Privacy policy

This policy explains what Expona Blog (expona.dev, “we”) collects when you read the blog, leave a comment, subscribe to the newsletter or use our content management system, and what happens when we share our articles on LinkedIn. We collect as little as we can, we do not sell personal data, and we do not use advertising trackers.

Reading the blog

To understand which articles are useful, we record anonymous reading statistics when you open an article:

• the page, the referring site and any campaign (UTM) tags in the link;
• your approximate location (country, region and city) as reported by our hosting provider, and your device, browser and operating system type;
• how long the page was actively read and how far it was scrolled.

We do not store your IP address: it is replaced with a one-way salted hash so repeat visits can be counted without identifying you. A random visitor ID is kept in your browser’s local storage (exp_vid) and a session ID in session storage (exp_sid). These are not cookies, are not shared with anyone, and you can clear them at any time in your browser settings. The public blog sets no tracking cookies.

Comments

When you comment we store your name, email address, optional website, the comment, a hashed IP address, your browser’s user agent and approximate location. Your name, website and comment are shown publicly once approved; your email address is never shown and is used only to moderate comments. Your name and email are remembered in your browser (exp_commenter) so you do not have to type them again.

Newsletter

If you subscribe we store your email address, where you signed up and your country. We use it only to send new articles. Every email has an unsubscribe link, and you can ask us to delete your address completely.

Authors and CMS accounts

People who write for the blog have an account in our content management system. We store their name, email address, profile details they choose to add, a hashed password, two-factor authentication settings, and security records of sign-ins (IP address, browser and country) to protect accounts against misuse. Sign-in attempt records are deleted after 180 days. An author’s name, photo, bio and profile links are shown on their articles and author page.

LinkedIn

Our CMS can publish posts about new articles to LinkedIn on our own profile or company page, using LinkedIn’s official API. When a member of our team connects their LinkedIn account, we receive their LinkedIn member ID, name and profile picture (through “Sign In with LinkedIn using OpenID Connect”) and an access token that lets us post on their behalf (the w_member_social permission). The token is stored encrypted, is used only to publish posts for our articles, and is deleted when the account is disconnected. We do not read your LinkedIn feed, connections or messages, and we collect no data about readers from LinkedIn. Content you see on LinkedIn is governed by LinkedIn’s privacy policy.

Services we use

• Hosting: the site runs on Vercel; our API, database, file storage and email (Amazon SES) run on Amazon Web Services.
• Images are delivered through Cloudflare.
• The “Buy me a coffee” button links to Buy Me a Coffee; nothing is loaded from them until you click it, and their privacy policy applies on their site.

These providers process data only to run the service for us. Fonts are served from our own domain, so reading the blog makes no requests to Google.

How long we keep data

Reading statistics, comments and subscriptions are kept while the blog runs or until you ask us to delete them. Account and security records are kept while the account exists and for as long as needed to keep the service secure. Read notifications in the CMS are deleted after 90 days.

Your rights

You can ask us what personal data we hold about you, to correct it, to delete it, or to stop using it — for example to remove a comment or a newsletter subscription. Email connect@expona.dev and we will reply within 30 days. If you are in the EU, UK or a similar jurisdiction you may also complain to your data protection authority.

Changes

If we change this policy we will update the date at the top of this page. Questions are welcome at connect@expona.dev. You can also subscribe to hear about new articles.