Privacy Policy

This site sets no cookies, runs no third-party advertising and no cross-site tracking. It shows one banner for a project of my own, which you can dismiss. It keeps a few of your settings in your browser and counts page views without identifying you. The detail is below.

Who is responsible

Florian Kapfenberger, contact [email protected]. The full disclosure is on the imprint page.

Hosting and server logs

The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Every time your browser requests a page, the technical data needed to deliver it — your IP address, the requested URL, the time, and your browser's user agent — is processed and kept briefly to run and secure the service. The legal basis is my legitimate interest in operating a website that works and stays available (Art. 6 (1) (f) GDPR). Vercel processes data in the USA. Vercel Inc. participates in the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR); the listing is public at dataprivacyframework.gov/list. Vercel uses sub-processors of its own, listed at vercel.com/legal/subprocessors. Should that adequacy decision be annulled or suspended, transfers continue on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).

The site is served through the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which sits in front of the hosting and delivers pages from a location near you. Because it is the first server your browser talks to, Cloudflare processes your IP address, the requested URL, the time, your browser's user agent and connection metadata in order to route the request, cache the response and block attacks. The legal basis is my legitimate interest in a fast and attack-resistant website (Art. 6 (1) (f) GDPR). A data processing agreement under Art. 28 GDPR is in place with Cloudflare, incorporated by reference into its self-serve subscription agreement. Cloudflare processes data in the USA. It states that it has certified to the EU-U.S. Data Privacy Framework, which the European Commission recognised as adequate on 10 July 2023 (Art. 45 GDPR), and that it falls back on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR) should that certification lapse; write to me for a copy of those. Its own privacy policy is at https://www.cloudflare.com/privacypolicy/.

Visitor statistics

I use Vercel Web Analytics to see how many people read an article and where they came from. Vercel Web Analytics documents that it stores no cookie and no identifier in your browser. Vercel derives a hash from the incoming request to recognise a visit, and documents that this visitor session is discarded automatically after 24 hours and that no identifier is used that could follow you to another website. The legal basis is my legitimate interest in knowing which articles are worth writing more of (Art. 6 (1) (f) GDPR).

Vercel records, for each page view:

• the time of the visit
• the page address and the route pattern behind it
• the referrer that sent you there
• query parameters, filtered by Vercel
• an approximate location derived from your IP address — country, region and city
• your device type, operating system and browser, including version numbers

I see these only as aggregate counts in a dashboard, never as one reader's history. The statistics work without storing anything in, or reading anything from, your browser, so they do not trigger the consent requirement in § 165 Abs 3 TKG 2021 and no consent banner is shown for them.

Settings stored on your device

These preferences live in your browser's local storage and are never sent anywhere:

• theme — the theme you picked
• reduce-motion — whether you asked for reduced motion
• show_banner — that you dismissed my announcement banner, so it stays dismissed

These entries have no expiry date and stay in your browser until you change the setting again or clear them through your browser's site data settings. They contain nothing but the value shown above and are never transmitted to me or to anyone else, so nothing here recognises you across visits.

Storing them, and reading them back when a page loads so the site renders the way you chose, is storage on and access to your terminal equipment within the meaning of § 165 Abs 3 TKG 2021. No consent is required for it, because each entry exists solely to deliver the site the way you explicitly asked for it — that is the exemption for what is strictly necessary to provide a service the user expressly requested. Nothing here measures you.

Content loaded from other providers

A few things on this site are fetched from servers I do not run. When that happens, your IP address necessarily reaches that provider, because it is what delivers the content to you:

• CodeSandbox — an embedded live code editor, loaded from codesandbox.io and csb.app.

The legal basis is my legitimate interest in illustrating articles with runnable examples (Art. 6 (1) (f) GDPR). CodeSandbox B.V. is established in the Netherlands, so this is not a transfer to a third country; CodeSandbox states in its own privacy policy that it may pass data to parties outside the EEA and that it does so only where there is an appropriate level of protection.

Fonts, images and the donation button are all served from this site's own domain, so no other provider learns anything about you through them. Links to GitHub, Bluesky or LinkedIn are plain links: nothing is loaded from them until you click.

How long data is kept

Vercel keeps its server logs for one hour on the free plan this site runs on — that is the window Vercel publishes for viewing runtime logs, and Vercel does not publish how long it holds the underlying records internally. Cloudflare keeps its logs for no period Cloudflare publishes; it states only that it keeps personal data as long as is consistent with the purpose it was collected for. Analytics data is aggregated by Vercel and viewable for one month on the free plan this site runs on. Vercel notes that it may hold the data longer than that window so a later plan upgrade does not lose it.

Your rights

I hold no personal data about you myself. Everything described here is processed by my providers in order to deliver the site, and a message to me is the fastest way to have me take it up with them. You have the right to access your data, to have it corrected or erased, to have its processing restricted, and to object to processing based on legitimate interest. Data portability under Art. 20 GDPR does not apply here, because nothing on this site is processed on the basis of consent or a contract. Write to [email protected] and I will handle it. If you think I am getting this wrong, you can complain to the Austrian data protection authority, the Datenschutzbehörde (dsb.gv.at), Barichgasse 40-42, 1030 Vienna.

I do not use your data for automated decision-making or profiling within the meaning of Art. 22 (1) and (4) GDPR.

Your right to object

Where I process your data on the basis of my legitimate interests (Art. 6 (1) (f) GDPR) — the hosting, the delivery network, the visitor statistics and the embedded content described above — you have the right to object at any time, on grounds relating to your particular situation, under Art. 21 (1) GDPR. If you object, I will stop that processing unless I can demonstrate compelling legitimate grounds which override your interests, rights and freedoms. A message to the address above is enough; no form and no reason are required.