PRIVACY

▶ IN SHORT

Nothing on this site tracks you without your consent. Visiting it produces the usual server logs at the hosting provider. If you write to me through the form, I receive your message by email. Google Analytics is only loaded once you agree in the cookie banner — and can be switched off again at any time.

▶ CONTROLLER

Controller within the meaning of the General Data Protection Regulation (GDPR). No data protection officer has been appointed, as there is no legal obligation to do so.

▶ HOSTING AND SERVER LOGS

This site is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. On every request Vercel processes technically necessary data: IP address, date and time, requested address, amount of data transferred, referrer, browser and operating system.

The legal basis is Art. 6 (1) (f) GDPR. My legitimate interest is delivering the site securely and reliably. A data processing agreement is in place with Vercel. Data may be transferred to the US; this is safeguarded by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

▶ CONTACT FORM AND EMAIL

If you write to me through the form, I process your name, your email address and your message in order to reply. The legal basis is Art. 6 (1) (f) GDPR (answering your enquiry), or (b) where a contract is concerned.

The message is delivered via the email service Resend (Resend, Inc., San Francisco, USA) to my mailbox at Proton Mail (Proton AG, Geneva, Switzerland). For the US, the EU-US Data Privacy Framework or standard contractual clauses apply; for Switzerland, an adequacy decision by the European Commission.

To prevent abuse, your IP address is held in the server's memory for at most ten minutes in order to limit the number of requests. It is not stored. I delete your message once the matter is settled and no retention obligation applies.

▶ COOKIES AND LOCAL STORAGE

Technically necessary and permitted without consent under Section 25 (2) no. 2 TDDDG:

• NEXT_LOCALE — a cookie that remembers your chosen language when you switch it.
• crondung-consent — an entry in your browser's local storage that records your decision in the cookie banner. It stays until you delete it or change your decision.

▶ GOOGLE ANALYTICS

Only with your consent do I use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you agree, no script is loaded from Google and no analytics cookie is set.

Once you agree, Google Analytics records which pages are viewed, for how long and where you came from, along with approximate location (country, region), device, browser and language. I also count a few interactions: submitting the contact form (without its content), opening Spriteworks and switching language. Google sets the cookies _ga and _ga_<ID> for this, with a lifetime of up to two years. Google Analytics 4 does not store your IP address.

Advertising features are switched off: Google Signals is disabled and the consent signals for advertising are permanently set to "denied". Google deletes the data after two months.

The legal basis is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. A data processing agreement is in place with Google. Data may be transferred to Google LLC in the US; Google is certified under the EU-US Data Privacy Framework.

You can withdraw your consent at any time with effect for the future via "Cookie settings" in the footer. The analytics cookies are deleted when you do.

▶ SPRITEWORKS

Images you load into Spriteworks are processed entirely in your browser. They never leave your device and are not uploaded anywhere.

▶ FONTS AND EXTERNAL LINKS

Fonts are served from this site's own server; there is no connection to Google Fonts. Links to GitHub and LinkedIn are ordinary links — data only flows once you click them, and the respective provider's privacy policy then applies.

▶ YOUR RIGHTS

You have the following rights towards me regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

▶ RIGHT TO COMPLAIN

An informal email to the address above is enough to exercise your rights. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Germany.