Privacy Policy

Effective Date: October 14, 2026

Your privacy is important to us. This Privacy Policy explains what information mzikmund.dev ("the Site") and the companion Martin Zikmund app ("the App") collect, why, and what you can do about it. The Site is operated by Martin Zikmund, who is the data controller for the processing described here.

1. Reading the Site

You can read every article, video listing and page on the Site without an account and without telling us who you are. Reading is anonymous.

When you visit, our hosting platform and our diagnostics service record technical request data — including your IP address, browser user agent, the pages you requested and the time of the request — so we can keep the Site running and diagnose faults. Your colour theme preference (auto, light or dark) is stored in your own browser and is never sent to us.

For diagnostics and basic usage statistics the Site uses Microsoft Application Insights, part of Microsoft Azure. When it is enabled, a script on each page sends page views, performance timings, errors and technical details such as your browser, operating system and IP address (used to estimate your approximate location, and then discarded) to Microsoft. It sets two cookies in your browser: ai_user, a random identifier that recognises a returning browser, and ai_session, which groups the pages of one visit. We do not use this data to identify you. See the Microsoft Privacy Statement.

Some articles embed videos from YouTube. When a page contains an embedded video, YouTube (Google) loads in your browser, may set its own cookies and receives your IP address and viewing information, as described in the Google Privacy Policy. We do not use the privacy-enhanced embed mode, so this happens as soon as the page loads, not only when you press play.

2. Advertising

The Site displays advertising from Google AdSense. Google and its partners may set cookies and similar identifiers in your browser to serve and measure ads. We do not receive your identity from Google. Where the law requires your consent for those cookies, the consent message is presented by Google itself rather than by us; the Site sets no consent cookie of its own. You can review and change your ad settings at Google My Ad Center and read how Google uses information from sites that use its services.

3. Signing In

You only need an account to post a comment, reply, upvote or report a comment. Sign-in is handled for us by Supabase, which acts as our processor and holds your account record: a user identifier, your email address, which sign-in method you used, and sign-in timestamps. We never see or store a password — password sign-in is disabled.

You can sign in in three ways, and each shares a different amount of information with us:

  • Google. We request the standard openid, email and profile scopes. Google returns your email address, your name and the web address of your Google profile picture.
  • Apple. Apple returns your email address, or a private relay address ending in @privaterelay.appleid.com if you chose to hide your email. Apple does not provide a profile picture, and provides your name only at the moment you first authorise the Site.
  • Email code. You enter an email address and we send a six-digit code to it. We receive nothing beyond that address.

4. Information We Store About Commenters

When you post, edit, upvote or report a comment, we create or update a record about you in our own database. It is built from your sign-in token — never from anything the browser or the App submits — and it contains:

  • Your Supabase user identifier.
  • Your display name, as shown next to your comments.
  • The web address of your profile picture, where your sign-in provider supplied one. The image itself stays on your provider's servers; your browser loads it from there when a page shows it.
  • Your email address (see section 6).
  • Whether you are currently blocked from posting (see section 10).
  • Your reply-notification preference, and the dates you first signed in and were last seen.

5. Comments, Votes and Reports

The text of your comment is stored exactly as you wrote it, together with a rendered copy used to display it, the time you posted it and the time of any edit. Comments are public. Your comment, your display name and your profile picture are visible to every visitor, are included in the page's HTML, and can therefore be indexed by search engines and copied by others. Please do not put anything private in a comment.

Upvotes are stored as a link between your account and the comment you voted on, so that a vote counts once and can be undone. Only the total is shown publicly; who voted is not.

If you report a comment, we store which comment you reported, the reason you selected, any note you added, and the fact that the report came from you. Reports are visible to the moderator, not to the public and not to the author of the reported comment.

6. Your Email Address and Future Notifications

Your email address is stored with your commenter record. It is never displayed publicly and never shared with other users. We do not currently send any email from the Site — reply notifications are not switched on. We retain your address so that reply notifications can be enabled later without asking you to sign in again, and your notification preference is stored alongside it. If and when notifications are enabled, you will be able to turn them off, and this policy will be updated before any message is sent.

7. Preventing Spam and Abuse

To stop automated and abusive posting we apply rate limits to the comment endpoints. These are counted against your account when you are signed in, and against your IP address otherwise. IP addresses are used transiently for this purpose and are not stored alongside your comments.

