Privacy Policy
The short version: nothing about you is stored on a server. Analytics run by default and every page says so, but no cookies and no stored IP addresses are involved.
Who is responsible
This is a personal blog. The address below is the data controller's contact point for everything described on this page: developer@cue.my.id.
What stays on your device
Two preferences are kept in your browser: your light/dark theme choice and whether you've seen the analytics notice. They never leave your device. No cookies are set for visitors — the only cookie this site can set is a short-lived one that protects the owner's login flow, and visitors never receive it.
Analytics — always on, and disclosed
Analytics run by default, provided by Umami and Cloudflare Web Analytics. The notice on every page tells you they're active; by continuing to browse you accept this.
The analytics are cookieless: they record the page you're on, the page you came from, your approximate country, and your browser and device in broad strokes. No cookies, no cross-site tracking, no fingerprinting, and raw IP addresses aren't stored. I also count a few anonymous events — like light/dark theme switches and uncaught errors (message and file, so I can spot breakage) — plain counters with no identifiers attached.
A notice on every page tells you they're active, and continuing to browse means you accept that. The control here brings the notice back up (it also lives in the footer of every page). This site sets no analytics cookies and keeps no identifier tied to you, so there is nothing for the providers to recognise you by across visits. Data already sent can be deleted on request — see Umami's privacy policy and Cloudflare's privacy policy.
Embedded content
Some posts embed third-party media. Each is set up to contact its provider as little as possible — but once an embed loads, that provider sees your IP address and user agent, and their own privacy terms apply.
- YouTube — loaded in privacy-enhanced mode: Google sees your IP when the player loads, but tracking cookies are only set after you press play. Google's privacy policy
- X/Twitter — posts appear as static snapshots, so viewing the page sends nothing to X. Only in rare fallbacks does the widget load, with do-not-track enabled. X's privacy policy
- Instagram — the embed only loads when the post scrolls into view; until then, nothing is sent. Meta's privacy policy
Fonts
The site's web fonts are self-hosted — they load from this site, and no third party sees a request for them.
Hosting & logs
The site is served by Cloudflare Pages. Cloudflare processes standard request metadata (including your IP address) transiently to deliver the site and protect it from abuse — see Cloudflare's privacy policy. I keep no server logs of my own.
What this site never does
No accounts, no comments, no newsletters, no advertising, no profiling, and no selling or sharing of visitor data — there is none to share.
Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection, plus the right to complain to your local supervisory authority. Because the site itself stores almost nothing about you, most requests concern third parties (Umami, Cloudflare) — email developer@cue.my.id and I'll help or point you to the right one.
Security
How to report a vulnerability — and what's in scope — is described in the security policy.
Changes to this policy
If what this site collects ever changes, this page will say so — the date below is the commit point.
Last updated 2026-09-29.