Effective date: 6 October 2026
1. Operator and scope
Mieko Studio, Ukraine, operates https://miekostudio.com. Contact: mavka.irl@gmail.com. This policy covers the studio website and enquiries sent through it. HabitMio and SiQuiz have separate product policies; this policy does not change their product practices.
2. Website requests and preferences
Cloudflare hosts the website through Workers and Static Assets. It processes web-request information such as IP address, browser/request headers, requested URL and security information to deliver and protect the website. Our Worker request logging and observability are disabled. Infrastructure providers may process their own operational and security records; disabling Worker logs does not eliminate their processing.
The website has no accounts, payments, advertising or application analytics/tracking integration. It does not set application cookies. The mieko-theme localStorage entry keeps your selected theme in your browser until you change it or clear site storage. It is not sent with contact messages or used as a tracking identifier. Otherwise, the site uses your system theme. Language is selected through the URL.
3. Contact messages
The form collects your name, email, subject, optional project, message, selected language and confirmation of consent to this processing. We use these to receive, understand and respond to enquiries and related support, privacy or security issues. Sending an enquiry is optional; required fields are necessary to send and respond to it. Do not include passwords, payment credentials or unnecessary sensitive information. Direct email and any attachments you voluntarily include are handled as part of your enquiry.
Your submitted email becomes Reply-To so our reply reaches you. We do not send an automatic confirmation email or subscribe you to marketing. The browser sends the form to our server endpoint; the Resend API key stays on the server. Resend delivers the message from Mieko Studio <noreply@miekostudio.com> to mavka.irl@gmail.com, a Google/Gmail mailbox. Cloudflare processes the request, Resend processes message/delivery information and Google processes received mail. The website has no contact database.
4. Security and abuse prevention
The endpoint validates origin, required fields, email format, lengths and payload size. It uses a hidden anti-bot field and a Cloudflare rate limiter. A hash of client IP and hostname is used for approximately three endpoint attempts per sixty seconds per client IP at a Cloudflare location. Invalid attempts can consume the quota; shared connections may share it. The limiter is approximate, not a guaranteed global counter. Our application does not write messages or IP addresses to logs. HTTPS, access controls and server secrets help protect data, but absolute security cannot be guaranteed.
5. Retention and recipients
We keep correspondence in the support mailbox only as long as needed to respond, resolve the enquiry and meet applicable legal obligations, then delete it. Mailbox deletion does not necessarily immediately remove provider backups or operational records. Cloudflare, Resend and Google apply their own service retention and security practices to infrastructure, delivery records and backups. The website does not persist form messages; the limiter maintains temporary quota state. We do not sell enquiry data or disclose it to advertising networks. Disclosure may be required by applicable law or necessary to address a security incident or protect lawful rights.
These providers use international infrastructure, so processing may occur outside Ukraine. Provider arrangements and applicable protections govern that processing; we do not promise exclusive storage in Ukraine. See Cloudflare's privacy policy, Resend's privacy policy and Google's privacy policy.
6. Choices and rights
Contact mavka.irl@gmail.com about information you provided. Subject to applicable law, you may request access, correction or deletion, object to or restrict processing, and withdraw consent where processing relies on consent. Withdrawal does not invalidate earlier lawful processing; necessary legal retention may still apply. We may request proportionate information to verify a request. You may complain to the competent data-protection authority, including Ukraine's Parliamentary Commissioner for Human Rights where applicable. Clearing site storage removes your saved theme, not correspondence held by mail providers.
7. External services and changes
External links lead to separate services with their own policies. Project availability is described on project pages; those links do not transfer your local app records through this website. We may update this policy when the website or processing changes and publish the revised effective date here. Use the contact above for privacy questions.