Privacy Policy

Last updated: 28 June 2026

This site is run by Thibault Milan, based in Luxembourg. I take privacy seriously — partly by conviction, partly because I'd rather not collect data I don't need. This page explains, plainly, what happens to your data when you visit or subscribe.

If anything here is unclear, you can reach me at hello@thibaultmilan.com.

Who's responsible

The data controller for this website is Thibault Milan (Luxembourg). I decide what data is collected and why, and I'm your point of contact for any privacy request.

Where the site lives

This website runs on Ghost, self-hosted on a Hetzner server located in Germany (EU). Your data stays within the European Union for hosting purposes, except where a specific third-party service (listed below) processes it elsewhere.

What I collect, and why

If you just read

When you browse the site, my server and Ghost's built-in analytics record minimal technical information — things like the pages you view, approximate referrer, and browser type. This is privacy-first analytics: no third-party tracking cookies, no cross-site profiling, no advertising networks. I use it only to understand which content resonates.

If you subscribe (free or paid)

To create a member account or receive the newsletter, I collect your email address (and your name, if you provide it). Paid members also go through Stripe for payment — I never see or store your card details.

I use this to:

• send you the newsletter and occasional updates you asked for,
• manage your membership and, if applicable, your subscription,
• reply to you if you get in touch.

You can unsubscribe at any time via the link in every email, or by managing your account.

The third parties involved

I keep these to a minimum, but a few services necessarily process some data:

• Ghost (self-hosted) — the platform itself, storing member accounts and content. Hosted by me on Hetzner (Germany, EU).
• Stripe — payment processing for paid memberships. Stripe is its own controller for payment data. (Privacy: stripe.com/privacy)
• Mailgun — delivers newsletter and transactional emails. Processes your email address to send mail. (Privacy: mailgun.com/privacy)
• Gravatar — loads author/member avatars based on email hashes (an Automattic service). (Privacy: automattic.com/privacy)
• Unsplash — some images are served from Unsplash's servers, which means they receive your IP address when those images load. (Privacy: unsplash.com/privacy)

I don't sell your data. I don't share it for advertising. Ever.

Cookies

This site uses only what's necessary to function — primarily a session cookie when you sign in as a member. There are no advertising or third-party tracking cookies. Because the analytics are cookieless and privacy-first, there's no invasive consent banner cluttering your screen.

How long I keep your data

• Member and subscriber data: kept as long as your account is active. Delete your account (or ask me to) and it's removed.
• Payment records: retained by Stripe and, where legally required, by me for accounting/tax obligations.
• Analytics: aggregated and short-lived; not tied to your identity.

Your rights

Under the GDPR, you can:

• access the data I hold about you,
• correct it,
• have it deleted ("right to be forgotten"),
• export it,
• object to or restrict its processing,
• withdraw consent at any time.

Email me at hello@thibaultmilan.com and I'll handle it. You also have the right to lodge a complaint with Luxembourg's data protection authority, the CNPD (cnpd.lu).

Changes to this policy

If the stack changes — a new tool, a removed one — I'll update this page and the "last updated" date above. Material changes affecting subscribers will be communicated by email.