Privacy

Last updated: 29 September 2026

Site owner and controller

The site matthewjohn.ch is published and run by Matthew John, in a personal and professional capacity, from Switzerland. He is the controller of the personal data collected through the site and is responsible for the published content under Swiss law.

The pages are static files hosted by Hostinger International Ltd., which supplies the space and the connectivity; the content is published by the owner. The provider’s registered office and the country of the servers are stated in the section "Recipients and processors".

• Name: Matteo Luca, who publishes and signs his work as Matthew John
• Address: Via degli Orti 20, 6616 Losone, Switzerland
• Email: business@matthewjohn.ch
• Representative in the European Union: none appointed. The site does not sell goods or services through its pages and does not monitor visitor behaviour; the only processing that may concern people in the European Union is replying to messages received through the contact form, which is occasional and involves no special categories of personal data.
• Data protection advisor (FADP) and data protection officer (GDPR): none appointed.

Scope and applicable law

The data protection sections cover the site matthewjohn.ch, in Italian and in English, and what it offers: the information pages, the contact form and the tools that run in the browser.

Processing follows the Swiss Federal Act on Data Protection (FADP) in the revised version in force since 1 September 2023 and its Data Protection Ordinance (DPO). Regulation (EU) 2016/679 (GDPR) may apply to visitors located in the European Union or the European Economic Area; where it applies, this notice also meets its requirements.

The terms "personal data", "processing", "controller" and "processor" have the meaning the two laws give them.

Browsing and technical logs

The pages are static files served by Hostinger. Like every web server, the one hosting the site records the technical data of each request: IP address, date and time, page or file requested, response code, referring page and browser identifier (user agent).

These logs serve to keep the site running, to locate faults and to prevent abuse. They are not combined with other data and are not used to identify individual visitors.

The logs are generated and kept by the hosting provider, which does not publish a retention period for web server access logs; in its control panel the access logs are viewable up to seven days back. Its data processing agreement provides that customer data is deleted thirty days after the end of the contract, subject to the terms of the particular service.

Contact form

The form on the "Contact" page asks for four items: name, email address, topic (chosen from a list) and message. All four are needed to reply; there are no optional fields and no requests for other data.

The form carries two measures against automated submissions. The time the page was opened stays in the browser and is not transmitted: it serves to discard a form filled in under three seconds. A hidden checkbox, which a person neither sees nor ticks, blocks the submission if it is found ticked; without JavaScript the submission is the browser’s native one and the timing check does not run. Together with the four fields, the service key, the chosen subject, the name the mailbox shows as sender and, without JavaScript, the address of the thank-you page are transmitted; to that subject the script adds the name and address of the sender, so the mailbox shows them without opening the message. This is not profiling and produces no stored data about the visitor.

Submission goes through the Web3Forms service, which receives the form fields and delivers them by email to the controller’s mailbox. The site has no server of its own to process them. Like every service reached over the internet, Web3Forms also receives the IP address and the user agent of the sending browser. With JavaScript disabled, submission uses the same service and the confirmation appears on a thank-you page of this site, which records nothing.

Messages are used only to answer the request and for any follow-up to it. They are not added to newsletters, not passed on and do not feed contact lists.

Tools on the site

The "Tools" section gathers utilities that run entirely in the browser. The code is downloaded with the page and processing happens on the visitor’s device: no entered data and no uploaded file is transmitted to a server.

• Files: the tools that read, convert or merge files (PDF, images, spreadsheets, Word documents) process them locally. The result is generated and downloaded in the browser; the file does not leave the device.
• Camera and microphone: three tools (webcam and microphone test, tuner, guitar amplifier) request access through the browser’s permission prompt. The audio or video stream stays in the browser, is neither recorded nor transmitted, and stops when the tool is closed. The names of connected devices are listed by the browser only after consent.
• Notifications: the pomodoro timer may ask permission to show system notifications; the choice stays in the browser.
• Screen and clipboard: the teleprompter may ask the system to keep the screen on; some tools copy a result to the clipboard, only on your action.
• No tool requires registration or an account.

Cookies, browser storage and analytics

The site sets no cookies, neither its own nor third-party ones, and loads no third-party scripts. There is no traffic analytics, advertising or profiling system. For this reason no consent banner is shown.

The only storage used is the browser’s session storage (sessionStorage), which is cleared when the tab closes and is never transmitted. It holds:

• the volume and mute settings chosen in the audio tools and in the side music staff;
• the configuration of the pomodoro timer (the durations, not the count);
• a flag that the home page animation has already been seen, to shorten it on later visits.

Fonts, embedded content and external links

The typefaces are served from the site’s own domain: no request is sent to Google Fonts or other content delivery networks. The home page reads the device’s graphics capabilities to choose the animation quality; the value stays in the browser.

