Privacy
What we collect, who else touches it, and how to get rid of it. It is a short page because there is not much of it, and we would rather you could check that than take our word for it.
Who is responsible
Samarkand Industries OÜ, registry code 17492007, VAT EE102996999, Narva mnt 5, 10117 Tallinn, Estonia, is the controller for everything described here. There is no data protection officer, because the thresholds that require one are not met. Write to hello@hosakaseven.com.
Reading the site
You do not have to tell us anything to read anything. No account, no sign-up wall, no cookie banner — and no cookie banner because there is nothing to consent to, not because we decided you would not mind. The reasoning is written out in full in our advertising policy.
One thing is stored on your device, and only if you ask for it: your choice of light or dark mode, kept in your browser’s local storage. It never leaves the browser and we never see it.
Analytics
We use Kontrol Analytics to count readers. It sets no cookies, no browser storage and no device identifiers, and it cannot recognise you tomorrow: visitors are counted with an identifier that rotates every day and cannot be reversed or joined across days.
Kontrol is not a third party, and you should hear that from us rather than find it in a footer. Kontrol Sentinel is operated by Samarkand Industries OÜ, registry code 17492007 — the company that publishes this site. There is therefore no processor in this arrangement and no data processing agreement between two parties to point you at: one controller holds the data at both ends, and the entity answerable for the analytics is the entity answerable for the publication.
Loading it does mean your browser makes a request to Kontrol, which sees your IP address and your user agent. That is personal data, and our lawful basis is legitimate interest — knowing roughly how many people read a piece, with no profiling, no advertising use and no identity that survives the day. If you would rather not be counted at all, any content blocker will stop the script and the site works exactly the same without it.
On where that happens, the binding document is Kontrol’s data processing agreement, and it says the service seeks to avoid transfers of personal data outside the EEA, applying standard contractual clauses or an equivalent mechanism where a transfer is required. That is what is printed here because that is what binds.
The newsletter
If you subscribe — on this site or in the iOS app, which asks the same way and keeps no copy of what you type — we hold your email address and the date you confirmed it. Nothing else: no name, no company, no inferred anything.
Subscription is double opt-in: we send a confirmation link and store nothing until you click it, so nobody can be signed up by somebody else. The lawful basis is your consent, and you can withdraw it at any time using the unsubscribe link in the footer of every issue, which takes effect immediately and without asking you why. Your address is deleted when you unsubscribe.
Mailgun stores the list and sends the mail, as our processor, on their European infrastructure, with log retention set to zero days. We do not put tracking pixels in the emails: we do not know whether you opened one, and we would rather not.
Notifications
If you ask to be told when the Monday letter goes out — by pressing the control on the newsletter page in a browser, or in the iOS app — we store the address your device’s push service will deliver to, and nothing else. In a browser that is an endpoint and the two keys that encrypt the message for it; in the app it is a token from Apple. Neither is a name, an address or an account, and neither is attached to anything you have read. A token identifies an installation, not a person: it changes when the app is reinstalled or the device is restored.
The lawful basis is your consent, given by pressing the control, and you can withdraw it in the same place. Stopping deletes what we hold immediately. If your device’s push service tells us the address is dead — the app was deleted, the permission revoked — we delete it then, without being asked.
Apple, and whichever push service your browser uses, carry the notification as our processor. For browsers the message is encrypted before it leaves us, so the service delivers something it cannot read. Notifications are one a week and carry a headline and a link; there is no second one if the first is ignored, and nothing tells us whether it was opened.
Writing to us
Mail to hello@hosakaseven.com and wire@hosakaseven.com is routed by Cloudflare to a mailbox we read. We keep correspondence for as long as the matter is live and delete it when it is not.
Hosting and logs
The site is served by Vercel from Frankfurt. Cloudflare provides DNS. Both keep short-lived operational logs containing IP addresses, as any web server does, for delivery and abuse prevention. We do not build anything on top of those logs.
Search runs entirely in your browser against a static index file. Typing in the search box sends nothing anywhere.
Advertising
Sponsorships are sold directly and served as ordinary images from our own domain. No ad network, no third-party ad tags, no retargeting, no conversion pixels, and no reader data passed to a sponsor. A sponsor learns that a click came from this site and nothing about which page it came from.
Transfers outside the EU
Our processors are used on their European infrastructure where they offer it. Where a provider is US-headquartered, transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework or on standard contractual clauses.
Your rights
You can ask for a copy of what we hold, ask us to correct or delete it, object to processing based on legitimate interest, and withdraw consent you have given. Write to hello@hosakaseven.com and we will answer within one month.
In practice: if you are a subscriber we hold your address and a date, and unsubscribe deletes it. If you are not, we hold nothing that could be connected to you, so there is nothing to send you.
If we get it wrong you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or to the supervisory authority where you live.
Changes
This page is dated. If the substance changes — a new processor, a new category of data — the date changes with it, and subscribers are told in the letter rather than being expected to notice.