How I handle data on this site. Short version: I collect as little as possible and do not sell anything.
// Last updated: September 2026
Who I Am
This is the personal website of Aidan Yagu, an independent AI music artist, at aidanyagu.com. I run it myself, so "I" on this page means me. Questions about this policy, or anything below, can go through the contact form on the About page, which lands in my inbox, or by email to info@aidanyagu.com.
The Short Version
There are no visitor accounts and no comments. The Google sign-in and comment section this site used to have were removed in September 2026.
The only things that store personal data on this site are the newsletter sign-up and the contact forms, and only if you use them.
Google Analytics only runs if you agree to it in the cookie banner.
I don't sell data, and I don't use your email for ad targeting or audience matching.
Newsletter
You can sign up on the blog, in the prompt that shows up halfway through a blog post, or with the checkbox on the contact form. I'm planning a newsletter for new posts and music drops, with no schedule yet. Signing up is double opt-in: you get an email with a confirmation link, and nothing else happens until you click it. After you confirm, you get a short welcome email with an unsubscribe link.
For each sign-up the site stores:
your email address
the status of the sign-up (waiting for confirmation, confirmed, or unsubscribed)
where you signed up (for example, the blog sidebar)
your IP address and country at the moment you signed up, as a record of the sign-up
which version of the sign-up wording you agreed to
a one-time confirmation code, which is cleared once you confirm
the dates you signed up, were sent the confirmation, confirmed and unsubscribed
The emails themselves are sent through Resend (see Third-Party Services).
Contact Forms
The form on the About page and the pitch form on Collabs store your name, email address, message, its topic and the time you sent it. The site then emails the message to me through Resend, with your address set as the reply-to so I can answer you. The site also keeps a small log of the emails it sends (recipient, subject line, delivery status), and the subject line of a contact email can include your name.
Analytics and Cookies
Cookie banner: Cloudflare Zaraz runs the consent banner and stores your choice in a cookie so it doesn't ask again on every visit.
Google Analytics 4 (only with consent): loaded server-side through Cloudflare Zaraz, using Google Consent Mode v2. If you agree, GA4 records things like the pages you visit, roughly where you are (country or city), your device and browser, and how you found the site, and it may set cookies to recognise repeat visits. If you decline, it doesn't set those cookies.
Cloudflare Web Analytics: counts page views without cookies and without tracking you across sites.
Security: Cloudflare's bot protection may set a security cookie (cf_clearance) to tell people apart from bots.
Browser Storage
A few things are saved in your own browser (local and session storage). None of it is sent to me, and none of it identifies you:
ay_volume: the player volume you picked
ay_settings: a cached copy of the site's public settings, so pages load faster
ay_nl_prompted and ay_nl_midread_shown: whether you already answered or saw the newsletter prompt, so it doesn't keep popping up
ay_player: what the player was playing, so music keeps going when you switch pages (cleared when you close the tab)
If you signed in here before September 2026, the site removes what that sign-in left in your browser the next time you visit: the saved Google sign-in and the ay_user_cache and ay_yt_subscribed entries.
Third-Party Services
These services process data when you use this site:
Cloudflare: hosts the site and its database and file storage (the database runs in Western Europe), and provides the security layer, Web Analytics and Zaraz. It sees request data such as your IP address. See Cloudflare's Privacy Policy.
Resend: sends the newsletter confirmation and welcome emails and forwards contact form messages to me. It receives the email address and the content of those emails. See Resend's Privacy Policy.
Google Analytics 4: only with your consent, as described above. See Google's Privacy Policy.
YouTube (Google): the player at the bottom of every page plays a YouTube playlist. It only loads YouTube when you press play (or when music is already playing and you move to another page), and from then on YouTube may set its own cookies. Music videos on the Best Of page and in some blog posts use YouTube's privacy-enhanced mode (youtube-nocookie.com). Video thumbnails on the home, music and Best Of pages load from YouTube's image servers, so Google sees your IP address when those pages load.
Google Fonts: blog posts currently load a font stylesheet from Google Fonts, so Google sees your IP address when you open a post. The rest of the site uses fonts hosted on this site.
Instagram (Meta): one blog post (Adam Neely on AI Music) embeds an Instagram post. Opening that post loads Instagram's embed script and content from Instagram's servers straight away, so Meta sees your IP address and may set its own cookies. See Instagram's Privacy Policy.
AIU.FM: the live radio option in the player. The stream and its now-playing info only load when you switch the player to AIU.FM.
Firebase Authentication (Google): used only for my own admin login. Visitors can't sign in, and no visitor data goes to Firebase.
Apart from that one Instagram post, links to Spotify, Apple Music, Bandcamp, social networks and similar sites are plain links. Nothing from them loads until you click, and once you're there, their own privacy policies apply.
Legal Basis for Processing (GDPR)
Newsletter: your consent (Art. 6(1)(a) GDPR), which you give by confirming the sign-up. You can withdraw it any time by unsubscribing.
Contact forms: answering the message you sent me (Art. 6(1)(b) and (f) GDPR).
Google Analytics: your consent (Art. 6(1)(a) GDPR), given or refused in the cookie banner.
YouTube player and AIU.FM radio: they only load when you press play or switch to the radio, to play what you asked for (Art. 6(1)(f) GDPR).
Everything else (hosting, security, cookieless page-view counts, the thumbnails and fonts loaded from Google, and the Instagram post embedded in one blog post): my legitimate interest in running a site that works and stays safe (Art. 6(1)(f) GDPR).
How Long I Keep Things
Newsletter sign-ups: until you ask me to delete them. If you unsubscribe, your address stays on file marked as unsubscribed so it doesn't get emailed by mistake. Ask, and I'll remove it completely.
Contact messages: until I clear them out. Ask, and I'll delete yours.
Google Analytics: at most 14 months, after which Google deletes it automatically.
Your Rights
Under GDPR you can ask to see the personal data I have about you, get it corrected or deleted, restrict or object to how it's used, and get a copy of it. Here's how:
Newsletter: use the unsubscribe link in the welcome email, or ask me through the contact form or by email.
Old account or comments: if you had an account here before September 2026 and want anything left over deleted, ask through the contact form or by email.
Google Analytics: change your consent any time with the button below.
Complaints: you have the right to complain to a data protection authority. In Germany, that's the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) or your state's data protection authority.
Cookie Preferences
You can change your cookie choices any time. They're stored in your browser and don't affect anyone else.
Changes to This Policy
I update this page when the site changes. The date at the top shows the latest revision.