Privacy Policy

eduardobarbosa.net is a personal astrophotography archive run by me, Eduardo Barbosa, from Portugal. It is not a business and it sells nothing. For the purposes of the General Data Protection Regulation (EU 2016/679) I am the data controller, which means the decisions described below are mine.

You can reach me at archive@eduardobarbosa.net about anything on this page.

When you use the contact form

Your name, if you choose to give one, your email address, and your message. These are sent straight to my mailbox and nowhere else. There is no database behind the form and no third party form service in the middle, so your message exists as an email and nothing more. Your address is set as the reply-to so that answering you works.

To stop the form being abused

The form limits how many messages can be sent from one internet connection in an hour. Doing that requires holding your IP address in the server’s memory for up to an hour. It is never written to a file, never logged, and disappears whenever the site restarts.

When you simply visit

I use Cloudflare Web Analytics to count visits. It records the page you looked at, the site you arrived from if any, your country, your browser, operating system and device type, and a few measurements of how quickly the page loaded and responded for you.

Your IP address, your browser’s identifier and the rest of your request headers are hashed and discarded rather than stored. Nothing is written to your device, no identifier follows you between visits, and there is no way for me or for Cloudflare to recognise you as the same person twice. The figures I see are estimates rather than exact counts, which suits the only question I am really asking, which is roughly which photographs people look at.

One thing worth being plain about: the small script that does the counting loads from Cloudflare’s servers rather than from mine, so opening a page here does make a request to Cloudflare, and that request necessarily carries your IP address before it is discarded.

Hosting logs

The site runs on Hostinger, which keeps the standard server logs any web host keeps: IP address, time, the address requested, the browser’s identifier and whether the request succeeded. These exist for security and for working out what broke, and they are governed by Hostinger’s own retention policy rather than mine.

This site sets no cookies. Not for analytics, not for advertising, not for anything else. That is why there is no cookie banner: there is nothing to ask you to agree to.

There is one exception worth naming, because being accurate matters more than being able to claim a clean sweep. The site stores a single item called skipLoading in your browser’s session storage, which remembers that you have already sat through the opening animation so it does not replay every time you move between pages. It holds no information about you, it is cleared the moment you close the tab, and it is strictly necessary to deliver the site in the way you asked for it, so no consent is required for it under Article 5(3) of the ePrivacy Directive or Article 5 of Lei 41/2004.

The GDPR requires a legal basis for each purpose. Mine are:

Your contact message

Consent, Article 6(1)(a). You decided to write to me, and you can ask me to delete the exchange at any point.

Anti-abuse on the form

Legitimate interests, Article 6(1)(f). Keeping the form usable, weighed against an IP address held briefly in memory.

Anonymous visit counts

Legitimate interests, Article 6(1)(f). Knowing which images people look at and whether pages load quickly, without identifying anyone. No consent is needed because nothing is stored on your device.

Server logs

Legitimate interests, Article 6(1)(f). Keeping the site up and secure.

Two companies process data on my behalf, and both are bound by a data processing agreement:

• Hostinger, which hosts the site and the mailbox your message arrives in.
• Cloudflare, Inc., which counts visits.

That is the complete list. The Cloudflare counting script described above is the only thing on this site that loads from anyone else’s server. Beyond it there are no advertising networks, no tag managers, no social media pixels, no embedded videos or maps, and no comment system. The typefaces are served from this site rather than from Google.

The footer links to my profiles on AstroBin, Instagram and X. These are ordinary links, not embeds. Nothing loads from those sites while you are here and none of them can see you until you choose to click through, at which point you are on their territory and their privacy policies apply rather than this one.

The site itself, and the mailbox your message arrives in, are hosted by Hostinger on servers in France.

The visit counting is the one part that leaves Europe. Cloudflare, Inc. is a United States company running a global network, so the anonymous, hashed data described in section 02 is processed outside the EEA. Those transfers rely on the EU-US Data Privacy Framework, under which Cloudflare is certified, and on the Standard Contractual Clauses in Cloudflare’s data processing addendum. Keeping the data inside the EU is available on Cloudflare’s enterprise plans only, and this site is not on one.

I made that trade knowingly. The tools that would have kept the counting in Europe either cost money, could not run on this hosting, or would have put a tracking cookie on your device. Not asking you to dismiss a consent dialog seemed the better deal.

Your message

For as long as the conversation is useful, then deleted. If we are done and you would like it gone sooner, ask.

Visit statistics

Six months, then gone. Detailed figures for the first seven days, aggregated after that. There is nothing personal in them to delete.

Anti-abuse record

One hour at most, in memory only.

Server logs

According to Hostinger’s own retention schedule, which is short.

Under the GDPR you can ask me for a copy of any personal data I hold about you, ask me to correct it, ask me to delete it, ask me to restrict what I do with it, object to my processing it, or ask for it in a portable format. Where I rely on your consent you can withdraw it at any time, which does not undo anything done before you withdrew it.

In practice, for almost everyone reading this, the honest answer is that I hold nothing about you at all unless you have written to me. If you have, email archive@eduardobarbosa.net and I will deal with it. There is no charge and I will reply within a month.

If you are not satisfied with how I have handled it, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt (opens in a new tab).

The site is served over HTTPS throughout, and the contact form delivers over an authenticated, encrypted connection to the mailbox. The strongest protection here is structural rather than technical: there is no account system, no visitor database and no stored analytics identifiers, so there is very little to lose in the first place.

If the site starts doing something new, this page changes first and the date at the top changes with it. Anything that materially affects what is collected will be called out rather than quietly folded in.

This policy is written to the GDPR and to Lei 41/2004 of 18 August, which is how Portugal implements the ePrivacy Directive.