Datenschutz

Information on the processing of your personal data pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR / DSGVO). This website is operated from Germany and is subject to the GDPR and the German TDDDG. This notice is provided in English because the website addresses an international, English-speaking audience.
Dies ist die Datenschutzerklärung gemäß Art. 13, 14 DSGVO. Sie ist auf Englisch verfasst, da sich dieses Angebot überwiegend an ein internationales, englischsprachiges Publikum richtet.

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4 (7) GDPR is:

See also the Impressum.

Data protection officer

I have not appointed a data protection officer, as the statutory conditions for a mandatory appointment under Art. 37 GDPR and § 38 BDSG are not met for this website. Please direct any data protection inquiries to the contact details above.

2. At a glance

This is a small personal blog. It is deliberately built to collect as little data as possible:

• No advertising and no cross-site tracking. There is no Google Analytics, no Matomo, no tracking pixel, no advertising network, and no profiling. A privacy-focused, cookieless reach measurement by my hosting provider is active; it is described in section 5.
• No cookies of my own. This website sets no cookies itself and stores no data in your browser's local storage. The reach measurement in section 5 also works without cookies. Cookies may only be set inside content you actively load or open: by GitHub in the comment section (section 6), and by Dodo Payments on their own checkout page, which opens in a new tab (section 7).
• No user accounts and no newsletter.
• The store is the one place where a real transaction happens. If you buy software here, you enter your payment and billing details on a checkout page operated by Dodo Payments, not by me, which opens in a new tab. Section 7 explains what that means and what I get to see.
• All fonts are hosted on this server. No connection is made to Google Fonts or any comparable service.
• Three third parties are nevertheless involved: my hosting provider (Cloudflare), the comment system on blog posts (giscus / GitHub), and the payment provider in the store (Dodo Payments). All three are described below.

Legal bases used

Where personal data is processed, this happens on one of the following legal bases:

• Art. 6 (1) (a) GDPR — consent: where you have explicitly agreed to a processing operation.
• Art. 6 (1) (b) GDPR — contract or pre-contractual steps: where processing is necessary to respond to your inquiry, or to handle a purchase in the store and deliver the software to you.
• Art. 6 (1) (f) GDPR — legitimate interests: my interest in providing this website in a technically secure, functional and stable form.

Providing personal data is neither legally nor contractually required. You can read this website without providing any data beyond what is technically necessary to deliver the pages to you.

3. Your rights

In relation to the personal data concerning you, you have the following rights:

• Right of access (Art. 15 GDPR) — to obtain confirmation as to whether data concerning you is processed, and a copy of that data.
• Right to rectification (Art. 16 GDPR) — to have inaccurate data corrected.
• Right to erasure (Art. 17 GDPR) — to have your data deleted.
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR) — to receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR) — see the separate notice below.
• Right to withdraw consent (Art. 7 (3) GDPR) — where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal is not affected.

To exercise any of these rights, an informal message to the contact details in section 1 is sufficient.

Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

The supervisory authority responsible for me, as I am based in Baden-Württemberg, is:

4. Hosting and server log files

This website is hosted on Cloudflare Pages, a service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare"). Cloudflare also acts as a content delivery network, meaning that the pages are delivered to you from a server geographically close to you.

When you access this website, your browser necessarily transmits technical data to Cloudflare's servers, which is processed in server log files. This typically includes:

• your IP address
• the date and time of the request
• the page or file requested
• the HTTP status code and amount of data transferred
• the referring URL, if any
• your browser type, version and operating system

This data is processed on the basis of Art. 6 (1) (f) GDPR. My legitimate interest lies in delivering this website reliably, protecting it against attacks and abuse, and ensuring its technical stability. This data is not merged with other data sources, and I do not use it to identify individual visitors.

Cloudflare additionally processes this data to provide security functions such as protection against denial-of-service attacks. Details are set out in Cloudflare's own privacy policy at cloudflare.com/privacypolicy.

A data processing agreement pursuant to Art. 28 GDPR exists with Cloudflare: Cloudflare's Customer Data Processing Addendum is incorporated by reference into the subscription agreement under which this website is hosted.

Encryption

This website uses TLS encryption (recognizable by the https:// prefix and the padlock icon in your browser) to protect the transmission of content between your browser and the server.

5. Reach measurement (Cloudflare Web Analytics)

This website uses Cloudflare Web Analytics, a reach measurement service provided by Cloudflare, Inc. (address as above). I use it to understand which articles are read and whether the website loads quickly enough.

