Ivan Mišić product · tech · ai
Legal

Privacy
policy.

What gets collected, why, and what you can do about it.

Last updated
15 August 2026

1. Who Controls Your Data

The data controller for this site is Ivan Misić, based in Croatia. For privacy questions or to exercise your rights, use the contact page.

2. Information I Collect

This is a personal website with blog, tools, and guides. Here's exactly what I collect:

When you browse (no account needed)

  • Page view analytics - Page path, referrer, browser type, and a non-reversible hash of your IP address. For Toolshed items, I also record a privacy-safe view, download, or source-click event so I can understand aggregate use. I don't use Google Analytics or any third-party tracking.
  • Bot detection - I flag automated traffic at the time of the request so I can filter it from reports.

When you create an account

You can sign in with a magic link (email) or through Google, GitHub, or LinkedIn. I store:

  • Email address - Required. Used for login and communication.
  • Name, bio, avatar - Optional. You choose what to share.
  • OAuth provider data - If you sign in via Google, GitHub, or LinkedIn, I receive your profile name, email, and avatar from that provider. I store these to display on your account page.
  • Login tokens - Temporary magic link tokens (expire in 1 hour) and session data.
  • Topic interests & newsletter preferences - Your selections, stored to personalize your experience.

When you subscribe to the newsletter (no account needed)

You can subscribe without creating an account. In that case your email address is stored on its own, with no profile attached to it. I store:

  • Email address - Required. Used to send the newsletter, nothing else.
  • Confirmation and unsubscribe tokens - Stored as hashes, never in plain text. The confirmation link works once. The unsubscribe link keeps working, because you may click it from an old email.
  • The page you signed up from - The path only, so I can see which pages people subscribe from.
  • Timestamps - When you subscribed, confirmed, and unsubscribed.
  • IP address - Used to cap how many signups come from one address per hour. It is not stored alongside your subscription. If a signup is rejected as automated, the address and browser string are written to a spam log so I can tell real traffic from bots.

Signup is double opt-in. Typing an address into the form does not put it on the list. Nothing counts as a subscription until someone clicks the confirmation link in the email sent to that address, so nobody can sign you up for something you did not ask for. Confirmation links expire after 48 hours.

When you submit the contact form

  • Name, email, message - What you type into the form.
  • IP address and browser info - Collected for spam prevention.

When you access gated guide content

  • Email address - Used to send a verification link.
  • Access token - Stored in a cookie (1 year) so you don't have to re-verify.
  • IP address and browser info - For abuse prevention.

3. How I Use Information and the Legal Basis

The legal basis depends on why I process the information:

  • Accounts and authentication - I process your account, profile, login, and session data to provide the account service you requested. The legal basis is performance of a contract under Article 6(1)(b) GDPR.
  • Gated guide content - I process your email address, verification data, and access record to deliver and remember access to content you requested. The legal basis is performance of a contract under Article 6(1)(b) GDPR.
  • Newsletter - I use your email address to send the newsletter only after double opt-in confirmation. The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw consent at any time through the unsubscribe link.
  • Analytics - I process privacy-safe page-view and Toolshed engagement data to understand which content is useful and improve the site. The legal basis is my legitimate interest in measuring and improving this site under Article 6(1)(f) GDPR.
  • Spam and abuse prevention - I process limited request data to protect forms, accounts, content, and infrastructure from automated abuse. The legal basis is my legitimate interest in keeping the site reliable and secure under Article 6(1)(f) GDPR.
  • Contact messages - I use the details you submit to read and respond to your message. The legal basis is my legitimate interest in handling enquiries under Article 6(1)(f) GDPR.

I do not sell, trade, or share your information with third parties. I do not run ads. I do not build advertising profiles.

4. Cookies

I use functional cookies only. No tracking or advertising cookies.

  • Session cookie - Standard PHP session for login state. Expires when you close the browser.
  • Persistent login - When you sign in via OAuth (Google, GitHub, LinkedIn), a cookie keeps you signed in between visits (expires in 1 year).
  • Guide access cookies - One per guide you've accessed, so you don't re-verify each visit (1 year).
  • Cache variation - A cookie that tells my server cache whether you're logged in, so it serves the right version of pages.
  • Theme/settings - Your display preferences stored in localStorage, not cookies.

I do not use third-party analytics cookies. No Google Analytics, no Meta Pixel, nothing like that.

5. Third-Party Services

  • OAuth providers - If you choose to sign in via Google, GitHub, or LinkedIn, those services handle the authentication flow. I only receive the profile information you authorize. Each provider has its own privacy policy.

Fonts are served from this site. Public pages do not load them from Google Fonts. There are no CDNs, embedded social widgets, or third-party analytics.

6. Data Retention

Different data has different lifetimes. The 12-month purge applies to analytics only.

  • Analytics - Page view data and per-visitor Toolshed engagement records are retained for up to 12 months. Expired Toolshed records are then replaced with non-identifying aggregate totals. IP hashes are non-reversible.
  • Contact submissions - Kept until manually deleted by the site admin.
  • User accounts - Kept until you delete your account.
  • Newsletter subscriptions - Kept until you unsubscribe or ask me to erase the record. The 12-month analytics window does not cover them, because a mailing list that quietly deleted itself after a year would be broken. Unsubscribing marks the record as unsubscribed instead of erasing it, so the address cannot be added back by someone else later. If you want it gone entirely, ask via the contact page.
  • Guide access records - Kept for reporting purposes.

7. Your Rights

Depending on the processing and the circumstances, you have the right to:

  • Access - Ask for a copy of the personal data I hold about you.
  • Rectification - Ask me to correct incomplete or inaccurate data.
  • Erasure - Ask me to delete your personal data.
  • Restriction - Ask me to limit how I process your data.
  • Data portability - Receive data you provided in a portable format where this right applies.
  • Objection - Object to processing based on legitimate interests, including analytics.
  • Withdraw consent - Withdraw newsletter consent at any time. This does not affect processing that took place before withdrawal.

You can also use the controls already built into the site:

  • Delete your account - Go to your account page and use the "Delete Account" option. This permanently removes your profile, connected social accounts, topic interests, and any newsletter subscription linked to that account. A newsletter subscription you made without an account is separate: use the unsubscribe link instead.
  • Unsubscribe from the newsletter - Every newsletter email carries a one-click unsubscribe link. It works on its own, with no account and no login.
  • Unlink OAuth providers - Remove connected Google, GitHub, or LinkedIn accounts from your account page at any time.
  • Contact form data - Reach out via the contact page to request deletion of your submissions.

To exercise any of these rights, use the contact page. I may need enough information to verify that the request concerns your data.

You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) or the supervisory authority where you live or work.

8. Security

  • Passwords are never stored in plain text (I use magic links, not passwords).
  • IP addresses in analytics are stored as non-reversible HMAC hashes.
  • Newsletter confirmation and unsubscribe tokens are stored as hashes, not in plain text.
  • All forms use CSRF protection.
  • OAuth state parameters are validated to prevent cross-site attacks.
  • Disposable/temporary email addresses are blocked at registration.

9. Changes to This Policy

If this policy changes significantly, I'll update the date at the top. Continued use after changes means you accept the updated terms.

10. Contact

For privacy-related questions, reach out via the contact page.