Privacy Policy

Last updated: September 2026

This policy explains what personal data RiskiBits ("the site", "we", "I") collects when you visit riskbits.net, why, and what rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and Romanian data-protection law.

Who is responsible for your data

The data controller is Ionuț-Robert Sandu, Persoană Fizică Autorizată (PFA) registered in Romania, tax identification (CUI) 51596898, registered address B-dul Bucureștii Noi 136, parter, ap. 5, Sector 1, Bucharest, Romania.

Contact for any privacy question or request: hello@riskbits.net

The short version

• No advertising trackers, no third-party analytics cookies, no data sold or shared for marketing.
• Analytics are aggregate and cookie-free.
• The only personal data you actively give the site is your name and text when you post a blog comment — and that is published on the page by design.
• The newsletter is run by Substack; your email only reaches them if you choose to subscribe.

What we collect and why

1. Blog comments

If you post a comment, we store the name and comment text you type, plus a timestamp. This is saved in Cloudflare Workers KV storage and displayed publicly beneath the article. Comments are automatically screened by a profanity filter and limited to the 100 most recent per article; older ones are dropped.

• We do not require or store your email address or IP address for the current comment system.
• A small number of older articles still use a legacy comment box with an optional email field. On those pages the comment is stored only in your own browser (localStorage) and is never transmitted to us. These pages are being migrated to the system above.
• Legal basis: your consent, given by submitting the form. You can ask us to delete a comment at any time (see "Your rights").

2. Likes

The "like" button increments an anonymous counter per article. No personal data is involved. A flag is stored in your browser's localStorage so the button remembers you already liked a post on that device.

3. Newsletter (Substack)

The "Stay updated" form submits your email address to Substack Inc., which operates the newsletter. If you subscribe, your email is processed by Substack under Substack's privacy policy. We can see subscriber counts and aggregate statistics in the Substack dashboard. You can unsubscribe from any newsletter email.

4. Analytics

We use Cloudflare Web Analytics, a privacy-first analytics tool. It does not use cookies, does not fingerprint visitors, and does not track you across other websites. It reports aggregate figures only (page views, referrers, country, browser family). It cannot identify you.

5. Hosting, security and server logs

The site is hosted on Cloudflare Pages. As part of delivering and protecting the site, Cloudflare processes technical data such as your IP address, the pages requested, timestamps and user-agent string. This is used for content delivery, DDoS protection and abuse prevention, and is handled by Cloudflare as our processor under its Data Processing Addendum.

Legal basis: our legitimate interest in operating a secure, available website.

6. Cookies and local storage

RiskiBits sets no advertising or analytics cookies. Because we set no non-essential cookies, no cookie-consent banner is shown.

• localStorage (stays on your device, never sent to us): remembers which posts you liked, and — on legacy pages — any comment you drafted or posted there.
• Strictly necessary cookies: Cloudflare may set a security cookie such as __cf_bm to tell humans from bots. These are exempt from consent requirements and carry no marketing data.

Affiliate and external links

Some links are affiliate links (see our Affiliate Disclosure). We also link to Gumroad, Substack, LinkedIn, GitHub and various security resources. Once you leave riskbits.net, the destination site's own privacy policy applies. We are not responsible for how third-party sites handle your data.

Digital products

All templates and guides are sold through Gumroad. If you buy one, Gumroad — not this site — collects your name, email and payment details, as the seller of record and payment processor, under Gumroad's privacy policy. No payment or checkout happens on riskbits.net.

International data transfers

Cloudflare, Substack and Gumroad are based in the United States. Where personal data is transferred outside the EU/EEA, it is protected by mechanisms such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as set out in each provider's terms.

How long we keep data

• Comments: until you ask us to remove them, or until they roll off the 100-most-recent limit per article.
• Analytics: aggregate data is retained according to Cloudflare's retention schedule (about 6 months of detailed metrics).
• Server/security logs: retained by Cloudflare for a short period for security purposes.

Your rights

Under the GDPR you have the right to: access your data; have it corrected; have it erased; restrict or object to processing; and data portability. To exercise any of these, email hello@riskbits.net. For a public comment, tell us the article and the name/text used and we will remove it.

You also have the right to lodge a complaint with the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — dataprotection.ro.

Children

This site is intended for professionals and is not directed at children under 16. We do not knowingly collect data from children.

Changes to this policy

If this policy changes, the updated version will be posted here with a new "last updated" date.

Contact

Questions about privacy: hello@riskbits.net