Imprint & Privacy

No cookies. No accounts. No advertising. No third-party trackers, no analytics service, no embedded fonts or scripts loaded from anyone else.

The site counts how often its pages are opened, and that count is stored in a database I run myself. Nothing is written to your device and nothing is read from it, which is why you are not being asked to agree to anything.

Which page was opened, and for a project page which project it was. How long a page stayed visible, in whole seconds. Which of the three filters on the home page was used. Whether a link leaving this site was followed, and to which of a handful of known destinations.

Each of those carries: the referring hostname (“google.com”, never the full address you came from), a two-letter country code, a two-letter language code, and one of three device classes — mobile, tablet or desktop.

Your IP address is never stored. It is read once, on the server, to compute a one-way hash together with your browser’s user-agent string and the current date, and is then discarded. That hash is the only thing that approximates “how many people”, it cannot be turned back into an address, and it changes at midnight UTC — so the same person on two days is deliberately counted as two.

The user-agent string itself is not stored either, only the device class derived from it. No mouse movements, no scroll depth, no clicks inside the page, no form input — there are no forms. Nothing about you is combined with anything from anywhere else.

The consent requirement in § 25 TDDDG, which implements Article 5(3) of the ePrivacy Directive, attaches to storing information on your device or reading information already stored there. This site does neither, so the requirement does not arise.

The one exception runs the other way: if you opt out (below), that refusal is kept in your browser’s session storage for the rest of the tab. It stores the refusal to be counted, never a measurement — the “strictly necessary” limb of the same provision.

The counting itself rests on legitimate interest, Article 6(1)(f) GDPR: knowing whether anyone reads this, without learning anything about who does.

If your browser sends Global Privacy Control or Do Not Track, the server drops the request before anything is derived or written. Both are settings in your browser and need nothing from this site.

You can also add ?notrack to any address here — dominikheilig.com/?notrack — and nothing is sent for the rest of that tab.

The site is hosted by Vercel Inc., which necessarily processes the requests it serves. The events are stored with Supabase, in an EU region. Both act as processors under a data processing agreement; nobody else receives anything.

Rows are deleted after 400 days.

You have the rights to information, correction, erasure, restriction, portability and objection under Articles 15 to 21 GDPR, and the right to complain to a supervisory authority.

In practice there is very little to exercise them against: with no identifier that survives a day, an event cannot be traced back to you, and I could not find your rows even if you asked. If you want to object in advance, the two ways above do it. For anything else, write to me.