Skip to content
Blog
Privacy and terms: the legal pages of a personal website

Privacy and terms: the legal pages of a personal website

Oct 12, 2026
Part 26 of the Journey

In the previous post, I shared the complete map of our ecosystem and where each of our 16 agents is located — split across the mobile app, my laptop, and the cloud.

What I wanted to solve

I work during the day, and at night and on Sundays I build with AI agents. I have never programmed professionally. When you put a site online, the first impulse is to focus entirely on visual presentation: picking clean colors, organizing article layouts, and making sure every link works. That was exactly what I did in early October 2026. The blog was running smoothly on Hugo, deployed automatically via Cloudflare Pages, with our first article live and our agents’ avatars illustrating the team roles.

To me, everything seemed ready. But before calling the launch complete, I decided to consult Legal — the assistant I keep in the Grok Bot app dedicated to answering questions in plain language. I asked Legal to review the site carefully and point out anything still missing regarding rules, transparency, and legal requirements.

Legal was direct: even for a personal blog with no commercial intent and no products for sale, hosting public web pages means meeting baseline privacy requirements under Brazilian data protection law (the LGPD) and making content ownership crystal clear. Legal flagged a short privacy notice (in both Portuguese and English) and the open-source license attribution for our theme as mandatory, while recommending terms of use to define copyright rules for our articles.

I wanted to handle this simply. I did not want to bury the site under dense legal jargon that nobody reads, and I certainly did not want to cover the screen with annoying cookie banners that block the text.

Quick summary

  1. Legal flagged a clear privacy notice and theme license attribution as mandatory, alongside recommending terms of use.
  2. I chose open direct messages (DMs) on X as our sole contact channel, removing the need for web contact forms.
  3. The site was built without tracking or advertising cookies, so it requires no cookie consent banners.
  4. I adopted the Creative Commons Attribution 4.0 International license (CC BY 4.0) for all published articles.
  5. The pages /privacidade/ and /termos/ (and their English counterparts /en/privacy/ and /en/terms/) went live on 3 October 2026 at around 18:34.

First: what these legal pages and terms actually are

For anyone without a background in law, compliance pages often look like pointless paperwork. But the core idea behind each one is straightforward when explained without jargon.

Privacy Policy and the LGPD The Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) regulates how personal data must be handled. Many people assume a modest blog does not need a privacy notice because it sells nothing and requires no user accounts. That is not how it works. Whenever someone opens any web page, the hosting server must receive technical connection details — such as an IP address — to deliver the requested files to the screen. A Privacy Policy is simply an honest public statement explaining what the server technically processes, what it does not do with that data, and the legal ground for keeping the site online.

Terms of Use Terms of Use act as a clear agreement between author and reader. They set plain expectations: this site is a free educational diary maintained by a non-programmer sharing what he learns with artificial intelligence. The text clarifies that articles are published strictly for informational purposes and do not constitute professional advice or legal guidance of any kind. That keeps expectations aligned from day one.

Cookies versus local browser storage A cookie is a small text file stored in your browser by a website to follow your activity across the web over time — very common in advertising networks. Local browser storage (localStorage) works differently: it functions like a private drawer locked inside your own device. On our site, when you toggle between dark mode and light mode, that preference is saved only inside your browser’s local drawer. The server does not track your choice, and nothing is sent to third parties.

Creative Commons License (CC BY 4.0) Under traditional copyright law, almost every published text comes with ‘all rights reserved’ by default. That means nobody can copy or share the material without prior permission. Because the goal of my diary is to teach what I am learning for free, I chose the Creative Commons Attribution 4.0 International license (CC BY 4.0). It allows any reader to share, copy, and distribute the articles, as long as they give proper credit.

What I used

  • Legal (in the Grok Bot app): assistant configured to clarify regulatory questions in accessible language.
  • Hugo: static site generator that compiles Markdown files into clean, lightweight web pages.
  • Hextra theme: open-source visual theme featuring built-in support for institutional pages and bilingual navigation.
  • GitHub: repository storing all site files with complete change history.
  • Cloudflare Pages: hosting service that deploys updates automatically whenever changes reach GitHub.
  • CC BY 4.0 License: standard open copyright license for written content.

How we built the pages

Guided by Legal, I tackled the setup in four practical steps on 3 October 2026.

