sudo cat /etc/legal
Privacy
01 Controller
Daniele Michelin, Berlin · info@daniele-michelin.com · full address in the imprint
02 Summary
- No cookies, no third-party tracking or advertising. Something is stored in your browser only if you choose a theme yourself or close the privacy notice (see “Display setting”).
- Fonts and all scripts are served from this server — no Google Fonts, no CDNs.
- One self-hosted, anonymised audience measurement; Do Not Track and Global Privacy Control are respected.
- Optional: a blog newsletter with double opt-in and no tracking.
03 Hosting
The site runs on a server operated by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, under a data processing agreement (Art. 28 GDPR).
04 Server log files
The web server logs IP address, date and time, requested page, referrer, user agent and status code to keep the service secure and stable (Art. 6(1)(f) GDPR). Logs are rotated daily and deleted after 7 days at the latest. Only hits from search-engine and AI crawlers are additionally counted (without IP addresses).
05 Cookie-free audience measurement
A small self-hosted script records per page view: page and language, referrer, screen size, time zone, reading time, scroll depth and user agent. IP addresses are truncated before storage (IPv4 last octet, IPv6 to /48). Daily unique visitors are counted with a hash of IP, user agent, date and a secret that changes every day — the full IP is never stored and hashes cannot be linked across days. Nothing is stored on or read from your device for this measurement. With Do Not Track or Global Privacy Control enabled, nothing is measured. An approximate country/city is derived from the truncated IP on this server using DB-IP's “IP to City Lite” database – no data is sent to third parties. Legal basis: legitimate interest in privacy-friendly usage statistics (Art. 6(1)(f) GDPR). Data stays on this server and is deleted after 14 months.
06 Display setting
The site first follows the light/dark setting of your device; the setting (prefers-color-scheme) is only read in your browser and not sent to the server. If you pick a theme with the ☀ toggle, only that choice (theme=light or theme=dark) is stored in your browser's localStorage so it persists on your next visit. It is never sent to the server. Storing it is strictly necessary for the function you explicitly requested (§ 25 (2) no. 2 TDDDG).
On your first visit a short notice at the bottom says that this site sets no cookies. If you close it with “Got it”, only that fact (notice=1) is stored in localStorage so the notice does not appear again — also never sent to the server (§ 25 (2) no. 2 TDDDG).
07 Contact form and e-mail
If you contact me, I process your name, e-mail address and message to reply (Art. 6(1)(b)/(f) GDPR). To prevent abuse the sender's IP address is included in the notification e-mail. Messages are delivered via STRATO's mail service and deleted once the request is settled. Statistics only count that a message arrived (time, language).
08 Newsletter
If you subscribe to the blog newsletter, I process your e-mail address and chosen language to send you new articles by e-mail. The legal basis is your consent (Art. 6(1)(a) GDPR). Sign-up uses double opt-in: you first receive an e-mail with a confirmation link and are only added to the list after clicking it. As proof of consent I store the time of confirmation and your truncated IP address (last octet removed). Unconfirmed sign-ups are deleted after 14 days. If you also tick the patch radar box, I store that choice and additionally send you an e-mail on Mondays with the week's security items; this e-mail also carries an unsubscribe link.
Every e-mail contains an unsubscribe link; unsubscribing deletes your address. E-mails are sent via STRATO's mail service (data processing agreement). There is no tracking – no open or click measurement, no images and no tracking links; e-mails are sent as an HTML and a plain-text version. The data stays on this server; you can withdraw your consent at any time with effect for the future.
09 Online tools
The tools under “Tools” (cron explainer, DNS TTL planner, DMARC generator, JWT and SAML decoders) run entirely in your browser; what you enter is not transmitted. For the SPF check the domain you enter is sent to this server and queried via DNS (TXT, A, AAAA and MX records); the result is shown but not stored. To prevent abuse a salted hash of your IP address (not the address itself) is kept for one hour and then deleted (Art. 6(1)(f) GDPR, security and functionality). The same applies to the mail DNS check, the certificate check and the security header check: the domain or address you enter is sent to this server, which runs the DNS queries, the TLS handshake or a single page request; none of it is stored, only the salted IP hash for one hour. The DMARC generator runs entirely in your browser. For the embeddable badges (SPF, TLS certificate, security headers) only the result per domain (e.g. “7/10 ok”, “83 days”, “A”) is cached for six hours, without any data about the person loading it. No cookies or local storage are used for this. For the “browser check” the device details shown are read only in your browser; your IP address is returned once by this server to your browser and is neither stored nor logged. For the “scam check” the text you paste is sent to this server, passed to an automation flow (n8n, own server) and transmitted to IONOS's AI service (Germany) for analysis; the domains found in it are also queried at public services (RDAP, Google Public DNS). The text is not stored. To limit use, a salted hash of your IP address is kept for 24 hours. Please do not paste passwords or ID data. The “explain an error” tool works the same way: the pasted text goes to this server, e-mail and IP addresses and passwords are replaced by placeholders, then it is sent via n8n to IONOS's AI service (Germany); it is not stored, the salted IP hash is kept for 24 hours.
10 External links
Links to GitHub and LinkedIn are plain hyperlinks; data is only transferred to those providers when you click them.
11 Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) — an informal e-mail is enough — and the right to lodge a complaint with a supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information.
12 AI assistant (chat and call in the browser)
When the AI assistant is switched on for this website you can type to it, or call it right in your browser, using a small button at the bottom right. Use is voluntary and starts only when you type something or click “Call”. The microphone is used only after you explicitly allow it in your browser; without a microphone you can type.
What is processed: your typed text, during a call your voice (as an audio stream) and the language setting of the page. Speech recognition and speech output run on my own computer in Germany; audio is not stored and not passed on to third parties. To produce an answer, the recognised text is sent to an AI language model from an external provider (currently Anthropic, USA). Please do not enter sensitive data.
Storage: conversation content is not stored. Technical logs contain at most the time and the length of messages. Your IP address is passed by the web server to my computer and used there only in memory to limit requests per hour and per day; it is not stored permanently. No cookies are set.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an information service about me and this website); for the microphone, your permission in the browser. The assistant is an AI, not a real person; it can make mistakes and makes no binding commitments. For binding enquiries please use the contact form.
Booking an appointment through the assistant: If you arrange an appointment with Daniele, your name, e-mail address, your request (short free text) and the chosen time are processed. They are kept in a non-public file on the server in Germany and deleted automatically at the latest 90 days after the appointment. You receive a confirmation by e-mail and Daniele a notification; sending goes through STRATO’s e-mail service (data processing agreement). The appointment appears in Daniele’s calendar. The legal basis is Art. 6(1)(b) GDPR (arranging an appointment at your request). Without an e-mail address no appointment can be booked.
Message to Daniele through the assistant: If you dictate or type a message for Daniele to the assistant, your name, e-mail address and text are sent to him by e-mail, exactly like the contact form (see above) – solely to reply. The content is not stored on this website; only the time and the language are counted. The legal basis is Art. 6(1)(b) GDPR.
The German version is legally binding.
Last updated: October 2026