Stef's Blog

Privacy Policy

Effective and last updated: 23 October 2026

Stefan Caliaro operates stefs.site, a personal portfolio and independent blog based in Sydney, Australia. Contact [email protected] with privacy questions or requests. This policy describes this site's current features; external sites linked from it have their own policies.

Information and purposes

  • Hosting and security: Cloudflare delivers the site and processes network information such as IP addresses and request details to provide hosting, performance and abuse protection. Cloudflare Turnstile checks qualifying reader activity for automated traffic.
  • Private analytics: Umami Cloud receives page-view and usage information, such as visited pages, referring sites and browser/device information, to help understand readership and improve the site. The site's Umami script is configured to respect Do Not Track. Detailed analytics are not made public.
  • Engaged reads: a separate Cloudflare-backed feature records qualifying reads, approximate active reading time and broad source categories. Its database does not store raw IP addresses, full referring URLs, names or browser fingerprints. An hourly keyed IP hash limits abuse. Only aggregate article summaries are public. Read the reader-stats explanation for limitations.
  • Hearts: a random identifier stored in your browser is converted to an article-specific keyed identifier on the server to remember your reactions and enforce a maximum of 50 hearts per browser per article. Article totals are public; the server also keeps the keyed reaction record and creation time. This is a browser-based limit, not verified identity. Use “Remove my hearts” on the article to remove your saved hearts.
  • Comments: the current Giscus widget uses GitHub Discussions. Comments, account names, avatars and reactions you publish there may be public on both this site and GitHub. GitHub/Giscus process sign-in and widget requests under their own policies. Do not post private or sensitive information.
  • Chat and email: Drift loads on the homepage and may process network/device data, cookies or identifiers and messages, names or contact information you provide. Email and chat are used to respond to enquiries and manage correspondence. Do not send passwords, card details or other unnecessary sensitive information.
  • Support payments: “Buy me a tea” opens Stripe-hosted checkout. Stripe collects payment and billing information; payment details are not entered into or stored by this site's static pages. I may receive transaction details, contact information and receipts made available to the recipient by Stripe for payment administration and record keeping.
  • Embedded content: YouTube and other embedded media, externally loaded fonts and third-party widgets can receive your IP address, browser information and the page context when loaded, and may use their own cookies or storage. Following an external link also shares normal browser request information with its destination.

Browser storage and privacy choices

This site uses local storage for article font, text-size and letter-spacing preferences, your light/dark theme, a reader session with a 30-minute logical expiry and per-article heart identifiers. Expired reader sessions are replaced when reading resumes; entries can remain in browser storage until replaced or cleared. Theme and heart identifiers remain until cleared. Clearing storage resets these preferences and may prevent you from removing earlier hearts through that browser.

Do Not Track or Global Privacy Control disables the separate engaged-read collection; this does not disable every third-party service. You can block scripts, third-party cookies or embeds using browser controls, and clear site storage. Some features may stop working. You can read articles without posting comments, reacting, chatting or paying. This policy is an explanation of processing, not blanket consent to optional tracking.

Optional article narration

When you press Listen, your browser or operating system reads the article using its speech service. Available voices vary by device; the selector identifies on-device and online voices where reported by the browser. Online voices may send article text to the voice provider under its privacy practices. This site does not record your microphone or generate a downloadable audio file. Narration starts only when requested.

Retention

Reader verification/session records expire after 24 hours and hourly abuse-limit records after one hour. Expired records are cleaned up during later qualifying requests, so removal may be delayed while the site is quiet. Aggregate readership totals and keyed heart records have no automatic expiry at present. Heart removal deletes the matching reaction record.

There is no single automatic deletion period for correspondence, moderation records or payment records. They are retained as needed to handle enquiries, operate the site, resolve disputes, prevent abuse and meet applicable record-keeping obligations. Umami, Drift, GitHub, Stripe and other providers retain information under their own service settings and policies. Public comments and copies made by others may remain outside my control.

Sharing, overseas processing and security

Information is shared with providers needed to run the features above and may be disclosed where required by law or reasonably necessary to investigate abuse or protect people and systems. I do not sell visitors' personal information. Access to private administration is restricted, but no online service can guarantee complete security.

The providers operate internationally, and information may be processed or stored outside Australia, including in the United States and other locations used by them. This site does not guarantee Australian-only storage. Provider locations, subprocessors and safeguards can change; their current privacy notices explain their practices:

Access, correction, deletion and complaints

Email [email protected] to ask about information held about you, request access, correction or deletion, or raise a complaint. Include the relevant page or interaction and enough detail to locate the information without sending identity documents unnecessarily. I may need to verify the request. Some records cannot be linked to you, and legal obligations or third-party controls may limit deletion. You can also manage your comments through GitHub and contact providers directly.

I aim to respond to privacy enquiries within 30 days. This policy does not restrict rights available under applicable law. Where relevant, Australian privacy information and complaint options are available from the Office of the Australian Information Commissioner.

Updates

This policy will be updated when the site's practices change, with the revision date shown above. See also the Terms of Use.