Skip to content

Privacy Policy

Controller

Oliver Eilhard
Alt F4
Irmgardstraße 41
81479 München
Email: hello@alt-f4.de

Overview

This website uses no advertising services and no third-party tracking. Fonts are self-hosted. We do use our own analytics, which we host ourselves and which works without cookies — see ‘Web analytics’ below. The processing described below is limited to delivering the website, measuring its use in aggregate, remembering a display preference on your device, and handling communications that you initiate.

Hosting

This website runs on a server provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. To establish the connection and deliver the website, the server and Hetzner's infrastructure process technical request data. Depending on what your browser transmits, this can include:

  • IP address
  • Date and time of the request
  • Requested URL and HTTP method
  • Referrer URL
  • User agent, including browser type and operating system

We do not keep access logs for this website. Operational system logs can be created when errors or security events occur. They are retained according to the system's size-based rotation limits and deleted when those limits are reached.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable delivery of this website. Hetzner receives technical connection data as our hosting provider.

Cookies and local storage

This website does not use analytics, marketing, or language-preference cookies. Our analytics works without cookies entirely; see ‘Web analytics’. The selected language is taken from the URL.

When you choose light or dark mode, the value is stored under the key ‘theme’ in your browser's local storage. It remains there until you change the preference or delete the browser storage. The value is not transmitted to us.

This storage is required to provide the display setting you explicitly request. Consent is therefore not required under section 25(2) no. 2 TDDDG.

Web analytics

To understand which pages are read and how people find them, we use Umami — an open-source analytics tool that we host ourselves, on the same server in Germany that delivers this website. The analytics data is never sent to a third party and never leaves our infrastructure. It is not used for advertising and is not combined with data from other websites.

When you open a page, the following is recorded:

  • the address and title of the page you opened
  • the page or search engine that referred you, if any
  • browser, operating system and device type
  • screen size and browser language
  • an approximate location (country, region, city) derived from your IP address

The analytics script sets no cookies and stores nothing on your device. It reads a single value from your browser’s local storage: ‘umami.disabled’.

Your IP address is transmitted to our server, where it is used to derive the approximate location above and a pseudonymous visitor identifier. It is not stored: the analytics database has no field for it.

That identifier is calculated from your IP address, your browser, and a value that we change periodically. Because that value changes, the identifier cannot be reversed back into your IP address and cannot be used to recognise you over the long term.

Analytics records are deleted automatically 12 months after they are collected. We keep them that long so that we can compare a period with the same period a year earlier, and no longer. Deletion is permanent — a deleted period disappears from our own reports as well. Our backups, which exist only to restore the site after a failure, still hold a copy until they are overwritten, within three weeks at the latest.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is understanding how this website is used so that we can improve it. We consider this proportionate: the data is aggregated, self-hosted, never shared, involves no cookies and no lasting identifier, and is not used to build profiles or to follow you across other websites.

You can object to this processing at any time — see ‘Your rights’ below. Note that the script is served from this website’s own domain, so content blockers that work from third-party blocklists will not necessarily prevent the collection.

Contact by email

If you contact us by email, we process the information you provide, such as your email address, name, message, and technical email metadata, to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR when the communication concerns a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is responding to your inquiry.

We use Google Workspace for email. Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland, and Google's subprocessors process messages and metadata to provide the service. Processing can take place outside the European Economic Area. Google describes the safeguards used for international transfers, including adequacy decisions and standard contractual clauses, in its GDPR information. Google Cloud GDPR information.

We delete correspondence when it is no longer required to handle the inquiry. We retain it longer where statutory retention duties apply or where it is needed to establish, exercise, or defend legal claims.

Providing this information is voluntary. Without a return address and enough information about your inquiry, we may not be able to respond. We do not use automated decision-making or profiling.

Contact form

If you use the contact form on this website, we process the information you enter — your name, your email address, and your message, and, when you send the form from a project page, the project it concerns — together with the selected language and the time of submission, in order to handle your request. To limit automated submissions, a hashed form of your IP address is retained for at most ten minutes; the raw address is never stored and is never linked to your message.

The legal basis is Art. 6(1)(b) GDPR; we process the data to respond to your request as a pre-contractual measure taken at your request. Providing this information is voluntary; without a valid return address we cannot respond.

Submissions are stored in a database operated for us by Neon Inc. (data stored in the EU, AWS region eu-central-1) and forwarded to us by email via Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France. Both act as our processors under Art. 28 GDPR. Brevo describes its data protection practices in its privacy documentation: Brevo privacy policy.

We delete submissions when they are no longer required to handle your request, unless statutory retention duties apply. You can request erasure at any time at hello@alt-f4.de.

Your rights under the GDPR

Subject to the applicable legal requirements, you have the following rights regarding your personal data:

  • Access (Art. 15 GDPR) — request information about the data we process
  • Rectification (Art. 16 GDPR) — request correction of inaccurate data
  • Erasure (Art. 17 GDPR) — request deletion of your data
  • Restriction (Art. 18 GDPR) — request restriction of processing
  • Data portability (Art. 20 GDPR) — receive data provided by you where processing is automated and based on consent or a contract
  • Objection (Art. 21 GDPR) — object, on grounds relating to your particular situation, to processing based on legitimate interests

To exercise any of these rights, contact us at hello@alt-f4.de.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority under Art. 77 GDPR, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.

The supervisory authority responsible for private organizations in Bavaria is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. Submit a complaint to the BayLDA.