Privacy policy

Last updated 8 October 2026. This policy covers the website moshimetrics.com.

This site is a set of static pages. It sets no cookies of its own, loads no fonts or scripts from anyone else's servers, and has no tracking pixels or advertising tags. A self-hosted, cookieless visit counter (described below) runs only if you allow it. The only cookies you may receive here come from Cloudflare and are strictly necessary to serve and protect the page you asked for. The short version is that we collect almost nothing. The rest of this page explains the "almost".

Who is responsible

Moshi Metrics is not yet a registered company. It is operated by Piotr Żmudziński, based in Warsaw, Poland, who is the controller of the personal data described here. You can reach him about anything on this page at [email protected]. If Moshi Metrics is later incorporated, this page will be updated with the new company's registered name, address and tax number before that change takes effect. No data protection officer has been appointed for the processing described on this page, because it does not meet the thresholds in Article 37(1) GDPR. Client projects are assessed separately.

Visiting the site

Our web server records each request so that we can keep the site working and spot abuse. The log holds the time, the page requested, the response status, the amount of data sent, the browser's user agent string and the referring page. It is configured not to store your IP address. Logs are deleted after 14 days.

Legal basis: our legitimate interest in operating and securing the site, under Article 6(1)(f) of the GDPR.

Counting visits

To know which pages are read, we run Umami, an open source analytics tool, on our own server (the same mikr.us server in Finland described below). It runs only if you allow it when the site first asks you, and you can change your choice at any time with the "Privacy settings" link at the bottom of every page. Your choice itself (allow or not) is remembered in your browser's local storage under mm-consent, so that we do not ask again on every page.

If you allow it, a small script loaded from umami.pzmud.pl sends us the page address without query parameters, the page title, the referring page, your browser, operating system, device type, screen size and language. On our server your IP address is used to work out your country and to compute a visit identifier: a one-way hash of your IP address, your browser's user agent, a fixed secret key held on our server and the current calendar month. The IP address itself is not stored. The identifier changes every month, so the stored statistics do not link your visits across months; because we hold the key, this is pseudonymous data, not anonymous data. The script sets no cookies and writes nothing to your device; it only reads one setting, umami.disabled, from your browser's local storage to check whether counting is switched off.

The requests pass through Cloudflare and the statistics are stored on our mikr.us server (both described below); no one else receives them. Only the controller sees the statistics. They are kept for up to 24 months and then deleted automatically.

Legal basis: your consent, under Article 399(1) of the Polish Electronic Communications Act and Article 6(1)(a) of the GDPR. You can withdraw it at any time with the "Privacy settings" link; this does not affect counting that took place before you withdrew it.

The two services in front of and behind the site

Two companies necessarily see your request before we do, and we cannot serve the site without them.

• Cloudflare, Inc. sits in front of the site as a content delivery network and security proxy. To route and filter your request it processes your IP address, the requested address and your browser details, and it may set a strictly necessary cookie such as __cf_bm or cf_clearance to tell human visitors from automated ones; under Article 399(3)(2) of the Polish Electronic Communications Act these are set without consent, because they exist only to deliver and protect the page you asked for. __cf_bm expires after 30 minutes of inactivity; cf_clearance is set only if you are shown a security challenge. Cloudflare is based in the United States. The transfer is covered by the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Cloudflare is certified; if that certification were ever to lapse, Cloudflare's data processing terms apply the Commission's standard contractual clauses instead. Write to us for a copy of the relevant safeguard.
• Hosting. The server is provided by mikr.us, a Polish hosting service, and stands in a Hetzner data centre in Finland. Your request data therefore stays inside the European Union at the hosting layer.

Writing to us

If you email [email protected] we receive your address, your message and anything you attach. The mailbox is run by Purelymail (Add Rabbit LLC), a small independent mail provider whose servers are in the United States, so that is where your message is stored. We deliberately do not use an advertising funded mail service for this address, and nothing you write is scanned for marketing. We have not put in place standard contractual clauses or another Chapter V safeguard for this specific transfer, and the provider is not listed under the EU-US Data Privacy Framework, so please do not send anything sensitive to this address; write one short line and we will move the conversation to an EU-hosted channel.

Giving us your email address is entirely voluntary and required by no law or contract. The only consequence of not giving it is that we cannot reply to you. We use what you write only to answer you and to discuss possible work. We keep correspondence for as long as the conversation is live and for up to 24 months after the last message, then delete it. Legal basis: taking steps at your request before entering a contract, and our legitimate interest in keeping a record of business conversations, under Article 6(1)(b) and 6(1)(f).

What we never do here

• We do not sell or rent personal data. If that ever changed, we would say so here before it happened, not after.
• We run no advertising, remarketing or audience tags on this site.
• We make no automated decisions about you and we do not profile you.
• We do not knowingly collect data from children, and this site is not aimed at them.
• We ask for no newsletter signup, so there is no mailing list to be on.

Client work is separate. When we build or run something for a client we act as their processor under a written data processing agreement, and that work is not covered by this page.

Your rights

Under the GDPR you can ask us to show you the personal data we hold about you, correct it, delete it, restrict what we do with it, or hand it to you in a portable form. You can object to processing we base on legitimate interest. Where we ever rely on consent you can withdraw it at any time without affecting what was lawful beforehand.

Write to [email protected] and we will answer within one month. In practice, since the only thing we are likely to hold is an email thread, "delete everything" is usually a same day job.

If you think we have handled your data badly you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the authority in the EU country where you live, work, or where the alleged infringement took place.

Changes to this policy

If we add anything to the site that collects data, a form or an analytics tool for instance, we will change this page before that goes live and update the date at the top. There is no archive of older versions, so the date is the version.