How it is embedded

Cloudflare inserts the measurement script automatically into the delivered pages of the production website. The script (beacon.min.js) is retrieved from static.cloudflareinsights.com, and the measurement data is transmitted to Cloudflare. As the insertion takes place on Cloudflare's servers while the page is being delivered, the script is not part of this website's source code.

What is recorded

According to Cloudflare, each page view records:

• the address of the page called up, without any query parameters
• the referring page, if any
• browser type and version and the operating system, derived from the user agent
• the country, derived from your IP address
• the HTTP status code of the response
• loading and performance measurements provided by your browser's performance interface (for example how long the page took to become visible and usable)
• a randomly generated identifier that is valid only for this single page view and is not stored afterwards

What is not done

According to Cloudflare, this service sets no cookies, stores nothing on your device, and uses no fingerprinting. Your IP address is evaluated only transiently in order to determine the country and is not stored. Cloudflare states that it does not track individual users across the websites of its customers, and the data is not used to build a profile of you. I myself see only aggregated statistics and cannot identify individual visitors.

Legal basis and your options

The processing takes place on the basis of Art. 6 (1) (f) GDPR. My legitimate interest lies in a needs-based design and the technical optimization of this website, measured in a way that avoids cookies and personal profiles. You may object to this processing at any time under Art. 21 GDPR, using the contact details in section 1.

Because the script is inserted by Cloudflare during delivery, it cannot be deselected within this website. You can prevent it from being executed by using a content blocker in your browser or by disabling JavaScript. Further information can be found in Cloudflare's privacy policy and in the Cloudflare Web Analytics documentation.

6. Comments on blog posts (giscus)

Blog posts on this website offer a comment section provided by giscus, an open-source comment system. giscus does not run its own database: comments are stored as discussions in the public GitHub repository of this website. The services involved are therefore giscus (operated by its maintainers via giscus.app) and GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA, a subsidiary of Microsoft Corporation.

What happens, and when

Nothing is loaded from giscus or GitHub until you ask for it. Below each blog post you will find a notice with a "Load comments" button. As long as you do not click it, no connection to giscus.app or to GitHub is established and no data is transmitted to those providers.

Only when you click the button is the comment section loaded and embedded as an iframe served by giscus and GitHub. From that moment on, your IP address, your browser data and the address of the page you are viewing are transmitted to those providers. If you are logged in to GitHub in the same browser, GitHub can associate the retrieval with your GitHub account. Cookies and comparable technologies may be set by GitHub within that iframe; these originate from GitHub, not from me, and I have no access to them.

Your decision applies to the page you are currently viewing and is not stored. If you open another blog post, or reload the page, the comments will again only be loaded once you click.

Posting a comment

Writing a comment requires a GitHub account and your authorization of the giscus application. The comment, your GitHub username and your avatar then become publicly visible in the associated GitHub discussion and on this website. Please bear in mind that comments are public and can be read and indexed by anyone.

Comments are stored by GitHub for as long as the discussion exists. You can edit or delete your own comments at any time via the GitHub discussion, or ask me to remove them.

Legal basis

By clicking the "Load comments" button you consent to the described transmission of data to giscus and GitHub, and to the storage of and access to information on your device by GitHub within the embedded comment section. The legal basis is therefore your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

You may withdraw your consent at any time with effect for the future, simply by reloading or leaving the page: as your decision is not stored, the comment section will not be loaded again unless you click the button once more. The lawfulness of the processing carried out up to the withdrawal is not affected.

Further information can be found in the giscus privacy policy and in GitHub's privacy statement.

7. Store and payments (Dodo Payments)

The store on this website sells software as a download. I do not process payments myself. Payments are handled by Dodo Payments, which acts as the merchant of record: it sells the software to you in its own name as my reseller, collects the money and handles invoicing and sales tax. According to its own terms, the provider operates through the group companies Dodo Payments Inc, Dodope Payments Limited and Sarvapanchhi Technologies Private Limited.

What happens, and when

This website loads nothing at all from Dodo Payments. There is no payment frame, no script and no other content of theirs embedded in these pages. The product page shows only a notice and a buy button, both served from this website.

Pressing the buy button opens Dodo Payments' own checkout page in a new browser tab. From that point you are on their website rather than mine: your IP address and browser data reach them because you are visiting them, and any cookies or comparable technologies are set there, under their responsibility. I have no access to them. Closing that tab ends the matter; this page is unaffected.

