Privacy Policy
Last updated: 2026-10-14
1. Who is responsible
Han Yu, Krankenhausstraße 8, 93449 Waldmünchen, Germany.
Contact for all privacy questions: the contact form (choose "Privacy / data request") or a letter to the address above.
2. What we process and why
- Server logs (IP address, browser, time, requested page): processed by our hosting provider Vercel to deliver the site and stop abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Visit statistics (page, referring site, country/city, device type, clicks on links and buttons): our own statistics (SiteHub), without cookies. Visitors are counted with a hash of IP address and browser that is salted with a random value that changes daily and is deleted after two days, so visits can't be linked across days; IP addresses are not stored. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- First-visit source (cookie
st_ft, only if you click "Accept all"): remembers which site or search brought you here first. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). - Google Analytics (only if you click "Accept all"): pages viewed, referring site, device and browser, approximate location, linked by a random ID stored in the
_gacookies. Google may process this data in the USA. Without your consent the Google Analytics script is not loaded at all. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). - Sign-in (name, e-mail address and profile picture from Google or GitHub, only if you sign in): used to show that you are signed in and to unlock member content. We don't keep a user database – this information is stored in an encrypted session cookie in your browser. Your profile picture is loaded from Google or GitHub. Legal basis: contract (Art. 6(1)(b) GDPR).
- Service worker (
/sw.js): registered only so the site can be installed as an app. It stores no content and no personal data. - Skill submissions (the details you enter on Submit Skill, including the author name, if any): stored as an issue in our private GitHub repository so we can review the skill. Legal basis: Art. 6(1)(b) GDPR.
- Messages via the contact form (your e-mail address, optional name, your message): stored as an issue in our private GitHub repository and used only to answer you. Legal basis: Art. 6(1)(b) or (f) GDPR.
3. Service providers
- Vercel Inc. (USA) – Hosting and delivery of this website; processes server logs. Transfer safeguard: EU–US Data Privacy Framework / Standard Contractual Clauses.
- Cloudflare, Inc. (USA) – Runs our own visit statistics (SiteHub). Transfer safeguard: EU–US Data Privacy Framework / Standard Contractual Clauses.
- Google LLC / Google Ireland Ltd. – Sign in with Google (only if you choose it); Google Analytics (only after "Accept all"). Transfer safeguard: EU–US Data Privacy Framework.
- GitHub, Inc. (USA) – Sign in with GitHub (only if you choose it); stores skill submissions and contact-form messages as issues in our private repository. Transfer safeguard: EU–US Data Privacy Framework / Standard Contractual Clauses.
We don't sell your data. We don't show advertising yet; section 5 explains what changes when we do.
4. Cookies
| Name | Category | Purpose | Duration |
|---|---|---|---|
st_consent | Necessary | Remembers your cookie choice | 180 days |
__Secure-authjs.session-token | Necessary | Keeps you signed in (encrypted; only after you sign in) | 30 days after your last visit, or until you sign out |
__Host-authjs.csrf-token | Necessary | Protects the sign-in against cross-site request forgery | Until you close the browser |
__Secure-authjs.callback-url | Necessary | Returns you to the page you came from after signing in | Until you close the browser |
__Secure-authjs.pkce.code_verifier, __Secure-authjs.state | Necessary | Secure the Google / GitHub sign-in while it is in progress | 15 minutes |
st_ft | Statistics – only with your consent | Remembers which site or search first brought you here | 180 days |
_ga, _ga_J56JCF02B1 | Statistics – only with your consent | Google Analytics: tells visits apart with a random ID | 2 years |
The sign-in cookies may be set on your first visit because the page checks whether you are signed in. If you change the colour theme under Settings, your choice is saved in your browser's local storage (theme) and never sent to us. You can change your cookie choice at any time: .
5. Advertising (Google AdSense)
We are preparing to show ads with Google AdSense, a service of Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (USA). No ads and no AdSense code are on this site yet. When they are added, this section and the "Last updated" date will be updated, and the following applies:
- Google and its partners use cookies and similar technologies (for example
__gads,__gpiandIDE) to show ads, limit how often you see them, measure their performance and prevent fraud. Ads can be personalised based on your earlier visits to this and other websites. - Visitors from the EEA, the UK and Switzerland are asked for consent first, through Google's consent message. Without consent, Google only shows non-personalised or limited ads. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); you can withdraw it at any time in the same message.
- You can turn off personalised ads in Google's Ad Settings, or opt out of third-party vendors at aboutads.info.
- How Google uses data from sites that use its services: policies.google.com/technologies/partner-sites. Data may be transferred to the USA (safeguard: EU–US Data Privacy Framework).
Our ads.txt file lists the only advertising account authorised to sell ads on this site.
6. How long we keep data
- Server logs: kept by Vercel for a short period for operation and security.
- Visit statistics (SiteHub): contain no IP addresses and are deleted automatically after 14 months.
- Google Analytics: kept according to the data retention setting of our Google Analytics property.
- Sign-in data: only in your browser's session cookie, until you sign out or 30 days after your last visit.
- Skill submissions: as long as the skill is under review or listed on the site.
- Contact-form messages: as long as needed to handle your request.
7. Your rights
You can ask for access to, correction or deletion of your data, restriction of processing and data portability, and you can object to processing based on legitimate interest – use the contact form or write to the address above. You can withdraw your consent at any time via "Cookie settings" in the footer; this doesn't affect processing that happened before. You also have the right to complain to a data protection supervisory authority, for example the Bavarian authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach.
8. Children
This site is not directed at children under 16.
9. Changes
We update this policy when the services or cookies on this site change. The date at the top shows the latest version.