Privacy Policy

Who we are

This Privacy Policy explains how we collect, use and share information on 4fs.dev and in our newsletter. The controller of your personal data ("we", "us" and "our") is:

It is a one-person business: Cyryl Szmit, who makes Monasterium. There is no data protection officer; write to the address above about anything in this policy.

Information we collect

We collect information when you sign up for the newsletter, when you email us, and when your browser asks for a page. We do not buy or receive information about you from anyone else.

The newsletter

• Your email address.
• When you confirmed: our proof that you asked for the letters.
• Delivery data for each letter: whether it arrived or bounced, whether it was opened, which links in it were clicked, and an approximate location (the city) that Sender works out from your IP address.
• If you open the link in the confirmation email: that you clicked it, when, and the approximate location.

Every letter contains a tiny invisible image (a clear GIF) and tracked links, through which our newsletter provider, Sender, records whether you open it and which links you click. We use this only to judge which letters and topics are useful, not to profile you or to choose what to send you. Sender cannot switch this off for one reader, so to withdraw your consent to it, unsubscribe. Until then, turning off automatic image loading in your email program stops the open record.

Pressing Subscribe on the form is your consent to receive the newsletter and to this open and click tracking. We then send you one confirmation email. Letters start only once you open its link and press the button on the page it opens (double opt-in). If you do not, we send you nothing else.

The link in the confirmation email is tracked too: it goes through Sender's tracking address (campaign-statistics.com), which forwards you to 4fs.dev. Sender's service does not let us switch this off for that email. So Sender records the click, the time and an approximate location, whether or not you then confirm. You agree to this on the sign-up form, and we use it only to see that confirmation emails get through.

The form is our own and loads nothing from Sender: a small program on Cloudflare Workers passes your address from 4fs.dev to Sender and stores no addresses. So that nobody can use the form to flood someone's inbox with confirmation emails, it keeps for one hour a one-way code made from the address with a secret key, not the address itself.

Giving us your email address is voluntary, but without it we cannot send you the newsletter. Its rules are in the Newsletter Terms.

Emails you send us

If you write to contact@4fs.dev or press@4fs.dev, we get your email address, your name if you give it, and whatever you write. Both addresses are forwarded to our inbox by Cloudflare Email Routing. The inbox itself is an ordinary Gmail account, so Google stores the emails you send us, under its own Privacy Policy, as an independent controller.

Information that is automatically collected

When you open a page, your browser sends your IP address, the page address, your browser and operating system (the user agent), the page you came from (the referrer) and the time. It has to, for the page to load.

The request passes through Cloudflare, which delivers the pages quickly and protects the site from attacks; the files are hosted on GitLab Pages. Both use this data to deliver the page and keep it secure, and may keep it in logs for a limited time under their own rules. We run no server and keep no access logs ourselves.

No cookies and no tracking on the site

• No cookies and no browser storage: nothing in cookies, localStorage, sessionStorage or anywhere else on your device.
• No analytics: no analytics script, tracking pixel, fingerprinting or advertising.
• No cookie banner, because nothing that needs your consent loads until you ask for it.
• Self-hosted fonts: they come from 4fs.dev, not from Google Fonts.

The one thing that loads from another company is the trailer, and only when you press play (see The trailer and YouTube).

How we use your information

We use the information we collect to:

• send you the newsletter you asked for, and the one email that confirms your sign-up;
• judge which letters and topics are useful, from opens and clicks;
• see that confirmation emails get through, from clicks on their link;
• keep proof that you asked for the newsletter, and of when you left;
• answer the emails you send us;
• deliver the site and keep it secure;
• know roughly how many people visit (see Online analytics);
• comply with the law.

We do not sell your data, use it for advertising, or make decisions about you by automated means. We do no profiling.

When we disclose your information

Service providers

These companies help us run the site and the newsletter. Those marked "processor" handle data only on our behalf, for the services we use.

Sender (processor)

UAB Sender.lt, Lvivo st. 25, Vilnius, Lithuania (company code 302820904). Sends the confirmation email and the newsletter, measures opens and clicks (through its tracking address campaign-statistics.com) and stores the subscriber list, which Sender states is hosted in the European Union.

Cloudflare (processor)

Cloudflare, Inc., USA. Delivers every page, forwards our email addresses (Email Routing) and runs the program behind the newsletter form (Workers; see The newsletter).

GitLab (hosting)

GitLab B.V. (Netherlands) and GitLab Inc. (USA). Host the site's files on GitLab Pages, where Cloudflare fetches them, and handle the request logs under their own privacy statement, not as our processor.

Google Ireland Limited: Gmail and YouTube

Gmail hosts our inbox, so it stores the emails you send us, under Google's own Privacy Policy as an independent controller, not on our instructions. YouTube, as a separate controller, only if you press play on a trailer: see The trailer and YouTube.

Legal compliance

We may have to hand data to public authorities when the law requires it.

