Privacy
Short, because there is not much to say. This site collects one thing, only when you type it in.
Jukka Blomberg, Helsinki, Finland, acting in a personal capacity as data controller. Contact: hello@jukkablomberg.com. No data protection officer is appointed — that address reaches me directly. If we go on to work together, that engagement is contracted separately, under whichever entity we sign with, and carries its own privacy notice.
First, what is not true: the one-pager is not gated on your address. It is returned by the same request that carries your address, and it is returned even when the form fails. Nothing about giving me your email is what gets you the document.
If you use the form: your email address, which page you asked from, whether you ticked the optional updates box, and the date. That is the whole record, and it lives as one email in my mailbox — there is no database on this site. It is used for two things:
(1) So I can reply to you — Art. 6(1)(b) GDPR, a step taken at your request. The notification arrives with your address set as reply-to, so answering you is one click.
(2) So I can see that a real person asked, which is how I judge whether this document is worth keeping — Art. 6(1)(f), my legitimate interest in knowing whether my own work is read. Weighed against that: the data is one address, it is not combined with anything, it is not profiled, and it is not used to contact you unprompted. You can object to this at any time under Art. 21 — one email and the record goes.
(3) Only if you tick the optional box: occasional updates when something ships. That rests on Art. 6(1)(a) — your consent. It is separate, optional and unticked by default, the one-pager does not depend on it, and you can withdraw it at any time without affecting anything that happened before. Every message carries a one-click unsubscribe link; replying "stop" works too.
Nothing else on this site collects personal data. There is no contact form, no comments, no account, no login.
24 months if you opted in to updates; 12 months if you did not. Ask and it is deleted sooner — that is a one-line request, and I do not ask why.
Two processors touch it. Resend, Inc. (United States) delivers the notification email, and my mailbox provider stores it. Delivery via Resend is a transfer outside the EEA, made under the transfer safeguards in that provider's data processing agreement. If you would rather not have your address leave the EEA at all, write to me directly at the address above instead of using the form — the document is at /operating-system and I will not withhold it.
Your address is never sold, rented, traded or shared for anyone else's marketing. There is no automated decision-making and no profiling.
This site uses Google Analytics 4 to count page views and which links get clicked, and it currently loads on every page without asking you first. Being straight about that: under the ePrivacy rules, analytics storage is not strictly necessary and asking first is the correct behaviour. A consent step is an open item, not a settled position — it is written down and owed, and this notice will be updated when it lands rather than after someone complains.
What the analytics actually records is measurement-only and carries no personal data: page paths, which links were clicked, and for the one-pager form a source label, a boolean for whether you ticked the updates box, and an error reason if it failed. Your email address is never placed in an analytics event — that is enforced by an automated test that fails the build if any event object contains an "@" character.
In the meantime, any content blocker stops it, and nothing on this site breaks if you block it.
You can ask for access to your data, its correction, its erasure, restriction of its processing, a copy of it in a portable format, and you can object to its processing. Where processing rests on consent, you can withdraw that consent at any time. One email to hello@jukkablomberg.com is enough for any of these.
If you think this is being handled badly, you can complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman — tietosuoja.fi.