guteszeug

Privacy Policy

How this site handles your data. In short: as little as possible.

Controller

Marc Wustrack
Gerhart-Hauptmann-Str. 18a
49163 Bohmte
Germany
Email: mail@smol-apps.de

Principle

guteszeug.me is a personal recommendation blog. There are no user accounts, no comments, no newsletter and no personal tracking or profiling. Personal data is only processed to the extent technically necessary when a website is accessed, for privacy-friendly traffic measurement and technical error analysis, or when you send me a message through the contact form.

Contact requests and email delivery (Resend)

If you use the contact form, I process your email address and message text to handle your contact request and, if appropriate, reply to you. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in responding to your request).

For delivery of contact requests I use Resend, a service of Plus Five Five, Inc., USA. The data entered in the form is transmitted to Resend so the email can be delivered to me. I do not run a separate database for contact requests. Emails remain in my mailbox as long as they are useful for handling or documenting the request, and are deleted afterwards. For transfers to the USA, Resend relies on the EU-US Data Privacy Framework and its data processing agreement.

Security check (Cloudflare Turnstile)

To protect the contact form from automated submissions, this site uses Cloudflare Turnstile by Cloudflare, Inc., USA. Turnstile checks whether a request likely comes from a human. When the contact form loads and when the security check runs, technically necessary data may be transmitted to Cloudflare, for example IP address, browser and device information, and the generated verification token. During server-side verification, I do not additionally send the IP address to Cloudflare.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in spam and abuse protection) and § 25 (2) TDDDG where the security check is technically necessary for operating the contact form. For transfers to the USA, Cloudflare relies on the EU-US Data Privacy Framework and standard contractual clauses.

Hosting (Vercel)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access the site, Vercel, acting as a processor, handles technically necessary access data in server log files:

  • shortened or full IP address
  • date and time of access
  • requested URL and amount of data transferred
  • referrer URL and browser/operating system used

This processing serves the delivery of content, the security and stability of the service, and statistical purposes. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure and functional service). For transfers to the USA, Vercel relies on the EU-US Data Privacy Framework and standard contractual clauses. Log files are deleted or anonymized after a maximum of 30 days.

Vercel Web Analytics

This website uses Vercel Web Analytics to evaluate anonymous, aggregated page views. It records automatic page views, including regular page loads and client-side page transitions. Custom events are not used on this site.

Vercel Web Analytics sets no tracking or marketing cookies, creates no user profiles and does not combine your data across different websites. According to Vercel, data points are anonymous and are not tied to an individual person or IP address. Visitors are identified without third-party cookies by a hash created from the incoming request; this visitor session is discarded after 24 hours.

According to Vercel, the following information may be stored with each data point:

  • event timestamp
  • requested URL
  • dynamic path
  • referrer
  • filtered query parameters
  • geolocation, for example country, region and city
  • operating system and version
  • browser and version
  • device type, for example desktop, tablet or mobile
  • Web Analytics script version

The data is used only for aggregated statistics. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in privacy-friendly traffic measurement and improving the service).

PostHog Analytics

This website also uses PostHog (PostHog, Inc., USA) via the EU endpoint https://eu.i.posthog.com to understand site usage in a privacy-friendly way and detect technical errors. PostHog is configured with cookieless_mode: "always". As a result, PostHog does not store PostHog cookies on this site and does not use local storage or session storage. Where possible, visitors are recognized using a privacy-preserving hash calculated on PostHog's servers. I do not call the identify() function and do not create user profiles with email addresses, names or similar identifiers.

Captured data mainly includes page views and individual events such as viewed articles, clicks on external article links or RSS links, language switches, selected article categories, search terms in the article search, successful contact form submissions without message content, and technical error data such as error message, stack trace, URL, browser and device information. Contact form contents, email addresses and message texts are not transmitted as PostHog event properties.

The data is used for aggregated analysis, content improvement and troubleshooting. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in privacy-friendly traffic measurement, improving the service and fixing errors). Processing is carried out on the basis of a data processing agreement. Where data is transferred to the USA, PostHog states that it relies on the EU-US Data Privacy Framework and standard contractual clauses.

Cookies

This site sets no tracking or marketing cookies. PostHog is configured cookieless and stores no PostHog data in cookies, local storage or session storage. Only one technically necessary cookie may be set to store your chosen language (German/English):

  • gz_lang: stores the preferred language. Purely functional, not shared with third parties. Legal basis: § 25 (2) TDDDG (strictly necessary).

Fonts

The fonts used (Bricolage Grotesque, Hanken Grotesk) are served locally from this server. No connection is made to Google Fonts or other external font servers, and no data is transferred to third parties in the process.

This site contains links to external websites and occasional affiliate links. When you click an external link, you leave this website; the operator of the target site is responsible for any data processing there. Affiliate links may contain an identifier from the respective partner program; the privacy policy of the linked provider is decisive.

Your rights

Under the GDPR you have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). Please contact the address above to exercise these rights.

You also have the right to lodge a complaint with a data protection supervisory authority.

Changes

I will update this privacy policy when something about the site or the legal situation changes. The version published here at any given time applies.