Last updated: 19 July 2026 · Version 1.0
This Privacy Policy applies to wannabegeek.dev and explains how we collect, use, and protect information in compliance with the General Data Protection Regulation (GDPR) (EU 2016/679), the UK GDPR, and the California Consumer Privacy Act (CCPA) / CPRA.
Who We Are
wannabegeek.dev is an educational website that demonstrates what personal data web browsers expose to any website you visit. It is operated as a personal project.
For the purposes of the GDPR, the data controller is the operator of wannabegeek.dev. To contact us about data matters, please use the contact form or the details in Section 12.
What Data We Process
2a. whoami page — browser demonstration data
The whoami page uses JavaScript to query your browser for information such as your User-Agent string, screen resolution, GPU renderer, installed font signatures, browser permissions, battery status, hardware concurrency, timezone, and behavioural signals (scroll depth, mouse movement, idle time).
This data is processed entirely within your own browser (client-side only) and is never transmitted to our servers. Nothing is logged, stored, or shared. The sole purpose is to demonstrate — to you — what data your browser exposes to any website you visit.
The one exception is the WebRTC IP-leak demonstration in Section 03 of the
whoami page. This probe makes a peer connection to
stun.l.google.com:19302 (Google's public STUN server) to detect whether your
real IP address leaks through WebRTC. Your IP address is sent to Google's infrastructure as
part of this technical process. See Section 4 for more details.
2b. Contact form
When you submit the contact form, we collect:
- Your name
- Your email address
- The subject and content of your message
This information is used solely to respond to your enquiry. It is not used for marketing, not shared with third parties (except the form processing service — see Section 4), and not added to any mailing list.
2c. Web server logs
Like all websites, our web server automatically records your IP address, the pages you requested, your browser's User-Agent, the date and time of access, and HTTP status codes. These logs are retained by our web hosting provider for operational and security purposes (typically 30–90 days) and are not used by us for analytics or profiling.
Cookies
We use the minimum number of cookies needed to operate this site and power its educational demonstrations. We do not use advertising, analytics, or tracking cookies.
| Cookie name | Category | Purpose | Expires | Consent required? |
|---|---|---|---|---|
| wbg_consent | Strictly Necessary | Stores your cookie consent choices so the banner does not reappear on every visit. No personal data is transmitted. | 1 year | No — essential for consent management |
| wbg_visits | Functional | A visit counter used on the whoami page to demonstrate how websites track return visits with cookies. Only set with your consent. | 1 year | Yes — functional consent required |
You can change your cookie preferences at any time by clicking or visiting the footer of any page on this site.
wbg_visits.
Third-Party Services
We have minimised third-party dependencies. Where third-party services are used, they are disclosed below.
| Service | Provider | Purpose | Data sent | Privacy policy |
|---|---|---|---|---|
| Web hosting | Your hosting provider | Serving the website | IP address, requested URLs, browser UA, timestamps | Consult your hosting provider |
| Google STUN server | Google LLC | WebRTC IP-leak demo on whoami page — a connection is made to stun.l.google.com:19302 to detect whether your IP leaks through WebRTC |
Your IP address is sent to Google's STUN server momentarily during the probe | policies.google.com/privacy |
| Contact form processor | To be configured (e.g. Formspree) | Delivering messages submitted via the contact form | Name, email, subject, message body | Depends on service configured |
Lawful Basis for Processing (GDPR)
The GDPR requires us to identify a lawful basis for each type of data processing. Our lawful bases are:
| Processing activity | Lawful basis | Explanation |
|---|---|---|
| Browser demonstration data (whoami page) | Legitimate interests (Art. 6(1)(f)) | Data is queried client-side only, never transmitted, and the processing is directly in your interest — it shows you what is exposed. Our legitimate interest in providing this educational demonstration does not override your rights. |
| Visit counter cookie (wbg_visits) | Consent (Art. 6(1)(a)) | Set only after you explicitly consent via our cookie banner. |
| Contact form submissions | Legitimate interests (Art. 6(1)(f)) | Processing is necessary to respond to your message. Our interest in being able to reply to an enquiry you chose to send does not override your rights. |
| Web server logs | Legitimate interests (Art. 6(1)(f)) | Necessary for server security, abuse prevention, and operational integrity. |
| Consent record (wbg_consent cookie) | Legal obligation + Legitimate interests (Art. 6(1)(c)+(f)) | We must record your consent decision to comply with GDPR and to avoid re-asking on every page. |
Retention Periods
| Data type | Retention period |
|---|---|
| Browser demonstration data (whoami page) | Not retained — processed in your browser only, never stored |
| Visit counter cookie (wbg_visits) | 1 year from last visit, or until you withdraw consent |
| Consent record (wbg_consent) | 1 year, or until you change your preferences |
| Contact form submissions | As long as reasonably necessary to resolve your enquiry, then deleted |
| Web server logs | As determined by our hosting provider (typically 30–90 days) |
Your Rights Under the GDPR
If you are in the European Economic Area or the United Kingdom, you have the following rights regarding your personal data:
To exercise any of these rights, please contact us via the contact form. We will respond within 30 days.
Your Rights Under CCPA / CPRA (California)
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights.
Categories of personal information collected
In the past 12 months, we have collected the following categories of personal information:
- Identifiers — IP addresses (in server logs only)
- Internet / network activity — Page requests, server log data
- Communications — Name, email, and message content (contact form only, when submitted)
We do not collect: geolocation data, biometric data, financial data, health data, or inferences used to create consumer profiles.
We do not sell or share your personal information
wannabegeek.dev does not sell personal information to third parties. We do not share personal information with third parties for cross-context behavioural advertising. As such, there is no need to opt out — but we disclose this clearly as required by CCPA.
Your California rights
To submit a verifiable consumer request, please use our contact form. We will respond within 45 days (with one 45-day extension if needed).
International Data Transfers
When your IP address is sent to stun.l.google.com:19302 as part of the
WebRTC demonstration on the whoami page, this data is transferred to Google LLC,
headquartered in the United States.
Google participates in the EU–US Data Privacy Framework and provides appropriate safeguards for international transfers of personal data from the EEA and UK. For more information, see Google's Privacy Policy.
If you use the contact form and it is configured to use a third-party processor (e.g. Formspree), your message data may also be transferred outside the EEA. You will be informed of the specific processor in use when the form is configured.
Children's Privacy
This website is not directed at children under the age of 13 (or 16 in the EEA where applicable). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If changes are material, we will display a notice on the site.
We encourage you to review this policy periodically. Continued use of the site after changes are posted constitutes your acceptance of the updated policy.
Contact & Data Requests
For any privacy-related enquiry, to exercise a data subject right, or to submit a verifiable consumer request under CCPA, please use our contact form and include "Privacy Request" in the subject line.
We will acknowledge your request within 72 hours and respond in full within the timeframes specified above.
If you are in the UK and are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO). If you are in the EEA, you may contact your national supervisory authority.