Privacy

Privacy

Reading Hafrok is anonymous. The site sets no cookies, stores nothing on your device and carries no trackers or advertising, until you register. Registering is free and asks for your name and email address; it opens Hafrok's own analysis and the full record, and it sets two small cookies so the site knows you on this device. This page says exactly what is kept, where, for how long, and how you remove it yourself. It is checked against the code rather than described from memory.

What the site stores on your device

Nothing, unless you register or sign in. Then the site sets two cookies, and nothing else is kept in your browser's storage:

hafrok_r, your sign-in. It holds a random account number (not your name or address), a session number and an expiry date, signed so that it cannot be forged. Scripts on the page cannot read it. It lasts 90 days and is renewed when you visit while signed in.
hafrok_in, a marker. It holds only the value "1". It tells the page that this browser has registered, so the page knows to ask for your details; without it, a page makes no request about you at all. Same lifetime as the first.

Both exist only because you asked for a registered view, so the site does not ask you to accept them with a banner. Signing out, or deleting your account, removes both.

If you register

The form asks for your name and email address, and says under its button that registering includes news on the projects you follow (Hafrok Monitor), notices about your account and the occasional question about how Hafrok works for you; a box beside the button, unticked unless you tick it, adds Hafrok Commentary, updates to the Hafrok platform and a personal note from me now and then. Your registration is kept in a database on Cloudflare's network that is held inside the European Union: it is stored and run only there.

What is kept. Your name and address; when you registered; the projects, developers and countries you follow; whether each of the two mails is on (Hafrok Monitor, about what you follow, and Hafrok Commentary), with a record of each time that changed (when, from where, on or off); how often you want Hafrok Monitor (weekly or as it happens); which of those mails I sent you and whether one bounced, and whether the welcome mail itself bounced; the day you last visited while signed in; and when you first opened a link I mailed you. Three counts, nothing more: how many times you downloaded the workbook while signed in, how many sign-in links from my mails you used, and on how many days you opened a page while signed in. That is all of it.
What is never kept. Your IP address, your browser, your location, and which pages you read. To stop the form being used to send mail in bulk, Cloudflare counts attempts from one network address for a minute; that count is not stored by me and nothing is kept from it.
Why, for each use. Your name and address are kept to give you the registered view you asked for. What you follow is kept because you followed it, to send you Hafrok Monitor; switch that mail off or remove anything from your list whenever you like. Hafrok Commentary is sent because you ticked the box when you registered, or switched it on later; switch it off on your account page, or with one click in any Commentary mail, whenever you like. That box also covers news about the Hafrok platform, including if early access ends, if a price is ever introduced and what that would change for you, and a personal note from me now and then; switching Commentary off stops all of it. I may also write to you about your account, and once in a while to ask how Hafrok works for you: that is part of running the service, and I keep it rare. Anything that proposes business between us comes only if you ticked the box. The one notice that goes to every registered reader whatever their settings is one that affects the account itself, such as a date on which early access ends.
Who else sees it. Nobody for their own purposes: your details are never sold, rented or passed on, and they leave my hands only if the law compels it or Hafrok changes hands (below). The programs that run Hafrok handle them on my behalf and under contract: Cloudflare, where the database and the mail run, and Google, where my mailbox is. No AI service sees the registration database: it is read by the Worker that serves you and by me, and by nothing else.
If Hafrok changes hands. Your registration goes with it, under these same terms and for the same purposes, and you are told before it happens. Anyone who wanted to use it for anything else would have to ask you first.
The mails you get. A welcome when you register, with a link to your account page that signs you in and works for 7 days. A sign-in link whenever you ask for one, valid for 30 minutes. Hafrok Monitor when something on your list moved: on Monday mornings for the week before, or, if you choose it on your account page, on the morning after it is recorded (no mail when nothing did): its words are fixed text and the published facts on the site; only the links in it are yours. Hafrok Commentary, when I write one and while it is switched on: my own words, and news about the Hafrok platform. One notice to every registered reader if the terms of access ever change, with the date.
Stopping it. Every Monitor and Commentary mail links to your mail settings, which stop it without signing in, and the header your mail program uses for its own unsubscribe button, which stops that mail in one click. Nothing in a mail counts whether you opened it: the logo travels inside the mail and nothing is fetched from my servers. If a mail bounces, Cloudflare tells me; if every mail to an address bounces, the registration is deleted 30 days after the last one. If the welcome mail itself bounces, the address does not exist: that browser is signed out at once and the registration is deleted 30 days later. If you mark a mail as spam, both mails stop.
The mail I get. When you register, I receive one email with your name and address, so that I see who registers on the day it happens. My mailbox is Gmail: mail to hafrok.com is forwarded there, so Google holds that one email on my behalf, as it holds anything you write to me. Deleting your account removes your registration at once, but not that email from my mailbox. Ask me and I will delete it too.
How long. Until you delete your account, or 30 days after the last of my mails to you if every one of them bounced, the welcome mail included. Nothing is removed for inactivity and nothing is kept after deletion, apart from the one email above until you ask.
One hidden field. The form carries an invisible field that people never see and automated spam usually fills in. If it is filled, the submission is quietly discarded. It collects nothing about you.

