Política de privacidadePolítica de privacidade

1. Who is responsible

This site is run by Nuno Foros, an individual based in Portugal. For anything in this policy, including any request about your data, write to [email protected].

2. The short version

Browsing this site collects nothing about you by default, and there is no tracking of any kind until you actively choose to allow it. I only receive personal data when you choose to give it to me: by sending a message through the contact form, by asking for the newsletter, or by connecting your Patreon account to open the Vault.

3. Contacting me

When you send the contact form, I receive your name, your email address, the subject and your message, together with two technical details your browser sends anyway — its user agent (browser and device type) and the page you came from. These help me spot spam and understand the context of your message.

Your message is stored in the site's database, hosted by Supabase in Ireland, and a copy is passed to an automation server I run myself (n8n), which sends a short notice to my phone through Pushover (Superblock, LLC, United States) so I see it straight away. That notice contains only your name and the subject — not your email address or your message — and the automation server does not keep a copy once the notice is sent. To protect the form from abuse, your IP address is also used briefly to limit how many messages can be sent in a short time; it is held only in the server's memory for a few minutes and never stored.

If I reply, our correspondence continues by email. My mailbox is hosted by Apple on iCloud with a custom domain (Apple Distribution International Limited, Ireland). I keep your message and our correspondence until you ask me to delete them.

The legal basis is my legitimate interest in replying to people who write to me, and in keeping the form free of abuse. Pushover is based in the United States; the transfer relies on the safeguards the provider offers for international transfers, such as Standard Contractual Clauses.

4. The newsletter — only if you tick the box

The contact form has a box, unticked by default, for receiving occasional updates about new work and releases. Only if you tick it, your name and email address are sent to Loops (Loops, Inc., United States), the service that manages the mailing list. Every email has a link to unsubscribe, and you can also write to me to be removed.

Legal basis: your consent. Loops is based in the United States; the transfer relies on the safeguards the provider offers for international transfers, such as Standard Contractual Clauses.

5. The Vault and Patreon

The Vault holds downloads for supporters on Patreon. To open it you can sign in with your Patreon account (Patreon, Inc., United States). You choose on Patreon whether to allow this, and I never see your Patreon password.

When you do, Patreon tells me your Patreon user ID, your name, your email address, your profile picture link and your membership with me — its status, your tier and the monthly amount. I use this only to decide which downloads you can open. I keep a record of it in the site's database (Supabase, Ireland) so I know who my supporters are, and I delete it when you ask. When your membership changes — you join, change tier or cancel — Patreon tells the site, which updates that record so your access matches your membership straight away, and I receive a short notice on my phone through Pushover with your name, tier and monthly amount.

Signing in sets a session cookie that keeps you signed in for 24 hours; after that, you sign in again so your access reflects your current membership. Disconnecting removes the cookie straight away.

Legal basis: performing the membership you have with me — giving you the downloads your tier includes.

6. Analytics and advertising — only if you say yes

The banner offers two separate choices. Neither is switched on in advance, and accepting one does not accept the other.

Analytics loads Google Analytics 4 (Google Ireland Limited). It tells me how many people visit, which pages get read, roughly where in the world you are and what kind of device you use. It uses your IP address to work out your approximate location and then discards it. I use it to understand which work is worth showing more of.

Marketing loads the Meta Pixel (Meta Platforms Ireland Limited). It records that you visited, which pages you looked at, your IP address, and information about your browser and device. Meta may connect this to your Facebook or Instagram account if you have one — including if you have never interacted with me on those platforms — and may use it to target advertising.

Both are delivered through Google Tag Manager, which is itself only loaded once you have accepted at least one of the two. Nothing above is added to the page before that.

Refusing is one click, in the same place and with the same weight as accepting. You can change your mind at any time through "Cookie settings" at the foot of every page: withdrawing takes effect immediately and clears the identifiers these tools left in your browser.

Legal basis: your consent. Once data reaches Google or Meta, their own policies govern what they do with it.

7. Cloudflare

This site is served from a machine I run, reached through Cloudflare (Cloudflare, Inc. and Cloudflare Ireland Limited), which delivers it and protects it from attack and automated abuse.

To do that, Cloudflare processes your IP address and request information, and sets a strictly necessary cookie (__cf_bm) to tell humans from bots. It also gives me aggregate traffic figures — visit counts, countries and similar — which do not identify individual visitors.

The contact form is also protected by Cloudflare Turnstile, which checks in the background that the form is being sent by a person and not a script. It looks at signals from your browser and device for that single check; it is not used for advertising and sets no tracking cookie.

This is not advertising or profiling, and the site cannot be served without it, so it is not part of the consent banner. The legal basis is my legitimate interest in keeping the site available and secure.

8. Cookies and what is stored on your device

• Your cookie choice — remembers whether you said yes or no, so you are not asked again. Stored in your browser and never sent anywhere. It exists to honour your choice, so it needs no consent of its own.
• __cf_bm — set by Cloudflare to tell humans from bots. Strictly necessary.
• nf_patron_session — keeps you signed in to the Vault for 24 hours after you connect Patreon. Only set if you sign in. Strictly necessary for the service you asked for.
• nf_patreon_oauth — a one-time security code that protects the Patreon sign-in from forgery. Lasts at most 10 minutes and is removed once you are back. Strictly necessary.
• Admin session cookies — only ever set for me, when I sign in to manage the site. Never set for visitors.
• _ga and _ga_* — set by Google Analytics to count returning visits. Only with your analytics consent.
• _fbp — set by the Meta Pixel to recognise your browser across visits. Only with your marketing consent.

9. Where the site and its data live

The pages and images are served from a machine I operate, fronted by Cloudflare. The site's content — project descriptions, posts and images — sits in a database hosted by Supabase in Ireland. The same database holds contact messages and Vault member records described above, and nothing else about visitors.

The album artwork in the "now playing" panel is fetched by my server from Last.fm, and the photo of the last artist I saw live from Deezer, and both are passed on to you — so your browser never contacts Last.fm or Deezer directly.

10. Your rights

Under the GDPR you can ask me for a copy of any personal data I hold about you, to correct it, to delete it, to restrict or object to how I use it, or to receive it in a portable form. Where I rely on your consent, you can withdraw it at any time without giving a reason.

Write to [email protected] to exercise any of these. I will reply within one month.

If you think I have handled your data badly, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt.

11. Changes

If I change how this site handles data, I will update this page and the date above. If the change is significant — a new tracker, or an existing one used for a new purpose — I will ask for your consent again rather than relying on an answer you gave to a different question.