Privacy policy

Last updated 3 September 2026. This policy covers the website moshimetrics.com.

This site is a set of static pages. It sets no cookies of its own, runs no analytics, loads no fonts or scripts from anyone else's servers, and has no tracking pixels or advertising tags. The only cookies you may receive here come from Cloudflare and are strictly necessary to serve and protect the page you asked for, which is why there is no consent banner. The short version is that we collect almost nothing. The rest of this page explains the "almost".

Who is responsible

Moshi Metrics is not yet a registered company. It is operated by Piotr Żmudziński, based in Warsaw, Poland, who is the controller of the personal data described here. You can reach him about anything on this page at [email protected]. If Moshi Metrics is later incorporated, this page will be updated with the new company's registered name, address and tax number before that change takes effect. No data protection officer has been appointed for the processing described on this page, because it does not meet the thresholds in Article 37(1) GDPR. Client projects are assessed separately.

Visiting the site

Our web server records each request so that we can keep the site working and spot abuse. The log holds the time, the page requested, the response status, the amount of data sent, the browser's user agent string and the referring page. It is configured not to store your IP address. Logs are deleted after 14 days.

Legal basis: our legitimate interest in operating and securing the site, under Article 6(1)(f) of the GDPR.

The two services in front of and behind the site

Two companies necessarily see your request before we do, and we cannot serve the site without them.

• Cloudflare, Inc. sits in front of the site as a content delivery network and security proxy. To route and filter your request it processes your IP address, the requested address and your browser details, and it may set a strictly necessary cookie such as __cf_bm or cf_clearance to tell human visitors from automated ones; under Article 399(3)(2) of the Polish Electronic Communications Act these are set without consent, because they exist only to deliver and protect the page you asked for. __cf_bm expires after 30 minutes of inactivity; cf_clearance is set only if you are shown a security challenge. Cloudflare is based in the United States. The transfer is covered by the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Cloudflare is certified; if that certification were ever to lapse, Cloudflare's data processing terms apply the Commission's standard contractual clauses instead. Write to us for a copy of the relevant safeguard.
• Hosting. The server is provided by mikr.us, a Polish hosting service, and stands in a Hetzner data centre in Finland. Your request data therefore stays inside the European Union at the hosting layer.

Writing to us

If you email [email protected] we receive your address, your message and anything you attach. The mailbox is run by Purelymail (Add Rabbit LLC), a small independent mail provider whose servers are in the United States, so that is where your message is stored. We deliberately do not use an advertising funded mail service for this address, and nothing you write is scanned for marketing. We have not put in place standard contractual clauses or another Chapter V safeguard for this specific transfer, and the provider is not listed under the EU-US Data Privacy Framework, so please do not send anything sensitive to this address; write one short line and we will move the conversation to an EU-hosted channel.

Giving us your email address is entirely voluntary and required by no law or contract. The only consequence of not giving it is that we cannot reply to you. We use what you write only to answer you and to discuss possible work. We keep correspondence for as long as the conversation is live and for up to 24 months after the last message, then delete it. Legal basis: taking steps at your request before entering a contract, and our legitimate interest in keeping a record of business conversations, under Article 6(1)(b) and 6(1)(f).

What we never do here

• We do not sell or rent personal data. If that ever changed, we would say so here before it happened, not after.
• We run no advertising, remarketing or audience tags on this site.
• We make no automated decisions about you and we do not profile you.
• We do not knowingly collect data from children, and this site is not aimed at them.
• We ask for no newsletter signup, so there is no mailing list to be on.

Client work is separate. When we build or run something for a client we act as their processor under a written data processing agreement, and that work is not covered by this page.

Your rights

Under the GDPR you can ask us to show you the personal data we hold about you, correct it, delete it, restrict what we do with it, or hand it to you in a portable form. You can object to processing we base on legitimate interest. Where we ever rely on consent you can withdraw it at any time without affecting what was lawful beforehand.

Write to [email protected] and we will answer within one month. In practice, since the only thing we are likely to hold is an email thread, "delete everything" is usually a same day job.

If you think we have handled your data badly you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the authority in the EU country where you live, work, or where the alleged infringement took place.

Changes to this policy

If we add anything to the site that collects data, a form or an analytics tool for instance, we will change this page before that goes live and update the date at the top. There is no archive of older versions, so the date is the version.