Privacy

Who runs this site

open tomato is run by Marcos Tomatti, a private individual in Sweden. He decides what the site records, which makes him the controller under the GDPR, the EU data protection law. You can reach him at contact@opentomato.io.

What the server logs

The hosting provider records each request to the site: your IP address, your browser’s user agent (the line that names the browser and system), the address you asked for, and the time. These logs are used only to keep the site running and to find and stop abuse, such as a flood of requests.

The site is hosted on Heroku, a Salesforce service, in its United States region. Heroku keeps only the most recent log lines (1,500 at most) for a short time, and the site adds no log storage of its own, so older lines are overwritten. Because the servers are in the United States, the logs leave the EU/EEA; Salesforce offers the EU standard contractual clauses for such transfers in its data processing addendum.

If you send an email

An email you send to contact@opentomato.io is read to answer it. It is kept for one year after the conversation ends, then deleted, and it is not shared.

On your device

The site stores one thing in your browser: your light or dark theme choice, in local storage under the name open-tomato.homepage.theme. It stays in your browser and is never sent to the server. Clearing the site’s data in your browser removes it.

The site sets no cookies.

What is not used

The site runs no analytics, no advertising and no social media trackers. Fonts are served from this site, so no font service sees your visit. Plausible, a cookieless analytics tool, is planned; it is not in use, and this page will be updated before it is switched on.

Links to other sites

Links to GitHub and the share buttons on dev diary entries are plain links, so nothing is sent to another site until you click one. When you click a share button, the entry’s address and title go to that network (LinkedIn, Bluesky, X, Hacker News, or mastodonshare.com for Mastodon). From then on, that site’s own privacy policy applies.

The copy buttons put the link or the entry’s markdown on your clipboard, and send nothing to other sites. The Email button opens your own mail app, and the Share button, where your browser has one, opens your device’s share menu.

Why this is allowed

The legal basis for the server logs and for answering email is legitimate interest (GDPR Article 6(1)(f)). A site cannot be run or protected without request logs, and an email cannot be answered without reading it. The data is used only for that and kept only for the times stated above.

Your rights

You can ask to see what is held about you, to have it corrected or deleted, or to have its use restricted, and you can object to its use. Send the request to contact@opentomato.io. Log lines carry no name, so to find yours, include the IP address and the rough time of your visit.

You can also complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at imy.se.

Changes

When what the site records changes, this page changes first. The date below says when it last did.