1. Choosing the contact channel Before drafting terms, I had to decide how readers could reach me with privacy questions or feedback. Adding a web form would require collecting visitor names and email addresses, creating extra responsibilities for storing personal data. Publishing an open email address on the page would invite automated spam bots. On 3 October 2026, I decided that our sole official contact channel would be direct messaging (DM) on X, kept open to anyone. Anyone who wants to talk can go straight to @RodrigoesPorto. That kept the setup lightweight and secure.

2. Drafting the Privacy Policy Instead of pasting generic templates from the web, we wrote a policy that reflects the exact technical reality of our site:

  • No tracking: the site uses zero cookies for advertising, analytics, or behavioral tracking.
  • No forms or accounts: there are no user profiles, logins, comment sections, web forms, or newsletter signups.
  • Hosting and defense: Cloudflare hosts the site and processes basic connection data strictly to deliver pages and defend against malicious traffic.
  • Aggregate metrics: our visitor counter (Cloudflare Web Analytics) measures only aggregate visit numbers without using cookies.
  • Local theme and search: theme preference toggling and site search run entirely inside the visitor’s browser.
  • Legal basis: processing relies on legitimate interest under Article 7, IX of the LGPD to maintain operational integrity and security.
  • Contact path: states clearly that any data requests can be submitted via X direct messages.

3. Structuring the Terms of Use Our terms establish simple, transparent project boundaries:

  • Personal, free diary: a volunteer project maintained to document learning and experiments.
  • Educational content: articles do not represent professional or legal advice.
  • No warranties: content is provided as-is, representing personal experiments by an independent learner.
  • AI transparency: clear disclosure that articles are drafted with the assistance of artificial intelligence agents and personally reviewed by me before publication.
  • Open licensing: texts are licensed under CC BY 4.0, requiring attribution formatted as “Rodrigo ES Porto — rodrigoesporto.com”.
  • Third-party trademarks: mentioned brands and logos belong to their respective owners, with no endorsement or affiliation implied.
  • Theme attribution: required open-source license notice for the Hextra theme.

4. Creating the files and deploying I authored the Markdown files for both site editions: /privacidade/ and /termos/ in Portuguese, and /en/privacy/ and /en/terms/ in English. Late in the afternoon on 3 October 2026, around 18:34, I pushed the corrective commit to GitHub. Cloudflare Pages finished building within seconds, and all four pages were live.

What I learned and what went wrong

The biggest lesson from this process was realizing that cookie banners are not an inevitable nuisance of modern browsing. Most websites show those persistent pop-ups because they install tracking scripts that follow visitors across the web to sell ads. When you deliberately design your site to avoid tracking cookies, you do not need a cookie banner at all.

Skipping the banner does not mean skipping a privacy policy. Under the LGPD, you still have an obligation to explain clearly how server connection logs are handled. Transparency remains mandatory, but the reading experience stays uncluttered and pleasant.

Drafting the terms also required deliberate effort. The initial drafts from Legal leaned heavily toward formal legalese. I asked the assistant to simplify the text three times until the explanations became short and conversational. If an everyday reader cannot easily understand the rules of a personal blog, the fault lies with the writing.

An honest caveat: I am not a lawyer or a digital privacy specialist. I share everything here as a student exploring technology, and this article reflects a non-expert’s perspective, not formal legal counsel.

Costs and limits

  • Financial cost: $0 additional. Consulting Legal used our existing setup, and static pages run for free on Cloudflare Pages.
  • Time spent: roughly an hour and a half across researching requirements, writing bilingual drafts, and deploying the commit on 3 October 2026.
  • Limits: this streamlined approach works because our site is purely static. If I ever introduce comments or newsletter capture, the policy will need a thorough revision to handle active consent and subscriber data.

What I would do differently

If I were building the site today, I would draft the privacy policy and terms of use alongside the initial About and Contact pages. Postponing compliance documentation until after site launch required a last-minute corrective commit that could have been avoided with earlier planning.

Who this is for and who it is not for

This approach is ideal for anyone running a personal blog, portfolio, or documentation site who wants to comply with privacy regulations cleanly, without loading heavy consent plugins.

It is not intended for online stores, corporate platforms, or sites running programmatic advertising, all of which require dedicated legal counsel.

Next steps

With our privacy and terms pages published, we complete all 26 parts of the initial launch roadmap for rodrigoesporto.com. In our next installment, I will share the next practical steps of this artificial intelligence journey and the ongoing work routine with our team of agents.

If you are building your own web projects and want to follow this journey with artificial intelligence, connect with me on X at @RodrigoesPorto. I regularly share our progress there, and my DMs are open.

Sources and links

The ecosystem map: each agent and where it livesHow the agents work each day, and the fixes I had to make by hand