The site embeds no third-party videos, maps, audio players or social network widgets.

Some pages link to external sites: the sites of the projects delivered and the controller’s social profiles. Following a link leaves this site, and the destination site’s notices apply.

Should an analytics system or embedded content be switched on in the future, this page will be updated before activation.

Legal bases

Under the FADP, processing by private persons is lawful when it respects the principles of lawfulness, good faith, proportionality and purpose and does not infringe the personality of the data subject. The processing described here follows these principles: answering those who write and keeping the site running and secure.

Where the GDPR applies, the legal bases are:

• Art. 6(1)(b), for the contact form: processing is needed to follow up a request from the data subject, also with a view to a possible contract;
• Art. 6(1)(f), for the technical logs and the measures against automated submissions: the legitimate interest in keeping the site running and secure.
• Browser permissions for camera, microphone and notifications are technical authorisations managed by the device: they involve no transmission of data to the controller and can be revoked in the browser settings.

Recipients and processors

Personal data is neither sold nor passed on. Only the technical providers needed to run the site have access to it, acting as processors on the controller’s instructions:

• Hostinger International Ltd., a company under Cypriot law, registered office: 61 Lordou Vironos str., 6023 Larnaca, Cyprus. Service: hosting of the pages and server logs. The servers that serve this site are located in Germany.
• Web3Creative, the business that operates the Web3Forms service and states that it operates from India; its terms are governed by Indian law and name the courts at Palakkad, Kerala. Service: receipt of contact form messages and forwarding by email to the controller’s mailbox. The infrastructure is provided by Amazon Web Services, Cloudflare and Hetzner; for filtering unwanted submissions, the sender’s IP address and email address may be passed to CleanTalk and to Akismet (Automattic), in the United States. The list of sub-processors as at the date of the agreement is published in the provider’s data processing agreement, which undertakes to keep an up-to-date version.
• Google Cloud EMEA Limited, registered office: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Service: the controller’s mailbox (Google Workspace), where form messages arrive and are kept. Google publishes the list of its sub-processors, among them Google LLC in the United States; the list also includes third-party suppliers processing data in other countries.
• The controller may disclose data to an authority when required by law. No other recipient is foreseen.

Transfers abroad

The site is run from Switzerland. Contact form messages are processed by Web3Creative in India, which is not listed in Annex 1 of the Swiss Data Protection Ordinance among the states where adequate data protection is guaranteed. For transfers from Switzerland, the provider’s data processing agreement incorporates by reference the European Commission standard contractual clauses (Implementing Decision (EU) 2021/914), with Web3Creative as data importer and the controller as data exporter. The agreement does not contain the adaptations the FDPIC requires for using those clauses under Swiss law: the FDPIC as supervisory authority, references to the GDPR read as references to the FADP, the right of data subjects in Switzerland to bring their claims at their place of habitual residence, and the choice of Swiss law. For filtering unwanted submissions, the sender’s IP address and email address may be passed to two services in the United States; the provider undertakes to impose on its sub-processors data protection obligations no less protective than those of its own agreement. Anyone who prefers their message not to pass through India can write directly to business@matthewjohn.ch.

The server logs are located in Germany and the mailbox is run by a provider established in Ireland. Germany and Ireland are both listed, as states, in Annex 1 DPO among those where adequate data protection is guaranteed: the transfer needs no additional safeguard. Both also belong to the European Economic Area, where the GDPR places no restriction on transfers.

Its data processing addendum provides that, subject to the data location and data transfer commitments set out in that addendum, customer data may be processed in any country where Google or its sub-processors maintain facilities. For transfers of Swiss data to the United States, Google has applied since 16 September 2024 the certification of Google LLC under the Swiss-U.S. Data Privacy Framework. Google states that it has adopted no other transfer solution for Swiss data going to other third countries: for countries that are not among those with adequate protection, transfers from Google to its sub-processors rely on the European Commission standard contractual clauses incorporated by its addendum, supplemented by the additional terms for transfers subject to the FADP.

Where the GDPR applies, the same transfers follow the safeguards of Chapter V of the regulation; the safeguard used is the one stated above.

Retention

Data is kept for as long as the purpose it was collected for requires:

• technical logs: for the period the hosting provider decides, which it does not publish; in its control panel the access logs are viewable up to seven days back, as stated in the section "Browsing and technical logs";
• contact form messages: in the controller’s mailbox for as long as needed to reply and handle the follow-up; messages that do not lead to a professional relationship are deleted once the exchange is over;
• copies at Web3Forms: thirty days from submission, the period set for this form; the provider’s terms allow it to be chosen between seven days and three years; after the contract ends the provider deletes the data within ninety days, and residual copies in backups are overwritten in the ordinary backup cycle;
• browser session storage: until the tab is closed;
• camera and microphone streams: not retained.
• If a message leads to a professional relationship, the data needed for that relationship follows the retention periods Swiss law sets for business records.

