thomas androws_
Say hello

Privacy

Privacy and cookies

This site is run by Thomas Androws. Here is what it collects and why, in plain language. Last updated 3 October 2026.

The short version

  • Analytics only run if you accept them. If you reject, no analytics cookies are set.
  • I do not sell your personal data and I do not share it for advertising.
  • If you send a message or join the newsletter, I use your details only to reply or to send the notes.
  • You can see, correct, delete or take your data, and withdraw consent, wherever you live.

Who is responsible

Thomas Androws runs this site and decides how your data is used (the "data controller" under GDPR and the "data fiduciary" under India's DPDP Act). Contact: contact page, or email [email protected]. This address also serves as the grievance contact.

What I collect, why, and on what basis

  • Analytics data (pages viewed, device and browser type, approximate location, referrer, cookie identifiers). Purpose: to learn which articles help people. Basis: your consent.
  • Contact messages (name, email, message). Purpose: to reply. Basis: you asked me to, and your consent when you send it.
  • Newsletter (email address). Purpose: to send the weekly notes. Basis: your consent, given by ticking the box. I keep the date and time of that consent.
  • Server and security logs (IP address, request details), handled by Cloudflare. Purpose: delivering the site and stopping abuse. Basis: legitimate interest.

Analytics cookies (only with your consent)

Google Analytics 4 counts visits and shows which pages and articles are read. It sets the cookies _ga and _ga_*. Event data is kept for 14 months.

Microsoft Clarity shows heatmaps and anonymised session recordings so I can see where pages confuse people. It sets the cookies _clck and _clsk. Text typed into form fields is masked and never recorded.

Both tools are loaded through Google Tag Manager, and only after you accept analytics. Your choice is stored in a cookie called cc_cookie, which is necessary for the banner to remember you. Nothing non-essential is set before you choose, and rejecting is as easy as accepting.

Change or withdraw your choice

Use the Cookie settings link in the footer of any page to accept or reject analytics again at any time. Rejecting removes the analytics cookies from your browser. You can unsubscribe from the newsletter at any time by replying to any email or using the contact page.

Who receives your data

I use a small number of service providers to run the site: Cloudflare (hosting and spam protection), Resend (delivering form emails), Google (Analytics and Tag Manager) and Microsoft (Clarity), plus my email provider. They process data on my behalf. These providers may be located outside your country, including in the United States and India, so your data can be transferred internationally. Where the law requires it, this relies on safeguards such as standard contractual clauses or the provider's data privacy framework certification.

How long I keep it

  • Analytics event data: 14 months, then deleted automatically.
  • Contact messages: up to 24 months after our last exchange, then deleted.
  • Newsletter email address: until you unsubscribe or ask me to delete it.
  • Consent choice cookie: 6 months, then the banner asks again.

Your rights

EU, EEA and UK (GDPR): you can ask for access, correction, deletion, restriction, a portable copy, and you can object to processing or withdraw consent at any time. You can also complain to your local data protection authority.

California (CCPA/CPRA): you can ask to know what is held about you, to delete it, to correct it, and to opt out of sale or sharing. I do not sell or share personal information, and I do not use it for targeted advertising. I will not treat you differently for using these rights.

India (DPDP Act 2023): you can ask for a summary of the data held about you, correction, completion, updating and erasure, withdraw consent as easily as you gave it, nominate someone to exercise your rights, and use my grievance contact below. If you are not satisfied, you can approach the Data Protection Board of India once it is operational.

To use any of these rights, use the contact page or email [email protected]. I aim to reply within 30 days, and for India-based grievances within 90 days at most.

Children

This site is written for professionals and is not aimed at children. I do not knowingly collect data from anyone under 18. If you think a child has sent me their details, tell me and I will delete them.

Hosting

The site is served by Cloudflare. Like any host, Cloudflare processes technical data such as your IP address to deliver pages and protect the site from abuse. Spam protection on the forms may use Cloudflare Turnstile.

Changes

If this page changes in a way that matters, I will update the date at the top. This page is a plain language summary and not legal advice.