If you signed up for updates earlier

Before registration existed, the site had a separate updates form. If you used it, what follows still describes what I hold about you.

The form asks for your name and email address. Nothing else: not your employer, not your job title. When you submit it, that goes to a small program on Cloudflare's network which checks it is not spam and emails it to me, at a Gmail mailbox that hafrok.com mail is forwarded to.

Why I have it. To send you occasional updates about Hafrok, and to know who I am writing to, because you asked me to write. Nothing else. It is never sold, shared or handed to anyone.
How long. Until you ask to come off the list, and then it is deleted. That is the whole retention policy.
How to leave. Reply to any update, or write to [email protected]. No form to fill in, no reason required, and it will not be quietly ignored.
A welcome email. One short message arrives straight away, confirming you are on the list and telling you how to leave it. That is the only automatic mail you will ever get from here; everything after it is written by hand.
One hidden field. The form carries an invisible field that people never see and automated spam usually fills in. If it is filled, the submission is quietly discarded. It collects nothing about you.

Who else sees you when you read the site

Cloudflare hosts and delivers the site. Like any web host it processes your IP address and standard request information to serve pages and to protect against attacks. If you register, it also holds your registration in the EU database described above and sends the mails. It does this on my behalf as a processor, under Cloudflare's data processing addendum, which carries the EU standard contractual clauses for anything Cloudflare processes outside the EU. The registration database itself is held only in the EU.
Google hosts my mailbox. Mail to hafrok.com is forwarded to Gmail, so the email I get when you register, and anything you write to me, sits with Google on my behalf under its own data processing terms. Nothing else about you goes there.
OpenFreeMap serves the background map tiles when you open the map, and only then. That request goes directly from your browser to tiles.openfreemap.org, so that service sees your IP address and roughly which part of the world you are looking at. Nothing else on the site contacts it.
Esri serves the satellite imagery, only if you switch the map's basemap to Satellite. Those tile requests go directly from your browser to Esri's servers (services.arcgisonline.com), so Esri sees your IP address and the area you are viewing, under its own terms. Leave the basemap on Navy and Esri is never contacted.
Cloudflare Web Analytics counts page views. Cloudflare adds a small script to each page as it delivers it, which records which page was opened, the page that linked to it, and the country the request came from. Cloudflare states that it sets no cookies, keeps nothing in your browser and does not fingerprint your device, and I see only totals: how many readers, which pages, which countries, which referring sites. I cannot see an individual reader, and I do not try to.
Downloads of the database workbook are counted. When the .xlsx file is downloaded, a small program on Cloudflare's network adds one to that day's count. It keeps only the date, the file name, a number, and whether the request looked like an automated one (judged from the browser's self-description, which is then discarded). No IP address, no browser details and nothing else about who downloaded it is stored.
Nobody else. The typefaces are served from this site, not from a font network, so no third party learns you were here by delivering them. There is no advertising, no social embeds and no third-party script other than the one above.

Your rights

Because I am based in Denmark, European data protection law applies. You can see what I hold about you, correct it, take a copy, object to it or have it deleted, and you can do each of these yourself on your account page: download your data as a file, change your name and your list, switch either mail off, sign out on every device, or delete your account at once. You never have to ask or explain. If you would rather write, or something is not covered there, write to [email protected].

If you think I have handled your data badly, you can complain to the Danish Data Protection Agency, Datatilsynet (datatilsynet.dk). I would rather you told me first, but the right is yours either way.

The practical bits