Privacy Policy

Last updated: October 30, 2026

christiaankornaat.com ("the website") is a personal, non-commercial website run by Christiaan Kornaat, based in the Netherlands. This policy explains what personal data the website processes when you use it, why, and what your rights are. Christiaan Kornaat is the data controller under the General Data Protection Regulation (GDPR).

Data we collect

When you sign in with Google or Discord, we receive and store:

  • your name or username, email address and profile picture;
  • the account ID the provider uses for you, so we can recognise you on your next visit;
  • the sign-in tokens the provider issues (access, refresh and ID tokens). We use these only to sign you in and never to act on your behalf.

From Discord we only request the identify and email scopes. We cannot read your servers, messages or friends list.

Content you create, such as your profile text, blog posts, tweets, likes, friends and friend requests, messages, kanban boards, cards and comments, lists, quiz answers and game results.

Technical data: hosting providers may log your IP address, browser and request details for security and to keep the website running.

Cookies and local storage

We only use strictly necessary cookies: a session cookie that keeps you signed in, and short-lived cookies that protect the sign-in flow (CSRF and callback cookies). Your theme preference (light or dark) is stored in your browser's local storage. We do not use advertising, analytics or tracking cookies.

How we use your data

  • to create and manage your account and sign you in;
  • to provide the website's features, such as showing your content and letting you collaborate, chat and play games with others;
  • to keep the website secure and prevent abuse.

The legal basis is the performance of our agreement with you (the Terms of Service) and our legitimate interest in running a secure website. We do not sell your data, show advertisements or use your data for profiling.

Who can see your data

Depending on your privacy settings, other signed-in users can see your profile (name, username, picture and profile text). Content you share is visible to the people you share it with, for example board collaborators, quiz participants, friends or the recipients of your messages.

We use the following service providers to run the website. They process data on our behalf only:

  • Vercel: hosting;
  • Supabase: database;
  • Cloudflare: DNS and network security;
  • Google and Discord: sign-in.

Some of these providers may process data outside the European Economic Area. Where they do, they rely on safeguards recognised under the GDPR, such as the EU Standard Contractual Clauses.

How long we keep your data

We keep your account and content for as long as your account exists. Sign-in sessions expire after 30 days of inactivity. When you ask us to delete your account, we delete your personal data and content, unless we have to keep something to comply with the law.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • have incorrect data corrected;
  • have your data deleted;
  • restrict or object to processing;
  • receive your data in a portable format.

You can also revoke the website's access at any time from your Google or Discord account settings. To exercise any of these rights, contact us using the details below. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Children

The website is not intended for children under 16. We do not knowingly collect personal data from children under 16.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed.

Contact

For questions about this policy or your data, contact Christiaan Kornaat via LinkedIn or GitHub.