Four pages: /imprint/ and /privacy/ in English, /de/impressum/ and
/de/datenschutz/ in German, linked from the footer of the matching language.
The German version is the authoritative one; the English one says so.
Every fact in them was checked rather than assumed. The hosting section comes
from the Art. 28 processing agreement with Hetzner (EU/EEA only, DPO appointed,
breach notification, ISO 27001, BSI C5 Type 2); the server location comes from
the provider's API and is Nuremberg; the "no cookies, no third-party requests,
nothing in your browser" claim comes from loading the live page in a browser
that records every outgoing request — all of them went to this domain, with
zero cookies and an empty localStorage.
nginx now logs without the client address. The default format was writing
$remote_addr and X-Forwarded-For, so a static page that needs no personal data
at all was storing the IP of everyone who looked at it. The log keeps time,
request, status, size, referrer and user agent — enough to operate the site,
minus the field that identifies a person. Data minimisation beats a retention
policy you then have to honour.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
