Privacy policy
How the editors handle personal data: contact form messages, short-lived server logs, Cloudflare, affiliate links and banners, and your GDPR rights.
Last updated 14 Oct 2026
This policy explains what personal data the magazine handles when you read it or write to the editors, why, for how long and what you can do about it. The site is run from the Netherlands, so the EU General Data Protection Regulation (GDPR) applies.
Who is responsible
The controller for the personal data described here is App Season, the editors of apprilfestival.com. Questions about this policy and requests about your data go through the contact page. Mention in your message that it concerns privacy, so it is picked up quickly.
What we collect and why
Messages you send us
When you write to us through the contact form, we receive your name, your email address and your message. We use them to read and answer what you sent, to make corrections you point out and to keep a record of the exchange. The legal basis is our legitimate interest in running a magazine that readers can reach. In plain words: you wrote to us, and we need your message to deal with it. When your message is a request about your data under the GDPR, we also process it because the law obliges us to answer.
Messages are deleted no later than 24 months after we receive them. We delete them sooner if you ask and nothing requires us to keep them.
Server logs
Like nearly every web server, ours records basic details of each request: the IP address, the user agent your browser sends and the time. We use these logs to keep the site running, to spot abuse such as repeated attempts to break into the editors' sign-in page and to trace errors. The legal basis is our legitimate interest in a secure, working website. Logs are kept for up to 30 days and then deleted.
What we don't collect
There is no analytics software on the site, no advertising tracker of our own, no fingerprinting and no social media plugin that reports your visit to a platform. We don't build profiles of readers, and we don't sell or rent personal data to anyone.
Cloudflare
Cloudflare, Inc. delivers the site's pages through its content delivery network and protects the site against attacks and automated abuse. Every visit passes through Cloudflare's servers, which process your IP address and technical request data to do that job. Cloudflare may also set a short-lived security cookie, described in the cookie policy. The legal basis is our legitimate interest in a fast and secure site. Cloudflare acts as a processor on our behalf. Where that involves transfers outside the European Economic Area, Cloudflare relies on safeguards recognized under the GDPR, such as the European Commission's standard contractual clauses.
Affiliate links and partner banners
Some pages contain affiliate links to Amazon and to advertisers in the CJ (Commission Junction) network, and some show partner banners. These partnerships pay for the writing, which is our legitimate interest in including them.
Following an affiliate link takes you to the retailer's or advertiser's own site. That site sets its own cookies, and the network may record the click so that a purchase can be credited to us. We don't receive your name or contact details from these networks.
Partner banners are served from the network's servers. When a page with a banner loads, your browser fetches the image from the network, which receives your IP address and the usual technical request data and may read or set its own cookies. What happens to that data is covered by the privacy policies of Amazon, CJ and the advertiser concerned. We don't pass any information about you to them ourselves.
How long we keep data
| Data | Kept for |
|---|---|
| Contact form messages (name, email address, message) | Up to 24 months, then deleted |
| Server logs (IP address, user agent, time) | Up to 30 days, then deleted |
Your rights
Under the GDPR you can ask us:
- for a copy of the personal data we hold about you (access);
- to correct data that is wrong (rectification);
- to delete it (erasure);
- to limit how we use it while a question about it is settled (restriction);
- to send you the data you gave us in a common, machine-readable format (portability);
- to stop processing it where we rely on our legitimate interest (objection).
Send your request through the contact page and use the email address you wrote from before, so we can find your messages and confirm they are yours. We answer within one month, as the GDPR requires.
If you think we have handled your data wrongly, tell us first so we can try to put it right. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in the EU country where you live.
Security
Connections to the site are encrypted with HTTPS. Messages can only be read by the editors, behind a password-protected sign-in that blocks repeated failed attempts.
Changes to this policy
If we change how we handle personal data, we update this page and the date on it. The version on this page is the one that applies.