what this site knows about you

who is responsible

Lagaluga is an independent publication, run by one person from the Netherlands. Under the General Data Protection Regulation that person is the data controller for everything described here.

For anything on this page, including a request to see or delete what the site holds, write to privacy@lagaluga.art. If you need the controller's name and address — to make a formal request, or to complain about one — ask at that address and you will be given them.

what the site collects

Your account. Signing up needs an email address and a password. Those are held by Neon Auth, the service that runs logins for this site, not in Lagaluga's own database. Lagaluga stores only the account identifier that service issues.

Your nerd. A nickname, an optional short bio, and the date the nerd was created. You choose all of it, and the nickname is permanent because it becomes the address of your page.

What you write. Lugas and takes, with the time you posted them and which nerd posted them. These are public. See the Terms for what public means here.

Audience measurement. Vercel Web Analytics counts page views. It sets no cookies and stores nothing on your device. It records the page, the referring page, a country, and a rough device, browser and operating system, and derives a visitor identifier by hashing your IP address and user agent. That hash is rotated daily and cannot be turned back into an IP address, so it cannot follow you between days or between sites.

Server logs. Vercel, which serves the site, keeps short-lived request logs that include IP addresses. They exist to debug outages and absorb abuse.

Fonts. Two typefaces load from Google Fonts, which means your browser asks a Google server for them and Google sees your IP address in the process.

Cover art. A luga can be about a record. Sleeves for those come from the Cover Art Archive, run by MetaBrainz and served by the Internet Archive, so a page showing one has your browser fetch an image from them and they see your IP address. Nothing about you is sent with it, and pages with no records on them contact nobody. Searching for a record goes the other way: Lagaluga asks MusicBrainz on the server and your browser never speaks to them at all.

what the visitor counter is not

The number in the taskbar tray is a single integer in a table. It is incremented and read back. There is no deduplication, no session, no cookie, nothing recorded about who bumped it, and bots count the same as people. It cannot tell you apart from anyone else because it never tried.

The "who's online" panel does not track presence. It picks names from the clock rather than from any actual visit, so your nickname may appear there whether or not you are on the site — and someone else's appearing there is not evidence that they are.

why, and on what legal basis

• Your account, your nerd and your posts — to provide the thing you signed up for. Legal basis: performance of a contract, Article 6(1)(b).
• Audience measurement — to know whether anyone is reading. Legal basis: legitimate interests, Article 6(1)(f). The interest is knowing the site is worth making; the impact is low because nothing is stored on your device and nothing is linked to your account.
• Server logs — to keep the site up and to deal with abuse. Legal basis: legitimate interests, Article 6(1)(f).

There is no advertising here, no profiling, no automated decision-making, and nothing is sold or handed to a data broker. There will not be, because the whole point of the counter is that this site does not measure people.

who else touches it

These companies process data on Lagaluga's behalf, under contract:

• Neon — the database, and the login service. Lagaluga's database runs in AWS eu-west-2 (London, United Kingdom).
• Vercel — hosting, request logs and audience measurement.
• Google — fonts only, and only as a consequence of your browser fetching them.
• MetaBrainz and the Internet Archive — record sleeves only, and only as a consequence of your browser fetching them. They are not processors: nothing of yours is given to them, they simply see the request.

The database sits in the United Kingdom, which is outside the EEA. Transfers there rest on the European Commission's adequacy decision for the UK. Vercel and Google are United States companies; transfers to them rest on the EU–US Data Privacy Framework and, where that does not apply, on the Commission's standard contractual clauses.

how long it is kept

• Your nerd and your posts — until you delete your account. Deleting a nerd deletes the lugas and takes attached to it in the same operation. There is no tombstone and no archive copy beyond routine database backups, which age out on their own.
• Server logs — days, not months. Vercel's retention window governs.
• Audience measurement — a rolling window set by Vercel's plan. It is aggregate and holds nothing that points back at you.

cookies and what is stored on your device

Lagaluga sets no advertising or analytics cookies. Signing in stores a session token in your browser so the site knows who you are from one page to the next. That is strictly necessary to run a feature you asked for, so it does not need consent, and signing out clears it. Nothing else is written to your device.

your rights

Under the GDPR you can ask to:

• see what the site holds about you (Article 15);
• correct it if it is wrong (Article 16);
• have it deleted (Article 17);
• restrict what is done with it (Article 18);
• receive it in a portable form (Article 20);
• object to processing based on legitimate interests, including audience measurement (Article 21).

Write to privacy@lagaluga.art and you will get an answer within one month. It costs nothing, and you do not have to explain why.

If the answer is unsatisfactory you can complain to the Autoriteit Persoonsgegevens, the Dutch data protection authority, at https://autoriteitpersoonsgegevens.nl. You can also complain to the authority in the EU country where you live.

children

Lagaluga is not for people under 16. No account is knowingly created for one. If you believe a nerd belongs to a child, write to privacy@lagaluga.art and it will be removed.

when this changes

The date at the top moves when the text does. A change that affects what happens to data already held will be announced on the site before it takes effect, not slipped in under a new date.