Security

The site is served over HTTPS only: plain requests are redirected and the browser is instructed to use the encrypted connection for one year (HSTS). Contact form submission also travels over an encrypted connection.

The server sends security headers that restrict camera and microphone use to pages of this domain, deny geolocation and payment, prevent the site from being embedded in third-party pages and reduce the referrer information passed to external sites.

The site has no database, no restricted areas and no password logins: there is no store of visitor data that could be breached. The mailbox is protected by the measures of the provider named in the section "Recipients and processors" and by the controller’s credentials.

Your rights

Under the FADP (Art. 25–32) and, where it applies, the GDPR (Art. 15–22) you can:

• find out whether data about you is processed and receive a copy (access);
• have inaccurate data corrected (rectification);
• request the erasure of your data or, where the GDPR applies, the restriction of processing;
• object to a processing operation;
• receive the data you provided in a common electronic format (portability), where that right is provided for.
• To exercise them, write to business@matthewjohn.ch. To protect your data, proof of identity may be requested. A reply is given, as a rule, within thirty days. Exercising your rights is free of charge, except in the cases of manifestly unfounded or excessive requests provided for by law.
• You may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. If you are located in the European Union or the European Economic Area, you may also lodge a complaint with the supervisory authority of your country of residence.

Minors

The site is not aimed at minors and does not knowingly collect data from minors. A person holding parental responsibility who believes a minor has sent data through the form can write to business@matthewjohn.ch to request its erasure.

Copyright and use of content

Texts, photographs, graphics, emblems, audio and the code of the tools published on this site belong to Matthew John, unless another author is stated, and are protected by the Swiss Copyright Act (CopA).

You may consult the pages, use the tools and quote short excerpts with attribution. Reproduction, modification, distribution or commercial use of the content require the owner’s written consent.

The files you generate with the tools (converted documents, PDFs, images, exports) are yours: the site keeps no copy and claims no rights over them.

The productions and musical works mentioned on the project and service pages belong to their respective rights holders and are named for information purposes.

The site uses open source components, each under its own licence: Astro and Preact (MIT), pdf-lib (MIT), SheetJS Community Edition (Apache 2.0) and the typefaces Space Grotesk and JetBrains Mono (SIL Open Font License).

Trademarks and third-party names

The names of companies and people mentioned on the "About", "Work" and "Services" pages appear with the consent of those concerned. On the "News" pages the names of companies, products and works are cited for information and comment. The names of third-party products and services, for example software, are cited to describe the work done. Trademarks belong to their respective owners; a mention implies no affiliation, sponsorship or endorsement.

Anyone who considers a mention inaccurate or unauthorised can write to business@matthewjohn.ch: the entry is checked and, where needed, corrected or removed.

Limitation of liability

The content of the site is written with care but is provided without any guarantee of completeness, accuracy or currency. The owner may change or remove it at any time without notice.

The tools are provided "as is", without any guarantee of operation, availability or fitness for a particular purpose. The results they produce (calculations, conversions, quotes, audio measurements, text analyses, decodings) are indicative and do not constitute professional, tax, legal or technical advice. Verify a result before making decisions based on it.

To the extent permitted by Swiss law, the owner is not liable for direct or indirect damage arising from the use of the site and the tools, from the inability to use them or from errors in the content. Liability for wilful intent or gross negligence and mandatory consumer protection rules remain unaffected.

Liability for external links

The links to third-party pages listed in the section "Fonts, embedded content and external links" were checked when the link was published, but the owner does not control their content and is not responsible for it. A link is not an endorsement.

Anyone who finds a link to content that is no longer correct or is unlawful can report it to business@matthewjohn.ch.

Applicable law and jurisdiction

Swiss law applies to this site and its use, excluding conflict-of-law rules. The place of jurisdiction is the owner’s domicile, in Ticino. Mandatory places of jurisdiction provided for by law, in particular for consumers, remain unaffected.

The processing of personal data is governed by the FADP and, where applicable, the GDPR, on the terms described in the earlier sections of this page.

Changes to this page

This text may change when the site, its providers or the law change. The version in force is the one published on this page, with the date at the top. Changes are made known by updating that date; no individual notification is sent.

Contact

For questions about this page, about the processing of your data or about the content of the site: Matthew John, at the postal address given in the section "Site owner and controller", or business@matthewjohn.ch. Requests may be written in Italian or in English.