Privacy Policy

This policy covers the current website: articles, descriptions of activities and projects, contact information, and comments using Google sign-in. It does not describe a future learning platform.

Serhii Pelishenko / Сергій Пелішенко owns serhiipelishenko.com. He determines the purposes and means of processing the data needed to operate the website and its comments, and is the controller of that data.

For privacy enquiries or requests to access, correct or delete data, contact hello@serhiipelishenko.com.

• When you visit. Hosting and external resource providers receive technical request data: IP address, browser and device information, requested resources and time. GitHub Pages logs visitors’ IP addresses for security.
• When you sign in with Google. Firebase Authentication processes a UID, name, email and sign-in provider information. The owner has administrative access to these accounts. The website does not receive your Google password.
• In comments. Firestore stores the name, text, dates, article, reply relationship, depth and status. Public documents contain no Auth UID, email, tokens or avatar. The UID link is stored separately and privately; only the corresponding author and administrator may read it.
• Publication confirmation. For new contributions, the pre-submission notice version and server time of explicit confirmation are stored privately. Confirmation is not retrospectively created for older comments.
• For administration. Separate private records contain moderation, blocking, rate-limit, administrative permission and backup data. Authors may access only their own records as permitted by the rules; the administrator may access operational data.
• In correspondence. The sender’s address, supplied name, message, attachments and other information you send are processed.

Data comes from you, Google, browser requests and the operation and moderation of the discussion.

Different purposes use separate legal bases:

• Authentication. A legitimate interest in providing access to comments requested by the user and identifying the author, using only the data needed for this purpose.
• Publishing comments. Informed, voluntary consent to the public dissemination of personal data in the contribution. This is separate from signing in. Separate confirmation concerns publishing the name and contribution; the Auth UID remains private.
• Moderation. A legitimate interest in reviewing contributions and maintaining an appropriate professional discussion.
• Preventing abuse. A legitimate interest in protecting the website, users and administrative access, including rate limits and blocking.
• Correspondence. A legitimate interest in responding to ordinary enquiries. Handling legally required personal-data requests relies on the corresponding legal obligation.
• Backups. A legitimate interest in restoring data and discussion functionality, with limited retention and access to copies. Legally required records of processing rely on the corresponding legal obligation.

A legitimate interest applies only where processing is necessary and proportionate and the person’s rights and freedoms do not override that interest. It does not replace the basis required for public dissemination under Ukrainian law.

Visiting the website or signing in with Google is not blanket consent. Publication confirmation is requested separately before each new submission. It is not retrospectively created for older comments.

Disclosure to a public authority requires a specific applicable legal provision and verification of the authority’s powers, whether the request is binding and its scope. Receiving a request is not, by itself, a legal basis.

Comments sign-in lasts for the current tab session. Before sign-in, Firebase Authentication uses browserSessionPersistence with sessionStorage. Reloading and navigating between pages in that tab retain sign-in. A new sign-in is needed after the tab session ends; persistent “remember me” storage is not used.

On a shared device, explicitly sign out of comments: your browser may restore a closed session. Signing out of comments does not sign you out of Google. Closing a tab, signing out or clearing browser storage does not delete the server-side account or comments.

The comments module does not add analytics or advertising trackers; this is not a statement about the entire website or providers’ services. Device storage and access cover browser storage as well as cookies. Google cookies are described in Google’s explanation.

• GitHub Pages hosts the website. GitHub processes its own technical and security logs under its privacy statement.
• Google Sign-In, Firebase Authentication and Cloud Firestore provide sign-in and discussions. For user data processed on the owner’s behalf, Google acts as a processing provider under the applicable contractual terms. Use of the Google account itself and Google’s other independent processing are governed by Google’s policy. See also Firebase privacy and security, Firebase terms and the Cloud Data Processing Addendum.
• Google Fonts loads fonts; cdnjs / Cloudflare delivers Font Awesome icon files; jsDelivr delivers the article-rendering library. Your browser requests these resources from external servers and sends technical request data. For Cloudflare, see its privacy policy.
• Email providers process messages when you contact the owner by email. This is a separate channel from comments.

The website links to social networks and external platforms. Their rules apply after you follow a link. A link is different from embedded content that loads from an external server without following a link.

If you send an email, the name you provide, email address, message, attachments and other supplied information are processed to consider the enquiry, respond and continue related correspondence. The contact link opens your email application.

Do not send patient data, other people’s personal data, sensitive operational information, passwords or sign-in tokens. The website’s email and comments are not channels for providing medical care or transmitting clinical records.

If such information has already been sent or published, notify hello@serhiipelishenko.com without repeating the data itself. Restricting access, erasure and any legal obligations are assessed according to the circumstances; all copies are not automatically cleared.

The website is professionally oriented. Google sign-in is not age verification. If an enquiry concerns a child’s data, state this without sending their medical data; the requester’s authority and necessary actions are determined under applicable law.

Personal data are not sold or traded. Access is available to the owner and authorised administrators for their tasks and to providers delivering services. Published comment documents are accessible to anyone, including through the API. Disclosure to public authorities requires the grounds described in section 03.

The Firestore comments database is located in europe-central2, Warsaw, Poland. This is not the location of all website data: Google’s documentation states that Firebase Authentication stores data in the United States. Hosting, email, external resources and providers’ subcontractors may process data in other countries.

Under Ukrainian law, overseas transfers are assessed under Article 29, including adequate protection in the recipient country or another ground provided by law. The law recognises adequate protection in EEA states, parties to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, and states whose capital-market regulators are signatories to the IOSCO memorandum specified in the law. Transfers to the United States are not automatically prohibited and do not always require separate consent.

