Privacy notice

Updated 11 September 2026

Who is responsible

I am the controller for personal data processed through this website:

Leonardo Gomes Cardoso
Am Nordbahnhof 1
10115 Berlin, Deutschland

Privacy requests: [email protected] or @leocardz.

Scope

This notice covers the public coming-soon website, contact, privacy, and terms pages. I will update it before advertising purchases go live.

Hosting and delivery

I host the website in the European Union on Fly.io (Fly.io, Inc.). Cloudflare, Inc. delivers the pages and protects the service against abusive traffic.

When you request a page, connection information such as your IP address, the requested address, request time, and browser or protocol information is processed to deliver the response and protect the service.

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, processes connection and request information, including IP addresses, browser and device information, and network or security data. It processes customer content and customer logs on my behalf and handles certain network and security data under its own privacy policy. Processing may take place outside the EEA, including in the United States. Cloudflare’s published data-processing terms describe reliance on the EU–U.S. Data Privacy Framework and, where applicable, EU standard contractual clauses.

The legal basis is my legitimate interest in operating a reliable, secure website under Article 6(1)(f) GDPR. The application does not keep an access-history database. Diagnostic or security records are kept only as long as needed to investigate faults or misuse, subject to legal obligations and the provider’s retention settings.

When you contact me

If you email [email protected], I process your email address, message, and anything you include so I can reply. Email is delivered and stored by Resend, Inc. (United States). Processing may take place outside the EEA. The legal basis is Article 6(1)(b) GDPR for steps related to a contract, or Article 6(1)(f) GDPR for other correspondence.

I keep correspondence until you ask me to delete it. I keep it longer only where a legal obligation or a legal claim requires it. Providing this information is voluntary; I cannot reply without a way to contact you.

Cookies and analytics

I use optional PostHog analytics in its EU hosting region to understand visits to the coming-soon, contact, privacy, and terms pages. The analytics code loads only after you select Accept. Declining loads no analytics and does not affect access. You can change or withdraw your choice at any time: . The legal basis is consent under Article 6(1)(a) GDPR. Withdrawal does not affect processing before withdrawal.

After acceptance, I send page views with a pseudonymous browser identifier, the public page path, and basic browser or device information through a Cloudflare-protected endpoint to PostHog. I exclude URL query strings, fragments, referrers, typed text, payment information, and ad submissions. Session replay, automatic click capture, and person profiles are off. Cloudflare and PostHog process connection information, including IP addresses, to deliver these requests.

Your consent preference is saved in local storage until you change it or clear site data. After acceptance, PostHog also uses browser storage for pseudonymous identifiers. Withdrawing consent stops capture and clears that analytics storage. Records already received follow the project’s retention; write to me for information or deletion. See PostHog’s privacy notice and privacy documentation.

I do not enable advertising trackers or embed third-party media on these pages. There is no public account, payment, or upload form on the coming-soon website. Cloudflare may use security cookies when protections are active; see its cookie documentation.

Who can receive information

Access is limited to me and the providers needed for hosting (Fly.io), delivery and security (Cloudflare), email (Resend), and PostHog when you accept analytics, plus authorities where the law requires disclosure. I do not sell your personal data.

Your rights

Subject to the GDPR, you may request access, correction, erasure, restriction, or portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. If processing relies on consent, you may withdraw it at any time without affecting earlier processing.

Send requests to [email protected]. You may also complain to a data protection supervisory authority, in particular in the EU country where you live, work, or believe an infringement occurred. Contacting me first is not required for that right.

Automated decisions

These public pages do not make decisions about you using automated processing that produce legal or similarly significant effects.