Privacy policy

Last updated October 12, 2026.

LymyVoyage is an independent research publication. This policy covers what the site collects, why, where it goes, and what you can ask about it. It applies to every language version of the site.

Who is responsible

LymyVoyage is run by an individual, not a company. The data controller is Arthur Harmash, Austria. For anything in this policy, including requests about your own data, write to the address at the end.

What is collected, and why

Five things, four of which only happen if you do something first.

Visiting a page

Pages are served by Firebase Hosting and a server function on Google Cloud. Like any web server, these record the request -- IP address, time, the page asked for, user agent -- in operational logs Google keeps on our behalf. They are used to run the site and to investigate faults and abuse, not to build a profile of you.

Signing up for articles by email

The form stores your email address, the page you signed up from, and the site language you were using, with the time of signup. Nothing else, and nobody else's address is visible to you or to any other reader. You can ask for it to be removed at any time.

Leaving a comment

A comment stores the name you type, the comment text, and which article it belongs to. Treat both as public: comments are published on the article page and readable by anyone. Use any name you like -- there are no accounts, and nothing is verified. Comments cannot be edited or deleted from the site itself; ask and one will be removed.

Asking for an automated contract review

The form stores your name, email address, the country you live in, the country of treatment, the type of treatment, the contract files you upload, and whether you ticked that you removed your personal details. A contract can contain health information, so this is only done with your explicit consent (GDPR Art. 9(2)(a)), given by ticking the box on the form; you can withdraw it by email at any time. It is used only to review the contract and email you the result. The files and the request details are stored with Google Cloud in the United States, like the rest of the site's data (see below). Files and request details are deleted 90 days after you send them. The review is done with the help of Claude, an AI model from Anthropic (United States), which receives the contract text through Anthropic's commercial API. Under Anthropic's commercial terms it is not used to train AI models, and Anthropic deletes it within 30 days. Apart from Anthropic and the services named under "Who else sees it", nobody else sees your files, and a notification to the site operator about a new request carries no name, email, treatment or file names. Removing your personal details from the contract before uploading, as the form suggests, means less of it is stored at all. The result of the review is stored without your personal details, which are removed before the contract is reviewed. It sits at a link with a long random code that only you receive, so anyone you forward the link to can read it. It is deleted together with the request after 90 days.

Analytics

Only if you accept it. Google Analytics counts visits and shows which articles get read; it is not loaded at all until you consent, and rejecting or withdrawing deletes its cookies. Visitor counts also come from Cloudflare Web Analytics, which sets no cookies and collects no personal data. Full detail on the cookies page.

Spam and abuse checks

Pages carrying the comment form or the email sign-up load Google reCAPTCHA and Firebase App Check to tell a reader from a bot. Google receives what it needs for that check. It is not used for advertising.

Legal bases

Under the GDPR: your consent for analytics and for the email list (Art. 6(1)(a)), which you can withdraw at any time; and legitimate interests for running the site, keeping it working, publishing comments and keeping out spam (Art. 6(1)(f)).

Who else sees it

None of this is sold, rented or shared for advertising. It is processed by the services that run the site: Google (Firebase Hosting, Cloud Firestore, Cloud Functions, Google Analytics, reCAPTCHA) and Cloudflare (cookieless visitor counts, and DNS). Emails the site sends, such as the result of a contract review, go out through Resend, which receives the recipient's address and the message. A contract sent for an automated review is also read by Anthropic's Claude (see "Asking for an automated contract review"). The sign-up list sits in the database and is read directly.

Where it is stored

In the United States. The database is in Google's nam5 multi-region and the server function runs in us-central1, so data from readers in the EU, the UK and elsewhere is transferred to the US. Google is certified under the EU-US Data Privacy Framework, and the transfer also relies on the Standard Contractual Clauses in Google's Cloud Data Processing Addendum.

How long it is kept

Email addresses are kept until you unsubscribe or ask for removal. Comments are kept while the article they belong to stays published. Server and analytics logs follow the retention Google and Cloudflare apply to them, which runs in months rather than years.

Your rights

If the GDPR or UK GDPR applies to you, you can ask for:

• a copy of what is held about you;
• correction of anything wrong;
• deletion -- of your email address, your comments, or both;
• restriction of processing while a question is sorted out;
• an objection to processing based on legitimate interests;
• a portable copy of what you provided;
• withdrawal of consent: one click for analytics, one email for the list.

Write to contact@lymyvoyage.com. You will get an answer within a month. There is no charge, and no account or ID is needed -- though for a deletion request, writing from the address you signed up with is the quickest way to settle that it is yours.

Complaints

If you think this site has handled your data badly, please say so here first -- it is a one-person operation and most things turn out to be a misunderstanding or an oversight. You also have the right to complain to your national data protection authority without contacting us at all.

Children

This site is written for adults and is not directed at children. No part of it knowingly collects data from anyone under 16.

Changes

If this policy changes in a way that affects you, the date at the top changes with it. Material changes to how personal data is handled will be noted on this page rather than made quietly.