Everything you then enter in order to buy — your name, your email address, your billing address and country, and your payment details — is entered on their page and goes directly to Dodo Payments and its payment partners. I never see or receive your card, bank or other payment details.

What I receive

After a completed purchase, Dodo Payments reports the transaction to me. What I see is the information I need to deliver the software, answer questions about an order and honor the money-back guarantee: your name, your email address, your country, the product purchased, the amount and the order or transaction number. This data is stored for as long as it is needed for that purpose and for as long as statutory retention obligations under commercial and tax law require.

Who is responsible for what

Because Dodo Payments sells to you in its own name, it is not my processor: it decides on the purposes and means of processing your payment data itself and is a controller in its own right for that processing, within the meaning of Art. 4 (7) GDPR. For questions about that processing, and to exercise your rights in respect of it, please refer to the privacy policy of Dodo Payments. I am the controller for the part described under "What I receive" above.

Legal basis

Because nothing of theirs is embedded here, this website transmits no data to Dodo Payments, and there is no storage of or access to information on your device by a third party for which I would have to obtain your consent (§ 25 (1) TDDDG). You reach them by following a link, as you would any other website, and what happens from there is governed by their privacy policy.

The subsequent processing of your order data is based on Art. 6 (1) (b) GDPR, since it is necessary for the performance of the contract and for delivering the software to you, and on Art. 6 (1) (c) GDPR in so far as commercial and tax law obliges me to retain records.

8. Contacting me

If you contact me by email or telephone, the details you provide — including your name, your email address or telephone number, and the content of your message — are processed for the purpose of handling your inquiry and any follow-up questions.

The legal basis is Art. 6 (1) (b) GDPR where your inquiry relates to a contract or pre-contractual measures, and otherwise Art. 6 (1) (f) GDPR, based on my legitimate interest in responding to inquiries addressed to me.

Please note that email is not an encrypted means of transmission unless you and I both use end-to-end encryption. I delete inquiries once they have been dealt with and no statutory retention obligations apply.

9. Fonts and other assets

All fonts used on this website, as well as all images, stylesheets, scripts and mathematical typesetting resources that form part of this website, are stored on this website's own server and delivered together with the page. No connection is established to Google Fonts, Adobe Fonts or a comparable third-party font service, and no data is transmitted to such providers.

The only content loaded from an external address is the reach measurement described in section 5 and the comment function described in section 6. Nothing is loaded from Dodo Payments into these pages either: pressing the buy button in the store merely opens their checkout in a new tab, as described in section 7. Apart from these, no content is retrieved from third parties when you visit this website.

10. Transfers to third countries

The providers named above are based in, or process data in, countries outside the European Economic Area whose level of data protection is not identical to that of the EU. In particular, it cannot be ruled out that authorities in those countries may access such data. This concerns Cloudflare (including its reach measurement) and giscus/GitHub in the United States of America, and Dodo Payments, whose group companies process data outside the EEA, including in India.

These transfers are safeguarded as follows. Both Cloudflare, Inc. and GitHub, Inc. have self-certified to the U.S. Department of Commerce that they adhere to the principles of the EU-U.S. Data Privacy Framework. GitHub, Inc. holds its own certification, separate from that of its parent company Microsoft Corporation. For transfers to companies certified in this way, the European Commission has determined by its adequacy decision of 10 July 2023 that an adequate level of protection is ensured (Art. 45 GDPR), so that no further transfer instrument is required.

Should such a certification lapse or be invalidated, both providers additionally rely on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) pursuant to Art. 46 (2) (c) GDPR.

Dodo Payments is not certified under the EU-U.S. Data Privacy Framework. According to its privacy policy, it transfers personal data from the EEA to recipients in countries without an adequacy decision on the basis of the Standard Contractual Clauses (Art. 46 (2) (c) GDPR), and it will provide a copy of those clauses on request to its privacy team. Since Dodo Payments is a separate controller for the checkout (see section 7), that transfer takes place under its own responsibility, and only once you open their checkout yourself. If you would rather not have your data transferred in this way, simply do not open it — the rest of this website works without it.

You can check the current certification status at any time in the official list at dataprivacyframework.gov.

11. Changes to this policy

I will update this privacy policy whenever changes to this website or to the legal situation make that necessary — for example when a service is added or removed. The version published here at the time of your visit always applies.

Last updated: September 8, 2026