Privacy and pseudonymity
The goal is not anonymity against a determined adversary — that is a different
and much harder project. It is that reading this site should not tell anyone
anything about the reader, and publishing on it should not quietly disclose
things about you that you did not choose to disclose.
What a reader's browser does
It connects to eratic.ro and downloads HTML, CSS, fonts and images. That is
the complete list. There is no analytics, no tag manager, no font CDN, no
embedded player, no share button, no comment widget, no cookie — and therefore
no cookie banner, because there is nothing to consent to.
This is enforced rather than promised. The Content-Security-Policy in
deploy/eratic.caddy sets default-src 'self', so if a third-party script,
font or pixel is ever added by accident, it fails visibly in the browser
console instead of quietly starting to track people.
script-src deliberately excludes 'unsafe-inline'. Astro bundles <script>
tags into external files, so real scripts work; an inline one is a mistake and
gets blocked. style-src does allow inline, because Astro emits component
styles that way and per-article theming depends on it.
The web server keeps no access log. Not a truncated one, not an anonymised
one — log { output discard }. An IP address you never wrote down cannot leak,
be subpoenaed, or turn up in a backup.
What you disclose when you publish
Photographs
This is the real risk, and it is handled in three independent places:
npm run build refuses to proceed if any source photograph carries GPS
coordinates. It names the files and prints the coordinates so you can see
what would have been published.- Astro re-encodes every image through sharp into AVIF and WebP, which
drops all metadata. The files a reader downloads carry nothing — not even
the camera model.
- The build prunes orphaned originals from
dist/. Astro emits the
untouched original alongside the processed versions even when nothing links
to it; that copy still had full EXIF, and it is now deleted before upload.
Because of (2), the camera settings you want shown are rendered into the page
as text, read from the source files at build time. packages/core/src/lib/exif.ts
asks the parser for an explicit allowlist of eight tags and never GPS. Do not
change that.
Fixing a photo with coordinates. Best: strip location on export — Lightroom,
Capture One and macOS Photos all offer it, and it is lossless. Otherwise:
which re-encodes at quality 95 and rewrites the EXIF with the camera fields
kept and GPS gone. Note that this fixes the working copy only: coordinates
remain in git history for any commit that already contained them. If that
matters, the honest answer is to rewrite history with git filter-repo before
the repository is ever public — or simply keep the repository private, which it
currently is.
Names and addresses
packages/core/src/config.ts holds the identity used across all four sites and
both feed formats. It is currently eratic / hello@eratic.ro. Nothing in
this repository should contain a legal name, home address or phone number,
because everything there is published in HTML and syndicated in feeds.
Git commits are configured pseudonymously for this repository:
git config user.name # eratic
git config user.email # hello@eratic.ro
This is repo-local and does not affect your other projects.
Domain registration
.ro domains registered to an individual do not expose personal details in
public WHOIS. Nothing to do here, but worth knowing it is the case.
The server
178.104.116.235 is registered to your ird account and is a Hetzner address —
it is not, on its own, an identifier that leads anywhere personal. Caddy sends
no Server header and no version.
If you ever want traffic numbers
You do not currently have any, by design. The options, least invasive first:
- Feed subscriber counts. Some readers send a subscriber count in their
User-Agent. Counting those requires turning on a log, so it is not free.
- Aggregate-only logging. Log to a file, aggregate to daily counts per
path, delete the raw log the same day. You learn "40 people read the harbour
post" without ever storing who.
- Self-hosted GoatCounter. Runs on the same box, no cookies, no
cross-site identifiers. This is the most you should consider, and it would
need a
script-src exception in the CSP.
Do not reach for a hosted analytics service. It would undo every property
described above in exchange for a chart.
The one opinionated default
public/robots.txt on each site asks the major AI training crawlers not to
index the content. It is a stated preference, honoured voluntarily — not a
technical barrier. Delete the block if you would rather be indexed by
everything.