What this site collects

Almost nothing. There are no accounts, no sign-in, and no forms to type into, so there is nothing you can submit and nothing we can store about you. The server keeps an ordinary request log — method, path, host, response status, response size, and how long the request took — which is what any web server records in order to be operated and debugged. Your IP address reaches our server as it must for the connection to work. Beyond that we count pageviews, and only if you allow it: see section 03.

Cookies

This site sets no cookie of its own. No session cookie and no preference cookie, because there is no account to keep you signed in to and nothing to remember between pages. The one exception is analytics, and it is yours to refuse: if you allow it, Google Analytics sets first-party cookies named _ga and _ga_*, which distinguish one browser from another so that two visits are not counted as two people. If you refuse, or simply ignore the banner, nothing is set and nothing is sent — the measurement script is not loaded at all, rather than loaded and told to stay quiet. Your choice is stored in this browser's local storage under sciensoft_cookie_consent, which is not a cookie and is never sent to us. You can change it whenever you like using the button below, and turning analytics off also deletes the cookies it had already set.

Cookie preferences

Third parties that see your visit

Three, and this is the part worth reading. Pages load a webfont from Google Fonts and several JavaScript libraries from cdnjs, which is operated by Cloudflare. Because your browser fetches those files directly, Google and Cloudflare receive your IP address and user-agent whenever you load a page here, and we do not control what they do with it. Serving both from our own domain would end that, and it is planned work rather than a promise already kept. The third is Google Analytics, which runs only with your consent and is described in section 03; until you give it, nothing is requested from Google's analytics domains at all. Once you allow it, Google receives the pages you view here, the site that referred you, your approximate location derived from your IP address, and your device and browser type. Google Analytics does not store your full IP address. Google Signals is switched off, this property is linked to no Google Ads account, and the page itself instructs Google to disable cross-device signals and advertising personalisation on every request it makes — so nothing collected here can feed ad targeting or follow you between devices. Separately, our site is served through Cloudflare, which therefore also sees the request. We use no advertising network and no tracking pixels, and we sell nothing to anyone.

Lawful basis

Two bases, for two different things. The request logs in section 02 rest on legitimate interest, Article 6(1)(f) GDPR: operating a website securely and being able to diagnose it when it misbehaves. Analytics rests on your consent, Article 6(1)(a) GDPR, and the storing and reading it involves additionally requires that consent under Article 11.7a of the Dutch Telecommunicatiewet, which implements the ePrivacy Directive. That is why nothing analytics-related loads until you agree, and why refusing costs you nothing: the site works identically either way.

Retention

Request logs are kept for 30 days and then discarded. If you allow analytics, Google retains the event data tied to your browser for two months from your last visit. That is the shortest period Google Analytics offers and the one we chose: what we actually read are aggregate counts — how many people came, which pages they read, where they arrived from — and those survive without a time limit because they identify nobody. Withdrawing consent stops further collection and deletes the cookies from your browser, but does not by itself erase what Google already holds; for that, use the rights in section 07 and we will pass the request on. Nothing else is retained, because nothing else is collected.

Your rights

Under GDPR, UK GDPR, and comparable laws you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. Where we rely on your consent you may withdraw it at any time under Article 7(3) GDPR, and withdrawing must be as easy as giving it: the Cookies section above carries the same control the banner offered, and it takes effect immediately rather than at your next visit. Withdrawal does not make what happened before it unlawful. In practice there is very little of yours here to act on, but write to the address below and we will answer within one month. You also have the right to complain to a supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

International transfers

Our own hosting is in the EU. Google and Cloudflare, named in section 04, are United States companies operating global networks, so a request for a font or a script may be served from outside the EEA, and analytics data is processed by Google LLC in the United States. Both are certified under the EU-US Data Privacy Framework, the adequacy decision the European Commission adopted in July 2023, and both also offer the European Commission's Standard Contractual Clauses as a fallback. Google acts as our processor for analytics under its Data Processing Terms. These are safeguards those providers put in place; they are not something we negotiated.

Children

This site is not directed at anyone under 16 and collects nothing that would identify a child. If you believe otherwise, write to the address below and we will look into it.

Changes to this Policy

We may update this Policy. The date at the top of this page moves when we do, and material changes are described here rather than made quietly.