Privacy
Privacy Policy
Plain English. The short version: I collect as little as I can, I set no tracking cookies, I never profile you or track you across the web, and I never sell anything.
Who runs this site
Gabriel Gruter is the data controller for gabrielgruter.com. I am a sole individual based in the UK. You can reach me about anything on this page by email at hello@gabrielgruter.com.
Which law applies
I handle personal data under the UK GDPR and the Data Protection Act 2018. If you are reading from the EU or EEA, the rights below are the same in substance.
What I collect
Almost nothing. There is no email list and no advertising.
The site runs Cloudflare Web Analytics, which counts page views. It sets no cookies, stores nothing on your device and does not fingerprint you, so it cannot recognise you here tomorrow or follow you to another site. It works out a visit by checking whether the page you arrived from was on this site. What it records is the page address, the address that referred you, your country, and the browser and device type. I only ever see the totals.
Whenever anyone loads a page, or requests an image, font or feed, my host records the request. That record includes your IP address, your browser's user-agent, the page requested and the time. This is how the page reaches you and how I keep the site available and defended against abuse. Your IP address counts as personal data, so I include it here.
If you use the light and dark toggle, the site stores a single value called "theme" in your browser to remember your choice. The site writes it only when you click the toggle. It never leaves your device, holds nothing that identifies you, and is not tracking. Because it is the only thing stored and it is strictly necessary to deliver the preference you asked for, there is no cookie banner.
Why I collect it, and my lawful basis
Server and edge request logs, including your IP: my legitimate interests (UK GDPR Article 6(1)(f)) in delivering the page you asked for and keeping the site secure and available.
Analytics: my legitimate interests (Article 6(1)(f)) in knowing which pages people read, so I can decide what to write next. Nothing is stored on or read from your device, so PECR does not require your consent for it and there is no banner to click.
Cookies and device storage
The site sets no advertising or analytics cookies, and the analytics script keeps nothing on your device at all. The only thing this site itself stores is the strictly necessary "theme" value described above, which is exempt from consent because it does nothing but remember a display choice you made.
One page is different. The audience tool linked in the footer sits behind a Cloudflare Access login while I am still building it, and loading that page sets a Cloudflare session cookie for the login itself. It is strictly necessary to run that gate and is there for nothing else. No other page on the site sets a cookie.
Who handles your data
Cloudflare, Inc. hosts the site and runs the analytics, acting as my processor for both under its data-processing terms. To serve each request it receives your IP address.
Where your data is handled
Cloudflare, Inc. is US-based, so hosting the site involves a transfer of personal data to the United States. That transfer relies on Cloudflare's certification under the EU-US Data Privacy Framework, including its UK Extension.
How long I keep it
I keep nothing myself. Server and edge logs are held only briefly, under Cloudflare's standard retention settings. Cloudflare keeps the analytics for six months. Only the first seven days are held in full, and after that it keeps a sample.
Automated decisions
There is no automated decision-making and no profiling. I do not analyse your behaviour to make decisions about you.
Your rights
- Ask for a copy of any data I hold about you, including in a portable format.
- Ask me to correct or delete it, or to restrict or object to how it is processed.
To exercise either, email hello@gabrielgruter.com. I will respond within one calendar month.
If you think I have mishandled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk. If you are in the EU or EEA, you can instead complain to the data protection authority in your own country.
Children
This site is not directed at children and I do not knowingly collect data from anyone under 13.
Changes to this policy
If I add a newsletter, this page will change first, before anything is collected. Material changes get a new date below.
Last updated 24 August 2026.