← felixgollnhuber.dev

Privacy Policy

This policy explains which data is processed when you use this website and which browser analytics processing takes place only after your consent.

controller

principle

DataFast browser analytics is disabled by default. Unless you actively allow browser analytics, the DataFast browser script is not loaded and no analytics cookies are set. Separate server-side bot traffic tracking processes requests that match known crawler user agents, as described below. This website uses no advertising networks or social media plugins. No automated decision-making takes place.

server log files

When you visit this website, the hosting provider, netcup GmbH, Karlsruhe, Germany, automatically processes data that your browser transmits:

• IP address of the requesting device
• date and time of access
• name and URL of the requested file
• amount of data transferred and status of the request
• browser type, browser version and operating system
• referrer URL, if transmitted

Purpose: technical delivery, stability and security of the website. Legal basis: Art 6 (1)(f) GDPR (legitimate interest in the secure and reliable operation of the website). This data is not merged with other data sources. Log data is retained by the hosting provider for a limited period in line with its log retention policy and then deleted automatically. A data processing agreement pursuant to Art 28 GDPR is in place with the hosting provider.

server-side DataFast bot traffic tracking

A Cloudflare Worker checks incoming requests locally for user agents associated with known AI assistants, search crawlers and model-training crawlers. When a request looks like crawler traffic, the Worker reports the event to DataFast. The purpose is to understand which public pages crawlers discover, index or expect to find and to improve the website accordingly.

The reported event can contain:

• the public DataFast website ID and requested hostname
• the requested public URL without query parameters
• the complete user-agent value
• the source IP address observed by Cloudflare
• the HTTP response status

Request bodies, cookies, authorization values and other request headers are not sent to DataFast. The Worker does not set browser cookies and does not delay or fail the website response if DataFast is unavailable. DataFast classifies the crawler provider, category and IP verification confidence on its servers.

Legal basis is Art 6 (1)(f) GDPR, namely the legitimate interest in understanding and improving how automated systems discover the public website. This processing is separate from optional browser analytics and is not controlled by the browser analytics consent setting. The information about DataFast, international transfers, retention and data subject requests in the following section also applies to bot traffic events.

optional DataFast analytics

If you actively select allow analytics, this website loads DataFast, a web analytics service provided by JustShipIt Pte. Ltd., trading as DataFast, Singapore. DataFast acts as a processor for the website operator. The purpose is to understand visits, traffic sources, use of individual pages and outbound link activity so the website can be evaluated and improved.

Legal basis is your consent pursuant to Art 6 (1)(a) GDPR and § 165 (3) TKG 2021. DataFast is not loaded before consent. Refusing consent has no effect on your use of the website.

When analytics is enabled, the following data can be processed:

• IP address and user agent transmitted with the network request
• page URL, referrer and time of access
• pseudonymous visitor and session identifiers
• first visit time, session count and page activity
• browser language, time zone, viewport and screen dimensions
• browser, operating system, device type and approximate location derived by DataFast
• campaign parameters and advertising click identifiers contained in a visited URL
• destination and visible text of outbound links that you activate

This website does not use DataFast to identify you by name or email, does not send payment information and does not configure custom conversion or scroll events.

With consent, DataFast can set the following first-party analytics cookies:

• datafast_visitor_id: pseudonymous visitor identifier, up to 365 days
• datafast_visitor_first_seen_at: time of first visit, up to 365 days
• datafast_visitor_session_count: number of sessions, up to 365 days
• datafast_session_id: current session identifier, approximately 30 minutes

DataFast can also use sessionStorage entries beginning with datafast_ to keep page-view and session state within the current browser session. These values are cleared when analytics is disabled through the footer control.

DataFast is based in Singapore and states that most of its infrastructure is outside the European Union, including in the United States. Its published subprocessor list includes AWS, Vercel, Mapbox, OpenAI, MongoDB, Upstash, TinyBird and ClickHouse. DataFast states that applicable safeguards, including Standard Contractual Clauses where relevant, are used for international transfers. Details are available in the DataFast Data Processing Agreement and the DataFast Privacy Policy.

Analytics records are retained while the analytics purpose and the DataFast customer relationship continue, unless they are deleted earlier. When DataFast is no longer used, deletion of the associated analytics data will be requested. You can request earlier deletion using the contact details above.

You can withdraw consent at any time by selecting disable analytics in the footer. This removes the known DataFast cookies and stops DataFast from loading on subsequent page views. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

local storage in your browser

The start page assembles itself as an animation on your first visit. So that it is not replayed on every visit, and so that the analytics choice can be respected, the following technical values are stored locally in your browser:

• fg-built (localStorage): remembers that the animation has already been shown
• fg-replay (sessionStorage): remembers a replay you explicitly requested
• fg-analytics-consent (localStorage): stores granted or denied

These values do not contain a unique user identifier and are not transmitted to the server. They are required to provide the requested animation and to remember and enforce your analytics choice. You can delete them in your browser settings. If the analytics choice is deleted, the website asks again before loading DataFast.

contact by email

If you contact me by email, your email address and the contents of your message are processed for the purpose of handling your inquiry. The legal basis is Art 6 (1)(f) GDPR (legitimate interest in answering inquiries) or Art 6 (1)(b) GDPR if your inquiry is aimed at entering into a contract. The data is deleted once it is no longer required for this purpose and no statutory retention obligations apply.

links to external services

This website links to external services, including GitHub, LinkedIn, Twitter/X, npm and the websites of the projects presented here. Apart from consent-based DataFast analytics as described above, no scripts, buttons or tracking pixels of these linked providers are embedded. Data is transmitted to a linked provider once you actively open its link. From that point on, its privacy policy applies.

your rights

With regard to your personal data, you have the following rights:

• access (Art 15 GDPR)
• rectification (Art 16 GDPR)
• erasure (Art 17 GDPR)
• restriction of processing (Art 18 GDPR)
• data portability (Art 20 GDPR)
• objection to processing (Art 21 GDPR)
• withdrawal of consent at any time (Art 7 (3) GDPR)

To exercise these rights, a message to [email protected] is sufficient.

right to lodge a complaint

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority:

effective date

This privacy policy is effective as of 2026-08-28.