Privacy policy

Who is responsible

I am Taras Slovak, an independent Shopify developer based in Ukraine. I run this website (taras-slovak.com) and decide what personal data it collects and why. I am also the person responsible for privacy here (title: owner).

Contact for everything in this policy: me@taras-slovak.com.

What I collect and why

If you write to me through the contact form: your name, your email address and your message. Used only to answer you. The form also keeps a one-way hash of your IP address (not the address itself), only to stop one sender from posting more than five messages an hour.

If you email me@taras-slovak.com: the sender's address and name, the subject, the text, and the names, types and sizes of attachments. Used only to read and answer your mail. Attachments are forwarded to my own mailbox but not kept in my inbox.

Every time a page is opened (the visit log): the IP address, the country, region and city that Cloudflare derives from it, the name of the network the address belongs to (for example an internet provider), browser, system and kind of device from the user agent, the address of the page, the website you came from (its name only, not the full address) and the time. Used to keep the site secure and to see which pages are read and where visitors come from. It is not used for advertising and is not combined with anything else.

Daily counters: how many pages were opened that day, how many different visitors (counted with a one-way hash that changes every day) and how often each project was opened. These hold no personal data.

On your device: if you press the light/dark switch, your choice is saved in your browser (local storage, key "theme"), only to show the site in that theme next time. It is never sent to me. The site sets no cookies for visitors, loads no advertising, no analytics from other companies, no social buttons and no fonts from other companies.

Links to other places: the demo store is a Shopify store and the footer links go to other websites. They have their own privacy policies, which I do not control.

Do Not Track and Global Privacy Control

If your browser sends the Do Not Track signal (DNT: 1) or the Global Privacy Control signal (Sec-GPC: 1), I do not record your visit at all: no row in the visit log and no count in the daily counters. This site does not follow you across other websites, so there is nothing else to switch off.

Who else receives the data

I do not sell personal data and do not share it for advertising. It is handled for me by two companies, only to run the site:

• Cloudflare, Inc. (USA): hosts the site, stores the database and the files, passes the traffic through its network and delivers mail sent to me@taras-slovak.com. Cloudflare privacy policy.
• Resend (USA): sends my replies and, if I have switched it on, a copy of each contact-form message to my own mailbox. Resend privacy policy.
• Slack (USA): tells me in my own Slack workspace that a contact-form message or an email has arrived, with the sender and the text, and answers my own commands with the visit log. Slack privacy policy.

Nobody else sees it, except where the law requires me to hand it over.

Where the data goes

I work from Ukraine, so the data is processed there. Cloudflare, Resend and Slack process it in the United States and in other countries where they operate. These companies are listed on the Data Privacy Framework List, including the UK Extension to the EU-U.S. Data Privacy Framework, and their data processing agreements also contain the EU Standard Contractual Clauses with the UK Addendum, which apply if the framework is not available. Sources: Cloudflare DPA, Resend DPA.

How long I keep it

• Visit log, and the daily visitor hashes: 90 days, then deleted automatically.
• Contact-form messages, received mail and my replies: 24 months from the message, then deleted automatically. Earlier on request (see below).
• Daily counters without personal data: kept.
• The theme choice on your device: until you clear your browser's data.

Your choices and rights

Write to me@taras-slovak.com and I will, for any person anywhere: tell you what I hold about you and send a copy; correct it; delete it; stop using it for something you object to. Where your law gives you more (for example restriction or a portable copy), I do that too; the last part of this policy lists them by region.

I answer within one month (within 30 days for requests under Canadian law). I may ask you to show that the request comes from you. The visit log can only be searched by IP address, so for it tell me the address you used and roughly when.

To keep your visit out of the visit log, switch on Do Not Track or Global Privacy Control in your browser (see above).

If you are unhappy with how I handled your data, write to me first; I will look into it and tell you the result. You can also complain to the authority named for your region below.

Security and children

The site is served over HTTPS. The database and the inbox can only be opened with a secret token that only I hold. This website is not meant for children and I do not knowingly collect their data.

Changes to this policy

The date at the top says when this text last changed. When a change matters to you (a new kind of data, a new company handling it, a longer term), I say so in a note at the top of this page for at least 30 days.

Additional information for residents of: EU/EEA, United Kingdom, California, Canada

The parts above apply to everyone. Below is what the law of each region adds.

