Privacy & cookies
How merox.dev handles your data and privacy choices.
Last updated: 8 November 2026.
I am Robert Melcher, based in Timișoara, Romania, and I am responsible for the personal data processed through this website. For privacy questions or requests, write to hello@merox.dev.
You can read this site without an account or enabling analytics. I do not run a newsletter or advertising on this site, and there is no online checkout. Activated YouTube players may show YouTube’s own ads.
Optional analytics are off by default. Manage your analytics choice, or read how each service handles data below.
Hosting and security
The site is delivered through Cloudflare. Serving a page involves processing technical information such as your IP address, the requested address, request time and browser headers. This is used to deliver the site, diagnose faults and prevent abuse. The legal basis is my legitimate interest in operating a reliable, secure website, under Article 6(1)(f) GDPR.
Cloudflare operates a global network, so this processing is not limited to the EU. Its operational and security data is retained under the criteria in its privacy policy, including the time needed to operate and secure its services, resolve incidents and meet legal obligations. The separate Cloudflare Web Analytics browser beacon is blocked by this site’s security policy.
Depending on the security checks applied to a request, Cloudflare may use strictly necessary security cookies. These are separate from optional analytics; their names, purposes and lifetimes are described in Cloudflare’s cookie reference.
Email contact
If you email me, I receive your email address, the name you provide and the contents and attachments you choose to send. My email is hosted with Hetzner Online GmbH. The brief on the Services page only prepares a message in your own email app; nothing is submitted to the website.
I use this information to answer your enquiry and, where relevant, discuss work you have requested. The legal basis is taking steps at your request before entering a contract, under Article 6(1)(b) GDPR, or my legitimate interest in responding to other correspondence, under Article 6(1)(f). Providing this information is voluntary, but I need a return address and enough detail to answer you.
Ordinary enquiry messages are kept for 12 months after our last exchange, then deleted. If correspondence becomes part of a contract, a legal obligation or a dispute, the relevant messages may be kept longer, only for the applicable obligation or time needed to establish, exercise or defend a legal claim. See also Hetzner’s data protection information.
Please do not send passwords, private keys or other credentials in an initial enquiry.
Optional analytics
Umami Cloud is off until you enable it using the controls below. The legal basis is your consent, under Article 6(1)(a) GDPR. Refusing or withdrawing consent does not affect access to the site.
When enabled, Umami Software, Inc. receives page views, page paths and titles, the referring site’s origin, browser and device information, screen size, language and approximate location. Search parameters and URL fragments are excluded. I do not enable session recordings or heatmaps, or send names, email addresses, account IDs or custom visitor identifiers to Umami. Umami does not use analytics cookies, but it processes connection information, including IP addresses, to derive visit identifiers and approximate location. A raw IP address is not a standard field in the analytics records; infrastructure and security logs are separate.
My account uses the EU data region and the free Hobby plan, with six months of analytics retention. EU storage does not mean all supporting processing remains in the EU: network routing, security, support and operational logs may involve other countries. Backup and operational-log lifecycles are separate from the analytics retention period. See Umami’s Cloud FAQ, privacy policy and subprocessors.
Your analytics choice
Optional Umami statistics are off by default. You can enable them here, or withdraw your choice at any time. Reading the site works either way.
Your choice applies to this browser across both language versions for 180 days. You can return here through the footer to change it. Disabling analytics stops future collection; it does not undo processing that already took place. You may also contact me about data already collected, although the absence of a direct visitor identifier can limit my ability to locate a particular visit.
YouTube videos
Some older notes contain YouTube videos. No YouTube player or remote preview image is loaded until you choose Load from YouTube for that video. This is a separate choice from analytics and is not remembered between page visits.
Loading the player connects your browser to Google/YouTube, which receives technical information including your IP address and browser information and may use browser storage. I use the privacy-enhanced player, which limits personalization but does not eliminate Google’s processing. The legal basis for initiating this connection is your consent, under Article 6(1)(a) GDPR. Unload video removes the player and stops further interaction through it; it cannot reverse data already sent or remove storage set by Google. You can also follow the ordinary link to watch the video on YouTube instead.
Google’s processing, international transfers and retention depend on its service and your interaction with it; see the Google privacy policy and YouTube’s explanation of privacy-enhanced mode.
Cookies and local storage
The site does not set advertising cookies. These preferences are stored locally in your browser, rather than in a visitor account:
| Item | Purpose | Duration |
|---|---|---|
theme | Remembers an explicit light/dark preference. | Until the preference is reset or you clear the site’s browser storage. |
privacy-choice | Remembers whether you enabled or disabled optional analytics, with the choice date and notice version. It is not a visitor identifier. | Valid for 180 days; an expired choice is discarded on the next visit. |
These preferences support choices you explicitly request. Clearing the site’s browser storage removes them and returns analytics to off. Any Cloudflare security cookies or storage used by an activated YouTube player are described above. Fonts and diagrams are served from this site.
Recipients and international transfers
The providers involved are Cloudflare for delivery and security, Hetzner for email, Umami when you enable analytics and Google/YouTube when you activate a video. I do not sell your personal data. Information may also be disclosed where required by law or necessary to establish or defend a legal claim.
Where processing involves transfers outside the EEA, the applicable safeguards depend on the provider and destination, including adequacy decisions or Standard Contractual Clauses where required. Details are available in the Cloudflare DPA, Umami DPA, Hetzner’s data protection information and Google’s transfer framework information. You can contact me for information about the safeguards relevant to your data.
Your rights
Depending on the processing and the conditions in the GDPR, you can request access, correction, deletion, restriction or portability of your personal data. You can object to processing based on legitimate interests and withdraw consent for optional processing at any time, without affecting the lawfulness of earlier processing.
Send requests to hello@merox.dev. I normally respond within one month; if a lawful extension is needed, I will explain why. I may need proportionate information to verify your identity. There is no automated decision-making or profiling with legal or similarly significant effects.
You may lodge a complaint with Romania’s ANSPDCP, through dataprotection.ro, or with the competent supervisory authority in the EU country where you live or work.