Mitchel van Emmerik
Privacy
This is a personal website. I don't sell anything, run ads or build profiles. Here is exactly what gets collected and why.
Who is responsible
Mitchel van Emmerik, Ridderkerk, the Netherlands, is the data controller for this website. For any question or request about your data, email mitchel@vanemmerik.net.
Analytics (only with your permission)
I use Google Analytics 4 to see which pages get read and roughly where visitors come from. When you first visit, a small banner asks whether that's OK.
- If you accept, Google Analytics sets cookies (
_gaand_ga_*, kept for up to 2 years) and records things like the pages you view, your browser and device type, your approximate location (country/city) and how you arrived. Google does not store full IP addresses for GA4. - If you decline, or haven't chosen yet, no analytics cookies are set. Google Consent Mode then only sends anonymous pings without identifiers, which Google uses to estimate visitor counts.
- Ad features are always switched off: no advertising cookies, no personalisation, no data for ads.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can change your mind at any time with the link in the footer of every page. Declining also removes the Google Analytics cookies. Your choice itself is stored in your browser's local storage (ga-consent), not on my server.
Google Ireland Ltd processes this data on my behalf, and it may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework. See Google's privacy policy. Analytics data is kept for 14 months, then deleted automatically.
Server logs
Like every web server, mine logs each request: IP address, date and time, the page requested, the referring page and your browser's user agent. I need these to keep the site running and secure (legitimate interest, Art. 6(1)(f) GDPR). The logs are only used for troubleshooting and abuse prevention, never shared and deleted after a limited period.
The site is self-hosted on my own server in the Netherlands, so no hosting company has access to these logs.
Blog view counter
Each blog post shows how often it has been read. To count every reader only once a day, the server combines your IP address and browser user agent with a random value that changes every day and keeps a short, one-way hash of the result. Your IP address itself is never stored, and the hashes and the random value are thrown away at the end of the day, so nobody, me included, can trace a hash back to you or recognise you the next day. Only the total per post is kept. No cookies or local storage are used. The legal basis is legitimate interest (Art. 6(1)(f) GDPR): knowing which posts get read.
Third-party content
- Google Fonts: the fonts are loaded from Google's servers, which means your browser sends your IP address to Google when it fetches them. Google says it doesn't use this to profile you and sets no cookies.
- Steam: the Kitsunekoni page shows avatars and game artwork loaded from Steam's image servers (Valve), which receive your IP address the same way.
- Links to LinkedIn, Twitch, Steam and other sites only send data to them once you click. From then on, their own privacy policies apply.
Your rights
Under the GDPR (in Dutch: AVG) you can ask to see, correct or delete personal data I hold about you, object to processing, restrict it or get it in a portable form. Email me and I'll respond within a month. Because analytics data is pseudonymous, I may need your Google Analytics client ID, which is in the _ga cookie, to find it.
If you think I'm handling your data wrongly, you can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Changes
If what this site collects changes, I'll update this page and the date at the top.