Privacy Policy

Last updated: 14 October 2026

This is a personal blog. I’m Alex Kovalev, I run koval.xyz on my own, and there is no company behind it. The short version: no analytics, no ad network, no tracking pixels. I don’t know who you are unless you email me, comment or subscribe. Below is everything that does leave your browser, and where it goes.

Hosting and Cloudflare

The site is a pile of static files on my own server (a VPS running nginx). Cloudflare sits in front of it for caching and to keep bots away, so every request passes through Cloudflare first. That means Cloudflare sees your IP address, your browser and the page you asked for. It also adds a small bot-detection script to the pages and may set a security cookie of its own (like cf_clearance). That part is Cloudflare’s, under their privacy policy.

My server keeps ordinary access logs: time, page, browser and an IP address, which is usually Cloudflare’s rather than yours, since the site sits behind it. I only look at them to debug something or to spot abuse, I don’t share them, and they’re deleted after 52 days.

No analytics

No Google Analytics, no Plausible, nothing like that. I don’t count visitors and I don’t build profiles. Fonts, images, scripts and the search index all come from this site, not from Google Fonts or some CDN.

What your browser remembers

The site itself sets no cookies. It does keep a few small values in your browser’s localStorage and sessionStorage, and they are never sent to me:

• theme: light or dark, if you picked one.
• The toys in posts remember their state: the owl’s filament color, how many times you fed the sourdough starter, which checklist boxes you ticked, whether you fixed the rack on the contact page, the terminal’s color and sound.
• The SSL and WordPress tools keep an unfinished order or your ticks in sessionStorage, which is gone when you close the tab.

Clearing this site’s data in your browser removes all of it.

Search

Search is Pagefind. The index is downloaded from this site and searched inside your browser. What you type doesn’t go anywhere.

Comments

Comments under posts and on the tools page run on giscus, which keeps them as GitHub Discussions in the public alexKov24/koval-comments repository. Nothing loads from giscus or GitHub until you scroll down to the comments. To write one you sign in with GitHub, and giscus then keeps a session token in this site’s localStorage (giscus-session). Your comment, GitHub username and avatar are public and live on GitHub, under GitHub’s privacy statement. You can edit or delete them there.

Newsletter

The form at the bottom of every page sends your email address, and only that, to Buttondown, the service that sends the emails. First you get a confirmation email, then one email per new post. Every email has an unsubscribe link, or just write to me and I’ll take you off. Buttondown keeps the list for me, and their privacy policy covers how.

Tools

Most of the tools (image crop and conversion, text diff, hashes, encoders, cron, Excel dates, SPF/DMARC) run entirely in your browser. Your files and text stay on your computer. Two are different, and say so on their pages:

• SSL certificate talks straight from your browser to Let’s Encrypt, without going through my server. Let’s Encrypt gets the domain names, the public key and the signed requests. The private key never leaves your browser. The “Check DNS” button asks Google Public DNS (dns.google) for the TXT record. And like every public certificate, the one you get is published in the Certificate Transparency logs.
• WordPress security check sends the address you type to a small scanner on my server, which then visits that site itself. Those visits go out through Cloudflare’s network (WARP), so the site sees a Cloudflare IP address, not yours and not my server’s. For every scan request it logs one line (time, your IP address, the site, the outcome and the score) to catch abuse. That log has a size cap, so old lines rotate out. The report stays in memory for 5 minutes, so a repeat scan doesn’t hit the site again, and the rate limits count scans per IP address and per site over the last few minutes, also in memory. A restart wipes all of it. To find known vulnerabilities, the scanner asks the public WPVulnerability database about the plugin and theme names and the WordPress version it found. Never the site’s address, never your IP.

Embeds and links

One post, fixing a font, has a Spotify player in it. It loads from Spotify when you scroll to it, and Spotify’s rules apply there. The synthesizer demos linked from this post are standalone pages that load fonts from Google Fonts and Fontshare and code from jsDelivr. There are no YouTube embeds, only links. Links to other sites in posts open in a new tab and don’t tell those sites which page you came from.

Your data

If you email me, the message sits in my Gmail inbox and I don’t add you to anything. If you want to know what I have about you, or want something fixed or deleted, write and I’ll sort it out. For most people the honest answer is “nothing”, because there’s nothing to have.

Contact

Alex Kovalev, privacy@koval.xyz. If anything here changes, so does the date at the top.