Imprint

Responsible for the processing of personal data on this site (controller under the GDPR) is Daniel Jonas Mielke, Hamburg, Germany, email: daniel.mlk@outlook.de.

This policy explains which personal data this site processes, why, and which rights you have.

The site is hosted by Vercel Inc. (USA). To deliver a page, Vercel processes the technical data your browser sends with every request: IP address, date and time, the page requested, the referring page, and browser and operating system. This is needed to show you the site and to keep it secure (Art. 6 (1) (f) GDPR). Vercel processes this data on my behalf.

I use Vercel Web Analytics to see which posts are read. It counts page views without cookies and does not follow you across other websites; I only see aggregated numbers such as the page, the referring site, the country and the device type (Art. 6 (1) (f) GDPR).

Fonts, the rendering of formulas, PDF previews and all scripts are served by this site itself. No content delivery networks or other third parties are contacted while you read, with the one exception of the anti-bot check described below.

When you like a post, your browser receives a cookie named visitor_id holding a random number (valid for one year). It makes sure a like counts once. The like is stored with that number only, without your name or IP address (Art. 6 (1) (f) GDPR).

If you write a comment or an annotation, the following is stored: the text, the time, the name you enter (or, when signed in, your GitHub username, user id and avatar), the visitor_id described above and a hashed form of your IP address (see below). Published comments and annotations are visible to everyone. Anonymous ones are only published after I have reviewed them.

The data is stored in a database operated by Supabase Inc. (USA) on my behalf and kept until the comment or annotation is deleted. Write to me if you want yours removed. Legal basis: your decision to publish it (Art. 6 (1) (a) GDPR) and my interest in keeping the site free of abuse (Art. 6 (1) (f) GDPR).

Your IP address is never stored as such. The site only keeps a salted SHA-256 hash of it, which cannot be turned back into the address without a secret key. It is used to limit how often likes, comments and annotations can be sent (these counters are deleted after two days) and is stored with each comment and annotation so that abuse can be blocked (Art. 6 (1) (f) GDPR).

The comment form uses Cloudflare Turnstile, a check that tells people from bots, run by Cloudflare, Inc. (USA). It only loads once you reach the end of a post, where the form is. Cloudflare then processes your IP address and technical data about your browser to make that decision (Art. 6 (1) (f) GDPR). Details: Cloudflare privacy policy.

Signing in is optional. If you sign in with GitHub, GitHub Inc. (USA) confirms your identity and the sign-in service of Supabase receives your GitHub user id, username, display name and avatar. A session cookie keeps you signed in until you sign out (Art. 6 (1) (b) GDPR).

The practice cards work without an account. As a guest, the cards you answered, your bets and your personal flags are stored only in your browser (see below) and are not sent to the server.

If you sign in with GitHub and practise, the following is stored with your account: for every answered card its id, the time, whether the answer was right, the chips you bet, the hints you used and how long you took, plus the flags and notes you set on cards for yourself. Answers you gave as a guest are added only if you choose to import them. The data is stored in the Supabase database and used only to schedule your reviews and show your progress to you. Nobody else can see it. On your profile page you can download all of it and delete your account together with this data at any time. Legal basis: your use of the feature (Art. 6 (1) (b) GDPR).

Your browser's local storage remembers which posts of the learning path you have read, whether you have already seen the hint about annotations, whether you have switched off the animated background, and your progress with the learning cards (answered cards, flags, the number of cards per session). This information never leaves your device unless you sign in and use the learning cards as described above; you can delete it in your browser settings at any time.

Vercel, Supabase, Cloudflare and GitHub are based in the USA. Where a provider is certified under the EU–US Data Privacy Framework, transfers rely on it (Art. 45 GDPR); otherwise on the EU standard contractual clauses (Art. 46 GDPR).

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), to object to processing based on legitimate interests (Art. 21) and to withdraw a consent at any time (Art. 7 (3)). An email to me is enough.

You can also complain to a data protection supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information.