Four pages: /imprint/ and /privacy/ in English, /de/impressum/ and
/de/datenschutz/ in German, linked from the footer of the matching language.
The German version is the authoritative one; the English one says so.
Every fact in them was checked rather than assumed. The hosting section comes
from the Art. 28 processing agreement with Hetzner (EU/EEA only, DPO appointed,
breach notification, ISO 27001, BSI C5 Type 2); the server location comes from
the provider's API and is Nuremberg; the "no cookies, no third-party requests,
nothing in your browser" claim comes from loading the live page in a browser
that records every outgoing request — all of them went to this domain, with
zero cookies and an empty localStorage.
nginx now logs without the client address. The default format was writing
$remote_addr and X-Forwarded-For, so a static page that needs no personal data
at all was storing the IP of everyone who looked at it. The log keeps time,
request, status, size, referrer and user agent — enough to operate the site,
minus the field that identifies a person. Data minimisation beats a retention
policy you then have to honour.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
A static Astro page. The sheet playground imports the print engine
(printlayout.ts, paper.ts) verbatim from the Klarbild repository and runs it in
the browser, so the layout on screen is the application's own arithmetic rather
than a mock-up. The PDF it offers is drawn from the same placements with pdf-lib.
No backend, nothing uploaded, no third-party requests.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
tillandClaude Opus 5