The comment form on the Site is protected by Cloudflare Turnstile, which acts as our processor. Turnstile loads a widget from challenges.cloudflare.com and processes your IP address, TLS fingerprint, user-agent header and our site key in order to distinguish people from bots. It may set Cloudflare cookies in your browser as part of that check. We receive only a pass or fail result, which we verify with Cloudflare on our server before accepting your comment.

8. Cookies and Browser Storage

The Site itself does not use a consent banner of its own. The following items are stored in your own browser:

  • Your sign-in session. After you sign in, the Supabase client library keeps your session in your browser's local storage under the key mz-auth, plus a short-lived mz-auth-code-verifier entry used while the sign-in redirect completes. This is what keeps you signed in; signing out or clearing site data removes it.
  • Your comment draft. If you start writing before signing in, your draft is saved in session storage so it survives the trip to your sign-in provider and back. It is discarded when the comment is posted or the tab is closed.
  • Your theme preference. Stored locally so the Site does not flash the wrong colours.
  • Diagnostics cookies (ai_user and ai_session) set by Application Insights, as described in section 1.
  • Advertising, video and bot-protection cookies set by Google (AdSense and YouTube) and Cloudflare as described in sections 1, 2 and 7.

The first three are necessary to provide features you asked for and are not used to track you. The diagnostics, advertising, video and bot-protection items are set by third parties and are not strictly necessary; you can block or delete them in your browser settings.

9. The App

The Martin Zikmund app talks to the same service as the Site and follows the same rules for comments, sign-in and moderation. It contains no advertising and no analytics. When you sign in, the App stores your session — your access and refresh tokens, and your email address and display name — in the app's own preferences on your device so that you stay signed in. Signing out removes it. The App does not run Cloudflare Turnstile; instead, comment rate limits apply as described in section 7.

10. Data Retention and Deletion

Comments are kept for as long as the article they belong to is published.

When you delete your own comment it stops being shown and is replaced by a placeholder, so that any replies underneath it are not orphaned. The underlying record — including the fact that you wrote it, and when — is retained. The same is true when a moderator hides a comment.

If a comment breaks the rules we may block an account from posting further comments. That block is retained for as long as it is in force. Existing comments from a blocked account are not automatically removed, and are hidden individually where warranted.

If you ask us to erase your data, we will remove the content of your comments, your display name, your profile picture address and your email address, and delete your sign-in account. Where a comment has replies we keep an anonymous placeholder in its place, so the conversation stays readable.

11. Your Rights

You can ask us at any time for a copy of the information we hold about you, or to correct it, erase it, restrict how we use it, or object to our use of it. You can also ask us to hand your data to you in a portable form. You can edit your own comment for a short window after posting, and delete it at any time, without contacting us.

We process comment data in order to provide the commenting feature you asked to use, and we process spam-prevention and moderation data on the basis of our legitimate interest in keeping the discussion usable.

Write to us using the address in section 16 and we will respond within one month. If you believe we have handled your data badly, you may complain to your local data protection authority; in the Czech Republic this is the Office for Personal Data Protection (uoou.gov.cz).

12. Who Else Sees Your Data

We do not sell your data and do not share it beyond the service providers we need in order to run the Site:

  • Supabase — sign-in and account storage.
  • Google and Apple — only if you choose to sign in with them.
  • Cloudflare — bot protection on the comment form.
  • Microsoft Azure — hosting, database and Application Insights diagnostics.
  • Google AdSense — advertising.
  • YouTube — embedded videos.

Some of these providers are based outside the European Economic Area, and data may therefore be transferred internationally under the safeguards those providers offer, such as standard contractual clauses.

13. Children

The Site is not directed at children under the age of 13, and we do not knowingly collect personal information from them. You must be at least 16 years of age to consent to the processing of your personal information in your country (in some countries a parent or guardian may do so on your behalf). If you believe a child has provided personal information through the Site, please contact us so that we can remove it.

14. Data Security

We take reasonable measures to protect your data from unauthorized access or disclosure: everything is served over HTTPS, comment content is sanitized on our server before it is ever displayed, and access to the database is restricted. However, please be aware that no method of transmission over the Internet or method of electronic storage is 100% secure.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. You are advised to consult this Privacy Policy regularly, as continued use of the Site is deemed approval of all changes.

16. Contact Us

If you have any questions or concerns about this Privacy Policy, or want to exercise any of the rights in section 11, please contact us at:

Email: martin@zikmund.dev

Thank you for reading, and for commenting.