Privacy policy

This policy covers the website jsnlabs.eu. The Luciola app and its pages under /luciola have their own Luciola privacy policy.

Controller

The controller is the provider named in the imprint.

In short

• No tracking, no third-party analytics, no ads. There is a cookie only if you switch the design.
• A visitor statistic of its own counts page views on the server, without a cookie, script or IP address.
• To protect against attacks, the server logs requests with the IP address and deletes the logs after 7 days.
• No embedded content from other providers. This site serves its fonts and images itself.
• The contact form stores only what you enter, on this site's own server, and deletes it after 12 months at the latest.
• New posts by email only after you confirm, without measuring opens or clicks.

Delivery through Cloudflare

The site is delivered through the network of Cloudflare, Inc. (USA), which makes it faster and protects it from attacks. Cloudflare processes technically necessary data of your request, in particular your IP address, the requested address and details of your browser. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.

Server and logs

The server runs on Oracle Cloud Infrastructure. It logs every request with your IP address, the time, the requested address, the status code and the response time. It does not log browser details or other request headers. The logs serve to detect and fend off attacks and abuse and to find errors; the legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). They are kept on the server itself and on a monitoring server run by the provider, and deleted on both after 7 days at the latest. They are not passed on.

Visitor statistics

To see which pages are read and where visitors come from, this site's server counts page views itself. Only daily totals are stored: how often a page was viewed, from which website (its domain only, such as google.com), with which kind of device (desktop, phone, tablet), with which browser family (such as Firefox) and from which country, as Cloudflare derives it from the IP address. No cookie is set, no script is loaded and nothing is stored on or read from your device.

So that several views by the same person on one day count as one visitor, the server forms a check value from the IP address and the browser identification, with a key that is generated anew every day. Check value and key exist only in memory and are discarded by the end of the day (UTC) at the latest; the IP address itself is not stored. The stored totals do not allow conclusions about individual people. The legal basis is our legitimate interest in improving the site (Art. 6(1)(f) GDPR).

Contact form

When you send the contact form, I store your name, email address, topic and message, along with the time and the language of the page, in a database on this site's server. I use these details only to answer your request (Art. 6(1)(b) GDPR for requests about an engagement, otherwise (f)). Only I can view them, in a protected area that requires signing in. I delete an enquiry once it is handled, and automatically after 12 months at the latest; encrypted backups keep it for up to 30 more days.

Your IP address is not stored with the enquiry; like every request, it is in the server log for at most 7 days (see above). To stop mass submissions, the server only counts in memory how often an address has sent the form, using a check value whose key is created anew every day. No cookie is set.

Newsletter

You can subscribe to new blog posts by email. For this I store your email address, the language of the page you signed up on, and the times of signing up and confirming in the database on this site's server. The legal basis is your consent (Art. 6(1)(a) GDPR). The subscription only starts once you click the link in the confirmation mail (double opt-in); unconfirmed sign-ups are deleted after 7 days. I keep the times as proof of your consent for as long as you are subscribed.

A mail contains the title, summary and link of a new post. Whether you open it or click its links is not measured. You can unsubscribe at any time with the link in every mail, which withdraws your consent; your address is then deleted at once. It remains in encrypted backups for up to 30 days after that.

The mails are sent through Scaleway Transactional Email by Scaleway SAS (Paris, France), with servers in the EU, as a processor under Art. 28 GDPR. Scaleway receives your address and the content of the mail for this.

Light and dark design

The site follows your system's setting. If you switch it yourself with the sun or moon symbol, your browser keeps a cookie named theme with the value light or dark for one year. It holds nothing else, is read only by this site and serves only to apply your choice on every page. Because you ask for it, it is strictly necessary (Section 25(2) no. 2 TDDDG) and needs no consent. You can delete it in your browser at any time; the system setting then applies again.

Contact by email

If you email me, I process your details to answer your request (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer needed for that and no retention obligations apply.

Links to other services

Links, for example to GitHub, LinkedIn or booking a call through Microsoft Bookings, lead to other providers' sites. Data is processed there only once you click such a link, under that provider's privacy policy.

Your rights

You have the right of access, rectification, erasure and restriction of processing, the right to data portability and the right to object to processing based on legitimate interests. You can also lodge a complaint with a data protection supervisory authority.

Last updated: October 2026