Privacy Policy

Who we are and what this covers

This site (the “Site”) is operated by Aryeh Kiovetsky (also known as Aryeh Stark and 21Stark, “we”, “us”). Aryeh Kiovetsky is the data controller and database controller for the personal data described in this policy.

This policy covers these domains: 21stark.com, www.21stark.com, aryeh.evinced-infra.group, and the Site's Cloud Run address (stark-personal-329729916035.us-central1.run.app). It does not cover other 21stark.com subdomains, or any third-party site you reach by following a link from here.

For any privacy question or request, email hi@21stark.com.

Analytics (Google Analytics 4)

We use Google Analytics 4 (GA4), and it does not run until you allow it. On every page we load Google's tag with analytics storage set to denied by default (Google Consent Mode v2), so no analytics cookie is written and no analytics identifier is created until you press Accept in the cookie banner. The banner offers Accept and Reject with equal prominence, and you can change your choice at any time through the cookie controls in the footer.

If you accept, GA4 collects: the pages you view (URL path and title, with the query string and fragment removed), the page you arrived from, on-page events, session information, an approximate location derived from your IP address (your full IP is not shared with us), a pseudonymous client identifier that distinguishes your browser from others, and general browser and device information. GA4 stores this at the event level.

We do not use GA4 for advertising: Google Signals, advertising personalization, and additional Analytics data sharing are turned off in the property.

Contact form

If you use the contact form, we store the name, email address, and message you type, plus a server timestamp and the path (not the full URL) of the page you sent it from. We use this only to read and reply to you. The stored record does not contain your IP address or browser user agent.

The AI assistant

If the AI assistant is available and you send it a question, your question is sent to a third-party AI provider to generate an answer, and the provider returns a response. The active provider is named in the notice shown beside the assistant. We do not keep a transcript of your questions or the answers. To limit abuse, a pseudonymized form of your IP address (a keyed hash, not the address itself) is used briefly to rate-limit requests. Please do not enter sensitive personal information.

The assistant can be served by Anthropic, OpenAI, or Google, depending on configuration. Anthropic, our default, retains API inputs and outputs for up to 30 days (longer only where required for safety or law) and does not use commercial API data to train its models by default. If we switch to a provider whose retention or training terms differ, we will update this policy first.

Blog engagement and preferences

We keep aggregate counts of how often a post is viewed and liked. These are totals for the post and are not tied to you; whether you personally liked a post is remembered only in your own browser. Your light or dark theme choice is likewise stored in your own browser and is never sent to us.

Server logs

Separately from the contact record, Google Cloud automatically creates technical request logs that may include your IP address, the requested URL, the referrer, your browser user agent, a timestamp, the response status, and latency. We use these logs to operate and secure the Site, and retain them for 30 days.

Cookies and local storage

• Analytics cookies: after you accept in the cookie banner, Google Analytics sets the _ga and _ga_<measurement-id> cookies to measure traffic. Both expire two years after they are set. If you decline, these cookies are not set, and any existing ones are cleared.
• Local storage (not cookies): your theme choice and which posts you liked are stored in your browser until you change them or clear your browser storage. They are never sent to us.
• Administration: a strictly necessary sp_session cookie is set only after a successful administrator login and expires after 12 hours. It keeps the operator signed in to the private admin area; no consent is required for it, but we disclose it here.

Legal bases (where the GDPR applies)

Where the EU General Data Protection Regulation applies, we rely on these legal bases:

• Contact messages: our legitimate interest in receiving and responding to correspondence you send us.
• Server logs and rate limiting: our legitimate interest in the security, reliability, and abuse-prevention of the Site.
• Google Analytics: your consent, given through the cookie banner and withdrawable at any time.
• The AI assistant: our legitimate interest in providing an optional feature you have affirmatively chosen to use.
• Aggregate post views and likes: our legitimate interest in measuring engagement with our content.

Service providers and international transfers

We use a small number of processors to run the Site. Each processes personal data for us under contractual data-processing terms:

• Google Cloud (Google LLC): hosts the Site and stores contact messages, post counts, and server logs. Processed in the United States (region us-central1).
• Google Analytics (Google LLC): processes analytics data, only after your consent. Processed in the United States and other countries where Google operates.
• Anthropic (Anthropic PBC), and, if configured, OpenAI (OpenAI, L.L.C.) or Google: process a question you send the AI assistant to generate a reply. Processed in the United States.

The Site runs in the United States, so if you visit from outside it, including the EU or Israel, your data is processed there and in other countries where our providers operate. For EU transfers we rely on the providers' standard contractual clauses; for transfers from Israel we rely on an applicable legal condition and the recipients' safeguards. You can request details of these safeguards at hi@21stark.com.

How long we keep data

• Contact messages: deleted 12 months after receipt, unless a documented legal reason requires keeping them longer.
• Google Cloud request logs: 30 days.
• AI rate-limit records: eligible for deletion two minutes after they are written; Google Firestore's time-to-live process normally removes them within 24 hours.
• Contact rate-limit data: held in memory for at most 10 minutes and never written to disk.
• AI provider inputs and outputs: retained by the provider (Anthropic: up to 30 days).
• Google Analytics: user and event data are retained for the period set in the GA4 property (the maximum for standard GA4 is 14 months); this setting does not remove standard aggregate reports.
• Aggregate post view and like counts: retained indefinitely, as they are not identifiable.
• Theme and like preferences: kept in your browser until you change them or clear your browser storage.
• Administrator session cookie: 12 hours.

Your rights

Where the law gives them, you have the right to:

• access the personal data we hold about you;
• have it corrected;
• have it deleted;
• restrict how we use it;
• object to our use of it;
• receive it in a portable form;
• withdraw your analytics consent at any time, through the cookie banner;
• complain to the Israeli Privacy Protection Authority or, in the EU, to your local supervisory authority.

Email hi@21stark.com to exercise any of these. Where the GDPR applies, we will respond within one month. We may need to verify your identity before disclosing data. Aggregate counters and browser-only preferences cannot be linked to a specific person, so we cannot act on those individually.

Children

The Site is not directed at children under the age of 16, and we do not knowingly collect their personal data. If you believe a child has sent us personal data, email hi@21stark.com and we will remove it.

Security

We take reasonable technical measures to protect the little data we hold, including transport encryption, access controls, and pseudonymization of the IP addresses used for rate limiting. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this policy as the Site changes. The current version is always the one on this page, with the last updated date shown at the top.

Contact

This Site is operated by Aryeh Kiovetsky (also known as Aryeh Stark and 21Stark), the data controller, based in Israel. For any privacy question or request, email hi@21stark.com.