Skip to content

~/avetyan.com/privacy

Privacy

What avetyan.com and its comment system collect, how long it's kept, and how to get a copy or have it deleted.

Last updated: 28 October 2026

This page covers two things: the website at avetyan.com, and the comment system at comments.avetyan.com that runs under every post. Both are run by Karen Avetyan, who is the person to write to about anything here: karen@avetyan.com.

The website

avetyan.com is a static site hosted on Cloudflare Pages. Cloudflare serves the pages, protects them from abuse and keeps its own request logs under Cloudflare’s privacy policy.

The site uses Google Analytics to count visits and see which pages are read. It sets first-party cookies (named _ga and _ga_…) and sends Google the page address, the referring page, and basic browser and device details. The numbers are used only to decide what to write next. Nothing is sold or used for advertising. Google’s handling of the data is described in how Google uses information from sites that use its services. You can block it with any content blocker or with Google’s opt-out add-on.

The theme you pick (light or dark) is kept in your browser’s localStorage and never leaves your device.

There are no ads, no social media widgets and no other tracking on the site.

Comments

What is collected

When you post a comment, the comment system stores:

  • the name from the account you signed in with,
  • the text of your comment,
  • a hashed IP address: your IP is run through HMAC-SHA-256 with a secret key before it’s stored, and the raw IP is never kept. IPv6 addresses are cut to their network prefix first, so the hash identifies a network rather than one device. It’s used for rate limiting and spotting abuse,
  • your browser’s user-agent string, kept next to the hashed IP for the same purpose,
  • the time you posted.

Because you sign in with Google, GitHub or Facebook, it also stores:

  • the email address the provider returns (nothing else is read from your account),
  • your avatar URL,
  • the provider’s user ID, so signing in again finds the same account.

If you react to a comment, it stores which reaction you gave to which comment.

How long it’s kept

  • Comments are kept until you ask for them to be deleted. A deleted comment shows as [deleted] so replies to it still make sense.
  • The hashed IP and user-agent are kept as long as the comment or report they belong to, and are removed when you ask for your data to be erased. There’s no automatic expiry.
  • Account details from your sign-in provider are kept until you ask for them to be removed.
  • Moderation records: when a comment is approved, hidden or deleted, or an account is banned, a record of the action, the reason and the account it concerned is kept, so the decision can be explained later. These records hold no email address or name, and are not removed by an erasure request, because they describe what was done rather than who you are.

Cookies and browser storage

The comment system sets one cookie, __Host-garrul_sess, on comments.avetyan.com. It’s HttpOnly, Secure and partitioned per site (SameSite=None; Partitioned), and holds only a random session ID. There are no advertising or tracking cookies in the comment system.

While you type, an unsent comment draft is saved in your browser’s localStorage so it survives an accidental reload. It never leaves your device and is cleared when you post or cancel.

Who can see it

  • The site’s moderator (Karen) can see all comments and account records.
  • Cloudflare hosts the comment system and its database, and runs the Turnstile check that keeps bots out.
  • Signing in with Google, GitHub or Facebook tells that provider you’re using this site. They act under their own privacy policies, not this one.

Comment data isn’t sold or shared with anyone else, and there’s no analytics or cross-site tracking in the comment system.

Get a copy of your data

Email karen@avetyan.com. You’ll get everything held about your account as one JSON file: your profile, your comments (with the hashed IPs and user-agents stored with them), any reports you filed, your reactions, and any moderation actions about your account. You’ll be asked to confirm the account is yours first, usually by writing from the email address on it.

Correct your data

Your name and avatar come from your sign-in provider and refresh each time you sign in, so change them there. You can edit a comment for 15 minutes after posting; after that, email to have it changed. The email address on an account can’t be changed in place: write in and it will be corrected by hand, or the account erased so you can sign in fresh.

Delete your data

To delete a single comment, use the trash icon next to it within 15 minutes of posting. After that, or to delete your whole account, email karen@avetyan.com from the address you signed in with and say which provider you used (Google, GitHub or Facebook). This is also how to remove data that came from signing in with Facebook.

Erasing an account means:

  • your name, email address, avatar and provider ID are removed, and your comments then show as [deleted] with no author,
  • the hashed IP and user-agent stored with every comment and report you made are removed,
  • you’re signed out everywhere, and signing in again later creates a new, empty account.

The text of your comments is kept by default, without your name, so conversations other people joined stay readable. Say so if you want the text removed too, or if it contains personal information, and those comments will be blanked as well.

Requests are answered within 30 days, usually much sooner. You’ll get a reply confirming what was deleted.

You can also disconnect this site from your account on the provider’s side at any time: in Facebook under Settings › Apps and websites, in Google under Third-party connections, and in GitHub under Settings › Applications.

Children

This site isn’t aimed at children under 13, and they shouldn’t sign in to comment.

Changes

If this page changes in a way that matters, the date at the top changes too.