Legal basis for processing

Our legal grounds under the GDPR are:

• Consent (Art. 6(1)(a) GDPR):
  • sending you the newsletter. Polish law (Article 398 of the Electronic Communications Law of 12 July 2024) also requires your consent before we send you commercial information by email, and signing up is that consent;
  • recording opens and clicks, in the newsletter and in the confirmation email, which you agree to on the sign-up form;
  • loading the trailer from YouTube, which you agree to by pressing play.
• Legitimate interests (Art. 6(1)(f) GDPR), where our interests are not overridden by your interests or fundamental rights and freedoms:
  • running a working, secure website and knowing roughly how many people visit it;
  • sending the one confirmation email, to check that the address belongs to the person who entered it;
  • keeping the one-hour code described in The newsletter, so that nobody can use the form to flood someone's inbox;
  • keeping the proof of your consent and of its withdrawal, and keeping your address on the unsubscribe list, to show that we wrote to you only because you asked and to never write to you again by mistake;
  • answering the people who write to us.
• Contract (Art. 6(1)(b) GDPR): if you write to us about a contract with us, or about entering into one.
• Legal compliance (Art. 6(1)(c) GDPR): when the law requires us to keep or disclose data.

Where we rely on your consent, you can withdraw it at any time. This does not make what we did before unlawful (Art. 7(3) GDPR).

Online analytics

We use no analytics service. Cloudflare's dashboard shows us totals, such as the number of visits and the countries they come from, counted by its proxy, not by a script in your browser.

Your choices and rights

Email unsubscribe

Unsubscribe at any time with the link at the bottom of every letter (one click is enough), or by emailing contact@4fs.dev. Unsubscribing also withdraws your consent to open and click tracking.

Your rights under the GDPR

You have the right to:

• Access: get information about how we process your personal data, and a copy of it (Art. 15).
• Correct: have inaccurate data corrected (Art. 16).
• Delete: have your data deleted where there is no good reason for us to keep processing it (Art. 17).
• Restrict: restrict how we use it, for example while we check its accuracy (Art. 18).
• Transfer: receive the data you gave us with your consent or under a contract in a common machine-readable format, or have it sent to someone else (Art. 20).
• Object: object to processing based on our legitimate interests (Art. 21).
• Withdraw consent: where we rely on your consent, withdraw it at any time (Art. 7(3)).

To use any of your rights, write to contact@4fs.dev. We reply within one month.

Your right to object

You can object at any time, on grounds relating to your particular situation, to any processing based on our legitimate interests (Art. 6(1)(f) GDPR), listed under Legal basis. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims (Art. 21(1) GDPR).

Your right to complain

You can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl, or to the supervisory authority in the EU country where you live or work. We would like to hear from you first, though, so we can try to put it right.

International transfers

Some of our service providers are outside the European Economic Area. Cloudflare, Inc. and GitLab Inc. are US companies, and Google (Gmail and YouTube) may transfer data to Google LLC in the USA. All three state that they are certified under the EU-U.S. Data Privacy Framework, which the European Commission found adequate (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023). Where it does not apply, they rely on the Commission's standard contractual clauses. For Cloudflare, which processes data on our behalf, you can ask us for a copy of these safeguards at contact@4fs.dev.

Security measures

We take technical and organisational measures to protect your information against loss, misuse and alteration. We collect as little as we can, and the subscriber list is kept only at Sender. No transmission over the internet is completely secure, though, so we cannot guarantee that nobody will ever get unauthorised access.

Children

The newsletter is meant for people aged 16 or over. If we learn that we have the email address of someone under 16, we will delete it as soon as practicable.

Data retention

We keep information only as long as we need it for the purposes in this policy, or as long as the law requires:

• Newsletter: until you unsubscribe or withdraw your consent. After that we keep your address marked as unsubscribed, with the record of your consent and its withdrawal, so that we never write to you again by mistake, for as long as someone could bring a claim about it. Sender also keeps the past opens and clicks with that entry.
• Sign-ups never confirmed: we store none. Only Sender's sending log keeps a record of the confirmation email and of any click on its link, for the period Sender sets (one day on our plan, per Sender).
• The one-hour code for confirmation emails: one hour (see The newsletter).
• Emails you send us: as long as the conversation needs, and then up to 3 years after our last message, in case the matter is raised again or a claim arises.
• Technical logs: we keep none. Cloudflare and GitLab keep theirs for the periods set in their own policies.
• YouTube: as set by Google's Privacy Policy.

Third-party links and services

We link to Steam, Discord, Bluesky, Instagram, TikTok, YouTube, X and, for the press kit, Google Drive. These are plain links, with no embedded feeds, widgets or share buttons, so the other site learns nothing until you click; then its own privacy policy applies. Links to our Steam page carry tags (such as utm_source=4fs.dev) that tell Steam which button on our site you used, and nothing about you.

The trailer and YouTube

The trailer on our pages is a picture stored on 4fs.dev with a play button on top. Nothing from YouTube loads until you press that button.

When you press play, your browser loads the video from youtube-nocookie.com, YouTube's privacy-enhanced mode. From then on, YouTube receives your IP address, details of your browser and the address of our site (4fs.dev), and it may store cookies and similar data on your device. In the European Economic Area, YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which handles this data as a separate controller under Google's Privacy Policy.

Once it plays, the player also connects to other Google domains, including its advertising domain doubleclick.net. We cannot change which domains YouTube uses.

• Legal basis: your consent, given by pressing play (Art. 6(1)(a) GDPR). We do not remember that choice: after a reload the video is a picture again. To remove what YouTube stored, delete the site data for youtube-nocookie.com and google.com in your browser settings (some browsers file it under 4fs.dev).
• Without the embedded player: next to every trailer there is a plain link to watch it on youtube.com instead.

Changes to this policy

We may change this policy as the site and the newsletter change. We will post any changes here and update the date at the top. If a change matters to newsletter subscribers, we also tell them by email at least 14 days before it takes effect.

Questions about this policy

Questions about this policy? Write to contact@4fs.dev or to the postal address in Who we are.