We collect as little as we can get away with. This page says exactly what is stored, why, how long, and what you can ask us to do about it.
There is no Google Analytics here, no Plausible, no third-party tag of any kind, and no tracking cookies — which is why you were never asked to accept any.
We keep a self-hosted request log on our own server: the path requested, the referrer, the user-agent string, a country code from Cloudflare's edge header, and a salted hash of the IP address. The hash lets us count visitors without storing who they are. We keep this mainly to see which AI crawlers — ClaudeBot, GPTBot, PerplexityBot and the rest — read the site. Rows are deleted after 90 days.
One exception to the hashing rule: when a request is a recognisable attack —
probing for /.env, SQL injection, path traversal, a vulnerability
scanner's user-agent — we store the raw IP address alongside
the reason it was flagged. We need it to block the source and, where the traffic
is persistent, to file an abuse report with the network that hosts it. Legal
basis: legitimate interest in keeping the service available (Art. 6(1)(f) GDPR).
These rows are deleted on the same 90-day schedule.
If you subscribe to the dispatch we store your email address, the time you subscribed, and a hashed form of your IP address for abuse prevention. Signup is single opt-in: your address is added when you submit the form, and we immediately send a welcome email that contains an unsubscribe link.
Every dispatch carries a one-click unsubscribe link and the standard
List-Unsubscribe headers, so your mail client can unsubscribe you
without opening anything. Unsubscribing stops all sending immediately; write to
us if you also want the record deleted outright.
When you email [email protected] or any other Empero address, we keep the message for as long as we need it to deal with your request and to meet record-keeping obligations.
The public site sets no cookies. The admin area at
/admin sets one strictly-necessary session cookie for signed-in
operators; it is not used for tracking and never reaches visitors.
The site runs on our own server in Europe, behind a Cloudflare tunnel that terminates TLS. Cloudflare processes request metadata (including IP addresses) as part of delivering the connection. Model weights and code are hosted by Hugging Face and GitHub; visiting those links takes you to their platforms, under their privacy policies.
Under the GDPR you have the right to:
To exercise any of these, write to [email protected] — for a newsletter record, sending from the subscribed address is the fastest route.
Empero — independent AI research lab, Germany. Data-protection questions: [email protected].