Privacy Policy

As of 13 October 2026. This policy deliberately describes only what this website actually does. This translation is provided for convenience; the German version is legally binding.

1. Controller

Name: Filip Mladenović
Address: Nöbauerstraße 48, Tür 13
4040 Gramastetten, Austria
Email: filip@mladenovic.studio

Full details in the imprint.

2. What this website does not do

It sets no cookies for visitors.
It loads no fonts from third-party servers. All fonts are hosted on this server, so no IP address is sent to Google.
It uses no Google Analytics and no advertising networks.
It embeds no social media plugins.
It creates no profiles and does not track anyone across pages.

The home page stores nothing in your browser. Only the experiments remember what you set yourself: whether an experiment's scenes move (localStorage), plus, in one experiment, the loop counter of the current session (sessionStorage). This never leaves your device and is not used for statistics.

That is why there is no cookie banner here: there is nothing to consent to.

3. Visiting the website (hosting)

This website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA).

When you open a page, your browser transmits technically necessary data, including your IP address, so that the page can be delivered at all. Cloudflare processes this data as a processor for operating the site and defending it against attacks.

Legal basis: Art. 6 (1) (f) GDPR, legitimate interest in secure operation
Transfer to third countries: Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

4. Visit counter

I count how often the site is visited. This works without cookies, without storing IP addresses and without storing anything in your browser. A visit is a page opened directly or from another website; reloads and clicks within this website do not count. For each visit, only three heavily coarsened details are added to daily counters:

Country — only the two-letter country code that Cloudflare derives from the request. The IP address itself is neither read nor stored.
Source — the referring page, reduced to a rough name (for example “Direct” or “google.com”).
Device type — only “mobile”, “tablet” or “desktop”.

No individual records per visitor are stored, no IP addresses and no full browser identifiers. No individual person can be identified from the stored numbers.

Bots and requests from data centres are not counted. For this, the counter compares the browser identifier and the network number (ASN) that Cloudflare derives from the request against a fixed list. Neither is stored.

Purpose: to see whether, and from where, the site is visited
Legal basis: Art. 6 (1) (f) GDPR, legitimate interest in simple audience measurement
Processor: Supabase (database for the daily counters)

5. Protected area /stats

The evaluation of the daily counters is password-protected and intended for me only. A technically necessary login cookie is set there, plus a cookie that keeps my own visits out of the visit counter. This only concerns me as the operator, not the visitors of this website.

6. Contact form and email

The contact form on the home page sends your name, your email address, your message, the topics you picked and, if you add it, the address of your current website. I use these details only to answer your enquiry.

The form stores nothing on this website. When you send it, a Cloudflare function (see section 3) delivers the details as an email to my Google Mail inbox. Your IP address is not passed on to me. To keep spam out, the form has a field that is invisible to people and checks how quickly it was sent; this sets no cookies and involves no third-party service.

If you write to me directly by email, I likewise process your email address and the content of your message only in order to reply.

Legal basis: Art. 6 (1) (b) GDPR where the message concerns preparing or carrying out a contract. For all other enquiries Art. 6 (1) (f) GDPR, legitimate interest in answering them.
Storage period: as long as needed to handle the enquiry, then within statutory retention periods

Enquiries from the form and messages to filip@mladenovic.studio reach my Google Mail inbox through Cloudflare (see section 3). My replies are sent by the email service Resend (Resend, Inc., USA) through servers in the EU (Ireland). These providers therefore also process your message on its way. If you don't want that, you can reach me any other way, for example by phone after arranging a call.

7. Client projects and live preview

On the home page I show websites I have built, as preview images stored as image files on this server. No data goes to the providers of those sites unless you click a link to one of them.

On large screens the projects are also shown as a live preview: while the “Websites I’ve built” section is in view, your browser loads the site of the project being shown after a short moment, scaled down, in an embedded frame (iframe), directly from its server. Phones get no live preview. The operator of that server receives technically necessary data, in particular your IP address. I only use a live preview for sites that load no content from third parties (such as fonts from Google) and set no cookies.

Currently embedded live: heropak.io, janagregus.com, help.earth, samanthalackner.com, tijanadinovski.com and austrianstringquintet.com; each site's own privacy policy applies to it
Legal basis: Art. 6 (1) (f) GDPR, legitimate interest in showing my work as it actually is

8. Experiments with the camera

Two experiments, The Mirror and Anamorphosis, can use your camera if you want them to. Your browser asks for permission first; without it, both keep working with mouse or finger. The camera image is analysed only on your device, by an image recognition library (MediaPipe) that is stored on this server and runs in your browser. No image is stored and nothing is transmitted, neither to me nor to anyone else. When you leave the page, the camera is off again.

Legal basis: your consent through the browser's camera prompt (Art. 6 (1) (a) GDPR), which you can withdraw at any time in your browser settings

9. Your rights

You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). A message to the email address above is enough.

If you believe that your data is not being processed lawfully, you can lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at.