PRIVACY · UPDATED 4 September 2026
Privacy.
OYS is a small independent publication run by one person. This note describes every piece of personal information the site touches, who else processes it, how long it is kept, and how to have it removed.
- No accounts, no advertising, and nothing that follows you from one site to the next. Page views are counted without cookies.
- Audit and Quick Test answers are scored inside your browser and are never sent to OYS.
- The only personal information OYS asks for is an email address, and only if you subscribe.
- Nothing here is sold, rented, or shared for advertising.
Who is responsible
Joonhee Jo operates OYS from the Republic of Korea and is the controller for the processing described here, and the personal information protection officer for the purposes of Korea's Personal Information Protection Act.
Write to privacy@oys.systems for any request in this note. You should have a substantive reply within 30 days.
What the site collects
Reading the site
Pages are delivered by Cloudflare. Delivering a page necessarily processes your IP address, the time of the request, the address requested, and your browser's user-agent string. This is used to serve the page and to absorb abusive traffic. OYS keeps no application log of its own. Lawful basis: legitimate interests in delivering and securing the site (GDPR Art. 6(1)(f)).
Page views are counted by Cloudflare Web Analytics, which Cloudflare adds at its own edge rather than from code written into this site. It records the address of the page, the site you arrived from, and coarse details such as country and device type. It uses no cookies, no local storage, and nothing else left behind on your device, and Cloudflare states that it does not fingerprint visitors by IP address or user-agent string for analytics. Nothing in it identifies you or joins one visit to the next. OYS uses it for one thing: to see whether a page is read at all. Lawful basis: legitimate interests in understanding whether the writing reaches anyone (GDPR Art. 6(1)(f)).
Subscribing to Notes
The subscription form posts one field — your email address — from your browser directly to Kit, the email service. It does not pass through an OYS server or database. Subscription is double opt-in: submitting the form starts a confirmation request, and nothing is sent to you until you confirm. Lawful basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time through the unsubscribe link in every email or by writing to the address above.
Kit records delivery events for the emails it sends, and by default this includes whether a message was opened and whether a link in it was clicked. OYS uses this only to tell whether sending is working at all. It is not combined with Audit or Quick Test answers, not used to build a profile of you, and not exported anywhere.
The Audit and the Quick Test
Your answers to Your System Audit and Your System Quick Test stay on your device. Both are scored by code running in your browser, and neither makes a network request that carries an answer. There is no server copy to ask for, and none to breach.
Buying the Audit
Your System Audit is sold through Gumroad, which acts as the seller and handles the payment under its own privacy policy. OYS never sees your card details. When you enter a license key to open the Audit, the key is sent to Gumroad's verification API and is checked against the purchase. OYS does not store the key: a one-way hash of it is used only to limit repeated attempts for 60 seconds.
Cookies and local storage
None of the following is used for advertising or cross-site tracking, which is why OYS shows no cookie banner. The page view counting described above is absent from this table because it stores nothing on your device at all.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
__Host-oys_audit_access | OYS | Proves that a license was verified, so the Audit will open. Holds only an issue time, an expiry, and a random value — no identity. | 30 days |
__cf_bm | convertkit.com | Cloudflare bot filtering for Kit, set when the subscription form's script loads. | About 30 minutes |
ckid | Kit, in local storage | Identifies your form submission to Kit. Created only at the moment you submit the form, not when you read a page. | Until you clear site data |
oys.your-system-audit.v1 | OYS, in local storage | Keeps your Audit answers and result on your device so you can return to them. | Until you reset the Audit or clear site data |
oys.quick-test.v1 | OYS, in session storage | Keeps an unfinished Quick Test in place if you reload. | Cleared on completion, on restart, or when the tab closes |
Who else processes it
OYS is operated from the Republic of Korea and these three companies are in the United States, so the transfers below are cross-border. Kit and Cloudflare act on OYS instructions under their data processing terms, which incorporate the Standard Contractual Clauses, the UK addendum, and the EU–US Data Privacy Framework. Gumroad acts as a seller in its own right, not on OYS instructions. No one else receives your information, and it is never sold.
| Recipient | Country | What it receives | Why |
|---|---|---|---|
| Cloudflare, Inc. | United States | IP address, request metadata, page view counts | Hosting the site and measuring whether pages are read |
| Kit (Kit.com, Inc.) | United States | Email address, confirmation and delivery events | Sending Notes, only if you subscribed |
| Gumroad, Inc. | United States | Purchase and license details | Selling the Audit and verifying a license key |
How long it is kept
Nothing is kept for longer than the purpose it was collected for.
- A subscription you never confirmed. Removed from Kit within 30 days. An unconfirmed address is never emailed.
- A confirmed subscription. Kept until you unsubscribe or ask for deletion.
- After you unsubscribe. Kit keeps the address marked as unsubscribed so that it is not added back by mistake. Ask, and it is deleted outright instead.
- License keys. Not stored at all. The hash used for rate limiting lasts 60 seconds.
- Audit and Quick Test answers. They are on your device, under your control, and OYS has no copy to delete.
- Request logs and page view counts. OYS keeps none of its own and exports nothing. Cloudflare holds request data and the aggregate page view counts on its own schedule as part of delivering, protecting, and measuring the site.
Your rights
Wherever you are, you can ask what is held about you, ask for it to be corrected, and ask for it to be deleted. Write to privacy@oys.systems. You may be asked to send the request from the address in question, because that is the only way to tell the request is yours. There is no charge, and asking costs you nothing else — service is not reduced for people who exercise these rights.
In the EEA and the UK, you also have the rights to restrict or object to processing, to receive your data in a portable form, and to withdraw consent at any time without affecting what was sent before. You can complain to your national supervisory authority.
In Korea, you may request access, correction, deletion, or suspension of processing under the Personal Information Protection Act, and you may take a dispute to the Personal Information Protection Commission or the Privacy Call Centre on 118.
In US states with consumer privacy laws, including California, Colorado, Connecticut, Texas, and Virginia, you have equivalent rights to know, delete, and correct, and the right to opt out of the sale or sharing of personal information and of targeted advertising. OYS does none of those three, so there is nothing to opt out of.
Children
OYS writes for working adults and is not directed at children. It does not knowingly collect information from anyone under 14 in Korea, under 16 in the EEA, or under 13 in the United States. If you believe a child has subscribed, write to the address above and it will be removed.
Security
The site is served over HTTPS only. There is no OYS subscriber database, no server-side store of Audit or Quick Test answers, and no credential kept in the project's source code. Service keys are held as platform secrets. This is a small site, and the strongest protection it offers is that it holds almost nothing worth taking.
Changes
The date at the top of this page changes when this note changes. If a change materially affects people who have subscribed, it will be described in an email rather than only posted here.