Privacy policy
Who is behind this site
This site is run by me, Zuzana Kocourková. I write under the name EshAlora. I am a private individual in the Czech Republic, this is not a business, and the site is not a commercial activity. Under the GDPR I am the controller of the personal data processed here.
You can write to me at eshalora@counterfiction.com.
This page is short because the site is simple. There is no login, no comments, no advertising, and nothing that requires your name.
What this site does not do
No cookies for analytics or advertising. Your browser stores your choice of light or dark mode. And if you switch analytics off yourself, that choice is stored too, so that it lasts. Both stay on your machine and are never sent anywhere.
No cross-site tracking, nothing handed to ad networks, no data sold. There is no Google Analytics and no tool that builds a visitor profile. No profile is created.
Why I am allowed to
Under the GDPR every kind of processing needs a reason. Here they are.
Analytics rest on my legitimate interest under Art. 6(1)(f) GDPR. The interest is specifically this: I need to know which texts people read so that I can decide what to write next, and I need to know whether the site works at all. I collect the smallest possible amount of data for that and connect it to no identity. You can object to this processing at any time.
Server logs rest on the same legitimate interest, specifically in keeping the site running and defending it against attack or abuse.
Replies to your emails rest on the legitimate interest in being able to correspond. If you write to me, you want an answer, and without your address you will not get one.
Your choice of light or dark mode is stored in your browser because you set it yourself. It is a feature you asked for, so it needs no consent.
Analytics
I want to know which texts people read, so that I know what is worth writing next. I use GoatCounter, analytics without cookies and without persistent identifiers. The data sits on servers in Germany and Finland, inside the European Union. GoatCounter is my processor and does nothing else with the data.
What gets recorded is the page you visited, where you came from, your browser type and your country. Aggregate counts are calculated from that. Your IP address is not stored, and individual pageviews are not stored as separate records, because I have that feature switched off.
To tell a new reader apart from someone who opens three texts in a row, GoatCounter groups your pageviews into a session. It does this by deriving a random number from your connection address and your browser identification, keeping it only in memory and for at most eight hours, and then discarding it. That link is never written to the database.
I delete analytics data after twelve months.
I have no access to your name, your address, or anything that would connect the statistics to a specific person, and I do not try to. But I do not want to claim more than is true: this is still data that relates to you, which is why I describe it in this much detail.
I host the counting script on my own server rather than loading it from someone else's domain. Third party code at a third party address is a risk even when the third party is decent: if anyone swapped it, it would run here too.
I have used that to make one change. The original version of the script sent your screen width with every pageview, even though I have that item switched off in GoatCounter. That setting only decides whether the server keeps it, not whether it leaves your device. My version does not send it at all, so the list above holds literally.
If you would rather not be counted at all, there are two ways. Switch on script blocking in your browser. Or open any page with #toggle-goatcounter appended to the address, which turns analytics off in that browser until you turn it back on the same way. That second route stores one item in your browser, namely that choice of yours. The site works exactly the same either way.
Why there is no consent banner. Under the European rules on electronic communications, consent is required where a site stores something on your device or reads something from it. This site stores nothing except your mode preference, which you asked for yourself, and the analytics work only with what your browser sends to every server anyway. That is why there is no banner. If I ever start using something that reaches into your device, I will ask first.
Where the site runs
The site runs on Netlify (Netlify, Inc., San Francisco, USA). Netlify is my processor, it serves finished HTML to visitors, and like any web server it keeps operational logs containing the visitor's IP address, the time, and the page requested. Those serve to run the service and defend against attacks.
This means data reaches the United States, outside the European Union. Netlify has Standard Contractual Clauses approved by the European Commission in place for this transfer, which is the safeguard required by Art. 46 GDPR. On request I will send you a link to their text.
I do not use the individual visit logs myself and have them connected to nothing. Netlify retains them under its own terms.
If you write to me
There is a contact address on this site. If you write to me, I will have your address and the text of your message, because otherwise I could not reply. I use it only to reply, I pass it to nobody, and I do not add you to any mailing list.
I keep correspondence for three years from the last message, because topics do come back. Where it is clearly a one-off question, I delete it sooner. I delete it on request at any time.
Newsletter
There is a field on this site for subscribing to updates. It is voluntary and the site works exactly the same without it.
What I will hold about you. Your email address, the language of the page you subscribed from, and a record of when and how you confirmed the subscription. That last one is not curiosity, it is the proof of your consent that I have to be able to produce.
On what basis. This is the only case on this site where processing rests on your consent under Art. 6(1)(a) GDPR, not on legitimate interest.
How that consent comes about. Entering your address does nothing on its own. You get an email with a link, and the subscription only starts when you click it. If you do not click, the address is used for nothing. This is called double opt-in and I do it so that nobody can sign you up but you.
Who sends it. Addresses are stored with Ecomail (Ecomail.cz s.r.o., Prague), which is my processor. I pass them to nobody else and sell them nowhere.
For how long. I keep your address until you unsubscribe. Every email contains an unsubscribe link and one click is enough. If a subscriber does not open a single email for two years, I delete the address myself, because the interest is clearly gone.
You can withdraw consent at any time, either through that unsubscribe link or by writing to eshalora@counterfiction.com. Withdrawing does not affect what happened before you withdrew.
The newsletter contains links to new articles. I send no advertising and let nobody else into it.
Who else can reach the data
Nobody I would send it to. Technically it does pass through four services that work for me as processors:
- Netlify, running the site, United States
- GoatCounter, analytics, servers in Germany and Finland
- Forpsi, the email mailbox, Czech Republic
- Ecomail, sending the newsletter, Czech Republic
I pass nothing to anyone else, sell nothing, and use nothing for advertising.
Your rights
You have these rights against me, and writing to eshalora@counterfiction.com is enough:
- to know whether I process anything about you, and get a copy
- to have inaccurate data corrected
- to have data erased
- to have processing restricted while something is being sorted out
- to receive data in a machine readable form and take it elsewhere. This applies to the newsletter, which rests on consent. It does not apply to analytics or to correspondence.
I will handle it within a month at the latest. If you ask and I am simply unable to find you in the data, because I hold no identity for it, I will tell you so straight.
Right to object. Analytics and server logs run on my legitimate interest. You can object to that at any time and you do not have to give a reason. Write to me and I will stop, unless I can demonstrate compelling grounds that override your interests. For analytics I will have no such grounds.
Right to withdraw consent. The newsletter is the only thing here that rests on your consent. You can withdraw it at any time through the unsubscribe link or by writing to me, and you do not have to explain yourself. Withdrawing does not affect the lawfulness of what happened before.
No automated decision making. I make no automated decisions about you and do no profiling, meaning nothing a computer concludes about you that has consequences for you.
Complaints. If you think I am doing something wrong, you can complain to a supervisory authority. In the Czech Republic that is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz. If you live in another EU country, you can go to the supervisory authority there.
Changes
Last changed on 1 September 2026, when the newsletter section was added.
If something appears on this site that handles your data differently, I will describe it here. Always before it starts working, not after.