Legal
Privacy policy
Last updated: 2026-10-16
This privacy policy is available in English, German, Spanish, and French. All four language versions have the same content and are equally binding.
1. Responsible party
The party responsible for data processing on this site is Mario Kreitz, Mönchfeldstraße 7, 70378 Stuttgart, Germany (the same details as in the legal notice (Impressum)). You can reach us by email at info@kreitz-webdev.de. No data protection officer has been appointed, because neither Art. 37 GDPR nor § 38 BDSG (German Federal Data Protection Act) requires one for this site.
2. Overview
This site is built to respect your privacy. It loads no third-party or analytics scripts in your browser, runs no cross-site tracking, sets a cookie only if you object to analytics (section 5), and collects only the minimal data needed to operate the site and understand aggregate usage. The sections below explain exactly what is processed and why.
3. Server logs and hosting
The site is self-hosted on a virtual server rented from Contabo (Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany) and managed with Plesk. Contabo provides the server infrastructure and, in doing so, processes the data described in this section and in section 4 on our behalf as a processor (Art. 28 GDPR). When you visit, the web server processes standard access logs that may include your IP address, the date and time of the request, the requested URL, the referring page, and your browser's user-agent string. The application that serves the site also writes operational and error messages to its own container log, for example when a contact form notification cannot be sent. This data is used to operate and secure the site, for example to deliver pages, diagnose errors, and defend against abuse. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in a secure, functioning service). The web server's access logs are deleted as soon as they are no longer needed for these purposes. The container log is rotated automatically and limited to 3 files of 10 MB each; once that limit is reached, the oldest file is deleted.
4. Analytics
We count page views with Umami, an open-source analytics tool that we host ourselves on the same server as this site (see section 3), so no analytics data is passed to a third party. No analytics script runs in your browser, and nothing is written to your device for counting page views. The only thing read from your device in connection with analytics is the opt-out cookie described in section 5, and only to honour your objection. Instead, when your browser loads a page of this site directly (not when it prefetches one in the background), our web server forwards the following details of that request to our Umami server: your IP address, your browser's user-agent string, the first language tag of your browser's Accept-Language header (for example en-US), which is forwarded with each page view, the referring page (without its query string) and the path of the page you loaded together with the five UTM parameters of the page address (utm_source, utm_medium, utm_campaign, utm_term and utm_content, each shortened to 255 characters); all other query parameters, such as advertising click identifiers, and the fragment are discarded and not forwarded. Clicks, copied text and other interactions are not recorded. Your IP address and user-agent string themselves are not stored. The Umami server computes a pseudonymous session identifier by hashing the website ID, your IP address, your user-agent string, a value that changes every month and a secret key of the server. With each page view it stores that identifier, the time, the page path with any of those UTM parameters and the referring page, and for the session that language tag, your browser, operating system and device type (derived from the user-agent string), and your country, region and city, which it looks up from your IP address in a GeoLite2 database on the same server without contacting any other service. Because the session identifier is derived from your IP address, this is pseudonymous rather than anonymous processing of personal data. We only look at the results in aggregate and do not try to identify individual visitors. Because nothing is stored on your device for counting page views and the opt-out cookie is read only to honour your objection, no consent under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) is required for it. The legal basis for the processing is Art. 6(1)(f) GDPR (our legitimate interest in understanding how the site is used). The analytics records are stored in the Umami database on this server. If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, nothing is forwarded. You can also object with the button below: it sets the cookie described in section 5, and while your browser sends that cookie, nothing is forwarded either. An opt-out saved in your browser's local storage under this site's earlier analytics setup is no longer read; if you opted out that way, please opt out again here. You can read more about Umami in its documentation.
If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, your page views are not counted, whichever button you choose. The buttons work without JavaScript.
5. Cookies
This site sets a cookie only when you object to analytics with the button in section 4: the cookie verbatra_analytics_optout with the value 1, valid for one year, which only stores your objection so that our server stops forwarding your page views. It is set only at your request and is strictly necessary for that purpose, so it needs no consent (§ 25(2) no. 2 TDDDG). Allowing analytics again deletes it. No other cookies are set. Two choices you make are saved in your browser's storage. When you switch between the light and dark theme, your choice is saved in local storage under the key theme. When you pick a package manager (npm, pnpm, yarn or bun) on the tabs above an install command, your choice is saved under the key package-manager in both local storage and session storage, so that the other install commands show the same package manager. Neither entry is written before you make that choice; both stay in your browser, are never sent to our server or anyone else, and you can delete them at any time by clearing this site's data in your browser. Because nothing requiring consent is stored on your device, no cookie consent banner is required.
6. Fonts and assets
Fonts and images, including the contributor avatars on the home page, are self-hosted: they are served from this site's own server, so loading a page makes no request to Google Fonts, GitHub, or any other third party. The site embeds no status badges. No third-party scripts, images, or embeds load at runtime, and no analytics script runs in your browser. External sites such as GitHub or npm are only contacted when you follow a link to them.
7. GitHub and npm
The project's source code, issues, and discussions are hosted on GitHub, and its published packages are hosted on npm. If you choose to interact on either site (for example, by opening an issue, joining a discussion, or viewing a package), that provider processes your data as an independent controller: GitHub's privacy statement or npm's privacy policy applies.
8. Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction of processing, objection, and data portability (Art. 15–21 GDPR); the right to object is set out separately in section 9. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is "Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg" (the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de. To exercise any of these rights, contact us using the details below.
9. Right to object (Art. 21 GDPR)
Where we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), as described in sections 3, 4, and 12, you have the right to object to that processing at any time, on grounds relating to your particular situation. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims. An informal message to info@kreitz-webdev.de is enough to object.
10. Contact
For any privacy-related questions or requests, email info@kreitz-webdev.de.
11. Changes to this policy
We may update this privacy policy as the site evolves or as legal requirements change. The date below reflects the most recent revision.
12. Contact form
When you use the contact form, we process the name, email address, and message you submit in order to respond to your inquiry. The notification email is sent directly through our own mail server, hosted in Germany; no third-party email provider is involved in delivering it, and delivering it involves no transfer of data outside the EU. Besides the hosting provider (see section 3), the only processor involved under Art. 28 GDPR is Arcjet (Arcjet Labs, Inc., San Francisco, USA), which processes the request's IP address and headers (not the message content) through its Cloud API to protect the form against bots and abuse. According to Arcjet's privacy documentation, Arcjet retains this request data for 30 days and retains aggregated data derived from it for longer. Arcjet is based in the United States and does not guarantee that requests are processed in the EU, so this data may be transferred to the United States, a third country (Art. 44 ff. GDPR). Arcjet is not certified under the EU-U.S. Data Privacy Framework, so the European Commission's adequacy decision for that framework does not cover this transfer; it is instead based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards by emailing info@kreitz-webdev.de. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in operating the form securely and responding to inquiries). Your submission and the resulting notification email are not stored anywhere beyond the operator's inbox. They are deleted once your inquiry has been fully handled.
13. AI-assisted translation
This project, verbatra, is an AI-assisted translation tool, and this documentation site uses it on itself. English is the source language. The interface text (navigation, buttons, and similar strings) is machine-translated into German, Spanish, and French by verbatra with Google's Gemini language model. The documentation pages are translated with AI as well, in a separate step outside that automated pipeline. Some texts, including parts of these legal pages, were written or corrected directly instead of being generated by that pipeline. Translations are checked on a best-effort basis: not every translated text is reviewed by a person before it is published, so a translation may contain errors. If you notice one, please tell us through the contact form. We provide this information voluntarily, for transparency.
Last updated: 2026-10-16