Privacy

This is a personal site with no accounts, no sign-up, no newsletter and no comments. There is nothing to log in to and nothing to submit. What follows is the complete list of what happens to data when you read it.

The short version

This site sets no cookies and stores nothing on your device. Not a cookie, not a localStorage entry, not a session-storage entry. That is why there is no consent banner: German law requires consent for storing information on, or reading information from, your device, and this site does neither.

It does still count page views, and counting involves your IP address reaching a server. That is data protection law rather than cookie law, so it needs no banner but it does need this page. The rest of it explains that.

The site also loads no third-party fonts, images or scripts. The text you are reading is set in fonts already on your own computer.

Who is responsible

André Aigner
Johannisweg 3
84030 Ergolding, Deutschland
andreaigner@icloud.com

I run this site as a private individual. ARSoftware UG, the company I founded, is written about here but does not operate this site and is not the controller for it. Postal details are repeated on the Impressum.

Hosting

The site is hosted by Vercel Inc. Serving a page necessarily means your browser sends a request, and that request carries your IP address, the page you asked for, your browser’s user-agent string and, if you followed a link, the page you came from. Vercel processes that to deliver the page and to keep the service running and secure.

The legal basis is Art. 6(1)(f) GDPR, my legitimate interest in operating a working and reasonably secure website. Vercel acts as a processor under a data processing agreement. Because Vercel Inc. is a Delaware corporation, this data may be transferred to the United States. That transfer is covered by the European Commission’s Standard Contractual Clauses, Module Two (controller to processor), under Commission Decision 2021/914, which Vercel’s data processing agreement incorporates. It does not rely on the EU-US Data Privacy Framework.

Counting page views

I use Vercel Web Analytics, which tells me how many people opened which article. I would genuinely like to know whether anyone reads this; that is the whole purpose, and it is the only purpose.

According to Vercel, it works without cookies: instead of tagging your browser, it derives a short-lived hash from the request itself, which lets it count a visitor twice in one day without keeping anything that identifies you afterwards. I have checked the part I can check, which is your side: loading this site produces no cookie and no stored data, and the script that does the counting is served from this domain rather than from anybody else’s. What Vercel does on its own servers is Vercel’s description, not my measurement.

What is recorded per page view, per Vercel’s own documentation: a timestamp, the URL and its route pattern, the referrer, filtered query parameters, an approximate location down to city level, your device type, and your browser and operating system with their versions. The hash that lets two views in one day count as one visitor is discarded after 24 hours.

What I see is the aggregate of that. I cannot see individuals, cannot follow one person between pages or across days, and there is no profile of you anywhere in this.

Legal basis: Art. 6(1)(f) GDPR. My interest is knowing whether the writing is read; the intrusion is a page count without a cookie.

This site runs on Vercel’s free tier, where the reporting window is one month: after that the figures are no longer visible to me. That is a promise about how long I can read the data, not about when Vercel erases it. Vercel says it may hold data beyond the window so that a plan can be upgraded without losing history, so the accurate statement is that the aggregate figures stay readable to me for one month and may persist longer on Vercel’s side. Nothing in them identifies you either way.

You can object to this processing at any time under Art. 21 GDPR, by email, and I will act on it.

If you email me

Mail sent to the address above is processed to answer it, on the basis of Art. 6(1)(f) GDPR, or Art. 6(1)(b) where the message is about a contract. I keep correspondence for as long as the matter is live and as long as commercial or tax law requires, and then delete it. The mailbox is an iCloud mailbox, so it is hosted by Apple.

Links off this site

Some pages link to GitHub, LinkedIn, the App Store and a few other sites. Those are ordinary links: nothing is loaded from them until you click, and once you do, you are on their page under their privacy policy, not mine.

Your rights

You have the right to access the data concerning you (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interest (Art. 21). Email the address above and you do not need to explain why.

Worth saying plainly: for the page counting there is almost certainly nothing to access, because nothing stored identifies you. An objection I can act on; a subject access request would mostly return “there is no record of you”.

Complaints

You can complain to a data protection authority. The competent one for me is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also complain to the authority where you live.

What this site does not do

No advertising, no ad networks, no tracking pixels, no cross-site tracking, no profiling and no automated decision-making within the meaning of Art. 22 GDPR. Nothing here is sold or shared with anyone for their own purposes.

Changes

If what the site does changes, this page changes with it, and the date at the top moves. There is no version history; the current text is the current practice.