How this site handles data.

Anonymous usage counters

The site keeps a few aggregate counters - total visits, generic clicks, A* runs, live connections. These are global numbers, not tied to any person or device.

• No cookies, no localStorage, no sessionStorage are used for tracking.
• Raw IP addresses, user-agents, and device fingerprints are not stored for analytics. A salted IP hash is used only for security limits and live-count deduplication.
• Counters are kept on the server only, in aggregate form.

Booking form

When you request a slot, the form collects the strict minimum needed to review and confirm the meeting:

• Name - so I know who I am meeting.
• Email - to send the request receipt, acceptance or rejection, and any follow-up.
• Topic/message - so I know what the meeting is about and can prepare for it.
• Meeting address - only when you choose an in-person meeting, so the agreed location can be included in the request and confirmation. Address suggestions are limited to Belgium.

Retention: booking requests are kept up to 12 months after the meeting date, then deleted. Short-lived email verification rows are swept automatically. Pending requests may expire automatically if I do not answer in time. You can request deletion at any time by contacting me.

Browser storage (strictly necessary)

Two pieces of data are stored in your browser only - not for tracking, but to make the site work as you asked. Under ePrivacy these qualify as "strictly necessary" and do not require consent:

• Language preference - when you switch language, the choice is stored locally so the site stays in that language on your next visit.
• Maze game state - your best score and unlocked achievements for the A* Maze Builder game, so you can beat yourself next time.

Both stay in your browser only - they are never sent to any server. Clear your browser storage at any time to wipe them.

Anti-abuse protection

To protect the booking flow from automated abuse, the API uses Cloudflare Turnstile on the email verification step and rate limits requests by e-mail plus a salted hash of the visitor IP.

• The raw IP address is processed transiently to build the hash and to validate Turnstile; it is not stored.
• The IP hash is used to limit repeated e-mail-code requests and booking requests from the same network.
• The live counter also uses an in-memory client key derived from the IP hash so several tabs count as one live visitor.
• Old e-mail verification rows, including their IP hash, are swept automatically after the configured short retention period.

Calendars

When booking is in live mode, the event is created in my Google Calendar (or Outlook) only after I accept the request. Transactional e-mails for request receipts and decisions may be sent through Resend. Nothing else is shared beyond what is needed to process the request.

Your rights (GDPR)

You can exercise the following rights at any time:

• Access - get a copy of any personal data the site holds about you.
• Rectification - correct anything inaccurate.
• Erasure - have your booking record deleted.
• Objection or complaint - to me directly, or to the Belgian Data Protection Authority (autoriteprotectiondonnees.be).

Contact: [email protected]

Hosting

The public site runs on a VPS in the EU. Booking e-mails and calendar events may be processed by the configured providers mentioned above, only for handling the request. Cloudflare Turnstile may process challenge data to protect the booking form from automated abuse. In-person address suggestions may be looked up through OpenStreetMap/Nominatim and are restricted to Belgium.