Privacy Policy

Effective Date: May 20, 2026
Website: underfitted.dev
Contact: [email protected]
1. Introduction and Data Controller

underfitted.dev (“the Website”) is a personal technical blog operated by an individual for informational and educational purposes. It is not affiliated with any corporation.

For the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, the Data Controller is the owner of the Website. You may contact the Controller regarding your privacy rights at [email protected].

2. How We Handle Analytics (Jetpack Stats)

We value user privacy and aim to minimize data collection while still understanding aggregate traffic trends.

This Website is hosted on WordPress.com and uses Jetpack Stats, an analytics feature provided by Automattic Inc., to measure aggregate traffic trends (e.g., page views, popular articles, referral sources).

  • Cookieless Measurement: Jetpack Stats does not set advertising or cross-site tracking cookies and does not build advertising profiles. We do not track your behavior across other websites or devices.
  • Limited Data: Jetpack Stats processes technical data such as your IP address and browser information to count visits and distinguish unique visitors. This information is used in aggregate to produce traffic statistics; it is not used to personally identify you or for advertising.
  • Processed by Automattic: Analytics data is processed and stored by Automattic Inc. on WordPress.com infrastructure, in its capacity as our hosting and analytics provider. It is governed by Automattic’s privacy practices and is never sold to third-party advertising networks.
3. Other Data We Collect

While we strive to minimize collection, the nature of web technologies requires processing some data to function securely.

A. Server Logs

When you access the Website, our hosting provider (WordPress.com, operated by Automattic Inc.) automatically logs standard technical information. This may include:

  • IP address
  • Browser type and version
  • Operating system
  • Time of visit and pages requested

These logs are retained strictly for security purposes (e.g., to detect DDoS attacks or technical failures) and are rotated/deleted regularly.

B. Voluntary Communication

If you send an email to [email protected], we will process your email address and the content of your message solely to reply to your inquiry. This data is not used for marketing lists.

C. Cookies (Functional Only)

The Website does not use cookies for advertising or analytics.

  • Core Functionality: If you are an administrator logging in, or if we enable a commenting system in the future, WordPress.com may set essential cookies required for authentication or session management. These are strictly necessary for the Website’s operation.

We process data under the following legal bases:

  • Legitimate Interest (Art. 6(1)(f) GDPR):
    • Security: Processing server logs is necessary to ensure the network and information security of the Website.
    • Analytics: We process aggregate analytics data via Jetpack Stats to understand and improve our content. Because this measurement is cookieless, limited to aggregate statistics, and is not used to identify you or for advertising, it has a minimal impact on user privacy. You may object to this processing at any time (see Section 7).
  • Consent (Art. 6(1)(a) GDPR): We will ask for your explicit consent before enabling any optional feature that might process personal data (e.g., a newsletter or third-party tracking embed), should we ever add one.
5. Data Sharing and Transfers

We do not sell, trade, or rent your data.

  • Service Providers: The Website is hosted on WordPress.com, operated by Automattic Inc. Automattic provides our hosting, analytics (Jetpack Stats), and spam protection (Akismet), processing data on our behalf to keep the Website running. We may also use an email provider to handle correspondence. These providers are bound by their own data-protection terms.
  • International Transfers: Automattic Inc. is based in the United States. Where your data is transferred outside the European Economic Area, it is protected by appropriate safeguards, such as the EU Standard Contractual Clauses.
  • Legal Requirements: We may disclose data if required by law or in response to valid requests by public authorities.
6. Embedded Content

Articles on this site may include embedded content (e.g., YouTube videos, GitHub Gists, Tweets). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, especially if you have an account and are logged in to that website.

7. Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate data.
  • Erase (“Right to be forgotten”) your data.
  • Restrict or Object to processing (specifically, you may object to processing based on legitimate interest).
  • Data Portability.

Because our analytics data is aggregate and not linked to your identity, we generally cannot isolate or delete analytics data relating to a specific individual. For other data (e.g., emails you send us), please contact [email protected] to exercise your rights.

8. Changes to This Policy

We may update this Privacy Policy to reflect changes in our technology or legal requirements. The specific “Effective Date” at the top of this page will be updated accordingly.