EU/EEA (GDPR and the ePrivacy rules)

Legal bases (GDPR Article 6). Contact form and mail: Article 6(1)(b) when you ask about working with me (steps at your request before a contract), and Article 6(1)(f), my legitimate interest in answering enquiries. Visit log: Article 6(1)(f), my legitimate interest in keeping the site secure and knowing which pages are read. I weighed that against your interests: the log is not used for advertising, is not shared, is deleted after 90 days and is switched off by Do Not Track or Global Privacy Control.

Cookies. The site sets no cookies and writes to your device only the theme choice you asked for by pressing the switch, which the ePrivacy rules (Article 5(3) of Directive 2002/58/EC) allow without consent when it is strictly necessary for a feature you requested. The visit log is made on the server and reads nothing from your device. That is why there is no consent banner.

Your rights. Access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21). You can object to the visit log at any time by email or with Do Not Track or Global Privacy Control. There is no automated decision-making about you.

Complaint. You may complain to the data protection authority of the EU/EEA country where you live, work or where you think the rules were broken (Article 77). The authorities are listed by the European Data Protection Board.

Transfers. See "Where the data goes" above.

United Kingdom (UK GDPR, Data Protection Act 2018, PECR)

The same legal bases, rights and limits as for the EU apply under the UK GDPR and the Data Protection Act 2018: access, rectification, erasure, restriction, portability and objection.

Cookies (PECR). The site sets no cookies. Saving your theme choice on your device falls under the exceptions in Schedule A1 to the Privacy and Electronic Communications Regulations 2003: it is strictly necessary for a feature you requested and it only adapts how the website appears to your preference, and you can object by simply not using the switch or by clearing it in your browser.

Complaint. Write to me first: since 19 June 2026 UK law (section 164A of the Data Protection Act 2018) gives you the right to complain to the organisation, and the Information Commissioner's Office will usually ask whether you have done that. You can then complain to the Information Commissioner's Office.

Transfers. To the United States through companies listed in the UK Extension to the EU-U.S. Data Privacy Framework, with the UK Addendum to the Standard Contractual Clauses as a fallback (see above).

California (California Online Privacy Protection Act)

Effective date of this policy: 2026-10-11.

Categories of personally identifiable information collected through this website: name, email address and message text (contact form and mail); IP address and the location, network, browser and device details derived from it, pages viewed and referring site (visit log).

Categories of third parties it may be shared with: service providers that run the site for me: Cloudflare (hosting, database, mail delivery), Resend (sending email) and Slack (notifications to me). Nothing is sold, and nothing is shared for advertising.

How you can review and ask for changes to your information: write to me@taras-slovak.com; I will show you what I hold and correct or delete it (see "Your choices and rights").

How I tell you about material changes: by changing the date at the top of this policy and a note on this page (see "Changes to this policy").

How I respond to Do Not Track signals: a browser that sends Do Not Track or Global Privacy Control is not recorded (see above).

Other parties collecting information about your online activity on this website: none. There are no advertising, analytics or social-media scripts from other companies.

Canada, including Quebec (PIPEDA and Quebec Law 25)

Purposes. Why each kind of data is collected is stated above, before or when you give it. I use it only for those purposes.

Consent. When you send the contact form or an email you consent to my using your name, address and message to answer you; the purpose is obvious from what you do. You can withdraw this by email, and I will delete the correspondence unless I have to keep it. The visit log is limited to what is needed to run the site and is switched off by Do Not Track or Global Privacy Control.

Person responsible for privacy: Taras Slovak, owner, me@taras-slovak.com. Within my business only I have access to the data (the companies named above handle it for me). Complaints and questions go to the same address.

Access and correction. You may ask to see the personal information I hold about you and to correct it. I answer within 30 days.

Complaint. If I cannot settle it, you may complain to the Office of the Privacy Commissioner of Canada; in Quebec also to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Quebec: governance and technology. How long data is kept and how it is destroyed (automatic deletion) are in "How long I keep it" above; roles: within my business I am the only person with access; complaints: by email to the person above. The visit log derives an approximate location (city) from your IP address; it is not used to profile you, and Do Not Track or Global Privacy Control switches it off. Your information is processed outside Quebec and outside Canada: in Ukraine and in the United States.