Privacy Policy
1. Who is responsible
The Stoic Optimizer is a personal blog run by Magda Ursulean, based in Switzerland. She is the data controller for everything described here, and can be reached through the contact form.
Because the controller is established in Switzerland, the Swiss Federal Act on Data Protection (nFADP) applies. The EU General Data Protection Regulation (GDPR) applies in addition where visitors are in the EEA, and the UK GDPR where they are in the UK. There is no Data Protection Officer — the site is small enough not to require one.
2. What is collected, and why
Nothing on this site asks you to create an account, and none of it profiles you or makes automated decisions about you.
| When | What | Why | Legal basis |
|---|---|---|---|
| Any visit | Your IP address, browser and device details, the page requested and the referring page — recorded in server and security logs. | Serving the site, and defending it from attack and abuse. | Legitimate interests (GDPR Art. 6(1)(f)) in operating a secure site. |
| Newsletter signup | Your email address, and your first name if you give one. | Sending you the newsletter and the free e-book, and nothing else. It is never sold, rented or passed on. | Your consent (Art. 6(1)(a)), given by clicking the confirmation link, and withdrawable at any time. |
| Contact form | Your name, email address, and whatever you write in the message. | Reading your message and replying to it. | Steps taken at your request (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) in answering enquiries. |
| Opening the contact page | Your IP address and browser signals, sent to Cloudflare Turnstile. | Confirming you are not a bot, so the form cannot be used for spam. | Legitimate interests (Art. 6(1)(f)) in preventing abuse. |
| Only if you accept cookies | Analytics data: pages viewed, approximate location from your IP, referrer, and which links you click. | Understanding which posts are worth writing more of. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. |
The Turnstile check in the fourth row runs when the contact page loads, not when you press send — so it happens even if you decide not to write anything. It is the one third-party request the site makes before you have answered the cookie banner, and it sets no advertising cookie.
3. Who else processes it
These are the only companies that handle data from this site. Each acts on instructions, under a data processing agreement.
- Cloudflare — hosts the site and runs the form endpoints, provides the Turnstile anti-spam check, and keeps operational and security logs. United States, with processing at edge locations worldwide.
- Kit (formerly ConvertKit) — stores the newsletter list and sends the emails. United States.
- SMTP2GO — transmits contact-form messages to the inbox. Your name, email and message pass through their systems and appear in their sending logs. United States.
- Google — provides Gmail, where contact messages are received and read, and — only with your consent — Google Tag Manager and Google Analytics. United States.
Fonts are self-hosted rather than loaded from a font service, so simply reading the site does not announce you to a third party. Data is never sold, and is only ever disclosed beyond this list where the law requires it.
4. Transfers outside Switzerland and the EEA
Every processor above is based in the United States, so your data is transferred there. Those transfers rely on the European Commission’s Standard Contractual Clauses together with the Swiss addendum, and, where the provider is certified, on the EU–US and Swiss–US Data Privacy Frameworks. US law may give public authorities access rights that Swiss and EU law would not — that is an inherent limitation of using US services, and it is why the list above is kept as short as it is.
5. Cookies and analytics
No analytics cookies are set unless you accept them. Google Tag Manager, and the Google Analytics tags inside it, are not loaded at all until you choose “Accept” in the banner. If you decline, or simply ignore the banner, nothing analytics-related runs and no analytics cookie is written.
If you accept and later change your mind, choose Cookie settings in the footer and decline. That deletes the analytics cookies already on your device and reloads the page, so tracking genuinely stops rather than only applying to your next visit. You do not need to change your browser settings, though you are of course free to.
Your choice itself is remembered in your browser’s local storage. It stays on your device and is never sent to a server.
The analytics cookies are set by Google Analytics 4, via Google Tag Manager. They are not used to identify you by name and are not combined with the information you give through the contact or newsletter forms. There are no advertising cookies, no remarketing tags, no social media pixels, and no cross-site tracking of any kind.
6. How long it is kept
- Newsletter — you are only added after clicking the confirmation link in the opt-in email. Your address stays on the list until you unsubscribe, which you can do from the footer of any email. After that it is removed, apart from the minimum record needed to avoid emailing you again by mistake.
- Contact messages — kept as long as they are needed for the conversation and any follow-up it leads to, then deleted. There is no fixed clock on this; if you would like your message deleted sooner, ask and it will be.
- Analytics — retained by Google Analytics for no more than 14 months, then deleted automatically. Reports are only ever looked at in aggregate.
- Server and security logs — kept short-term by Cloudflare for operations and abuse prevention, then discarded.
7. Your rights
Under the nFADP and, where it applies, the GDPR, you can ask for a copy of the data held about you, have it corrected, have it deleted, have its use restricted, object to processing based on legitimate interests, and receive it in a portable form. Where processing rests on consent — the newsletter and analytics — you can withdraw that consent at any time, without affecting anything done before you withdrew it.
Send your request through the contact form and you’ll get a reply. Requests are free, and answered within 30 days.
If you are not satisfied with the response, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC). If you are in the EEA or the UK, you can complain to the supervisory authority where you live or work instead.
8. Children
This site is written for adults and is not directed at children. It does not knowingly collect information from anyone under 16. If you believe a child has sent information through the contact form or the newsletter signup, get in touch and it will be deleted.
9. Changes to this policy
If what the site does changes, this page changes with it, and the date below is updated. There is no version history to dig through — what’s written here is what the site currently does.
This document was last updated on August 7, 2026.