If the GDPR applies, its international-transfer rules require a separate assessment: adequacy decisions, appropriate safeguards such as standard contractual clauses, and derogations have different conditions. The EU decision concerning the United States covers organisations participating in the relevant framework, not every US recipient. This policy does not establish that a particular recipient is certified or that a specific agreement has been executed.

You may request information about recipients, processing locations and applicable safeguards at hello@serhiipelishenko.com.

The website uses HTTPS. Access to unpublished comments is limited to their author and the administrator; administrative actions require separate permissions. Public records intentionally have the open access described below.

Firebase’s documentation describes encryption in transit and encryption at rest for Firestore and Authentication. This describes the provider’s protection, and does not establish that the owner’s manual exports are encrypted.

No method of transferring or storing data guarantees absolute security. Protection also depends on accounts, devices, access settings and how backups are handled.

You may request access and information about processing, correction of inaccuracies, erasure where there is no lawful reason to retain data, object to processing, and withdraw consent where processing relies on it. Email hello@serhiipelishenko.com. Clearly describe the outcome you want; provide a comment link or information that helps locate your data if you know it.

A general erasure request does not require a list of every technical data store. The owner must check comments and residual identifiers, operational records, Firebase Authentication, correspondence and backups relevant to the request. The response should explain actions taken, remaining data, lawful exceptions and further treatment of copies.

Identity verification must be proportionate to the risk of disclosing or deleting someone else’s data. Your Google password, tokens or a mandatory passport copy are not required. Ukrainian law prescribes identifying particulars for a formal access request; if necessary, the owner will clarify the appropriate information and how to provide it securely.

• Access under Ukrainian law: assessment within 10 working days of receipt, with notice of approval or lawful refusal; fulfilment within 30 calendar days unless the law provides otherwise. A person’s access to their own data is not deferred under the rule for third-party access.
• A reasoned demand to stop processing or change the data’s composition or content: consideration within 10 days of receipt under the Model Procedure for Personal Data Processing. Inaccuracies are corrected without delay once established. Changes, erasure, destruction or access restrictions are notified within 10 working days after the action. These are distinct deadlines, not one deadline for all enquiries.
• If the GDPR applies: information on action taken without undue delay and within one month of receipt. Complexity or the number of requests may justify an extension of two further months, with reasons notified within the first month.

A moderator clearing text is not full personal-data erasure. Deleting this website’s Firebase Authentication account does not delete your Google account, which the website does not control. Lawful exceptions to erasure are assessed individually and do not automatically cover every record.

You may seek protection from the Ukrainian Parliament Commissioner for Human Rights or a court. If processing falls under the GDPR, its additional rights, including restriction and portability, and complaints to a competent supervisory authority apply under the Regulation’s conditions. An English-language website or a database in Poland does not, by itself, establish GDPR applicability.

For questions about this policy, data processing, comments or requests concerning your rights, contact Serhii Pelishenko at hello@serhiipelishenko.com.

Published comments can be read without signing in. Posting requires a Google account. New comments and replies undergo premoderation and become public after approval. The Ukrainian and English versions of an article share one discussion.

Before every submission, a notice explains that your name, text and date will become public after approval and links to this policy. You must explicitly select a checkbox that is initially unchecked. Signing in with Google is not consent to all forms of processing.

The public API includes the name, text, timestamps, status and technical comment and article relationships, but no Auth UID. The private author link and confirmation record are accessible only to the corresponding author and administrator. Pending and hidden comments are also accessible only to their author and administrator.

Read-only mode disables submissions. Hiding the block removes it from the interface and prohibits new submissions, but does not itself restrict public API access to previously published documents.

“Delete text” clears the name and text while retaining the document identifier, dates and reply relationships. The UID link and operational records remain private; the Firebase Authentication account is not deleted. This is not full anonymisation. Hiding or deleting a contribution on the website does not remove copies made by other people.

Do not publish patients’ or other people’s personal data or sensitive operational information. Comments are a public discussion, not a protected channel for clinical or operational exchanges.

No automatic cleanup schedule is implemented. Published comments are retained as part of the discussion, taking erasure requests into account. Pending and hidden messages require individual moderation review; operational data requires an assessment of its necessity for authorship, abuse prevention and handling enquiries. Different categories do not share one retention period.

A retention period of 30 days from export creation has been agreed for backups. Each backup requires a recorded manual deletion date; automatic deletion is not implemented. Backups are manually encrypted in a 7z archive using AES-256 and encrypted file names, then stored in a private Google Drive folder without shared access. The password is kept separately. Extraction and the file checksum are verified after downloading the uploaded archive.

A manual private Firestore backup may contain unpublished contributions, private UID links, confirmations and operational records. It is not placed on the website or in Git. There is no automatic export schedule, backup rotation or deletion.

The current deletion register is used during restoration to prevent deleted text and names from returning; it does not clear older backup files. Older backups are converted before restoration so that UIDs cannot re-enter public documents. Backups require separate review when handling erasure requests.

Signing out is not account deletion. A manual Firestore backup is not a Firebase Authentication backup. Logs and accounts in providers’ systems have their own retention periods under their terms and applicable law.

Material changes will be announced separately with a policy link, a description of the changes and an effective date. A change notice is not confirmation to publish new contributions and does not create consent retrospectively.

A new policy does not itself provide consent for new purposes or legitimise past processing. Where a different legal basis or new confirmation is required, a change notice alone is insufficient.