Privacy notice

Last updated: 5 May 2026

This page explains how I handle personal data on davidhach.com. The site is run as a personal project, not a business. I keep the data flow as small as possible.

1. Controller

The controller responsible for data on this site is David Hach. For contact details, see the Imprint.

2. What's collected, when

Visiting the site

Vercel (the hosting provider) processes standard server log data when you load the site: IP address, user-agent, referrer, and the requested URL. This is needed to deliver the page and to protect the service against abuse. Logs are retained for a short, automatically-rotated period and not used for analytics or tracking.

The site uses no analytics, no advertising trackers, no fingerprinting, and no third-party social embeds. Fonts are served from this domain — no request is made to Google Fonts. YouTube thumbnails are proxied through this domain — no request is made to Google / YouTube CDNs from your browser when you view the homepage.

Newsletter ("Tap into my brain")

If you subscribe, the email address you submit is sent to my email service provider Kit (Kit Inc., USA — formerly ConvertKit), which stores it for the purpose of sending you the newsletter. Your browser does not contact Kit directly; the request is proxied through this domain.

Kit operates a confirmation-email flow ("double opt-in"): you receive an email and must click a link before being added to the list. If you don't confirm, the address is discarded.

Legal basis: your explicit consent (Art. 6(1)(a) GDPR), captured by the checkbox on the form.
Purpose: sending you the newsletter you signed up for.
Retention: until you unsubscribe (every newsletter contains a one-click unsubscribe link).
International transfer: Kit is based in the United States. The transfer is supported by the EU–US Data Privacy Framework and Standard Contractual Clauses where applicable. See Kit's privacy policy.

Theme preference

Your light/dark mode choice is stored in your browser's localStorage under the key dh_theme. This is a strictly-functional storage entry — no information leaves your browser. You can clear it any time in your browser settings.

3. Cookies

This site does not set any cookies. The only client-side persistence is the theme preference described above.

4. Your rights

Under the GDPR you have the right to: access, rectify, erase, and port your data; restrict or object to processing; withdraw consent at any time without affecting the lawfulness of past processing; and lodge a complaint with a supervisory authority.

To exercise any of these rights, contact me using the address in the Imprint. To unsubscribe from the newsletter, click the unsubscribe link in any email — that revokes consent immediately.

5. Service providers used

Vercel Inc. — hosting, edge caching, serverless functions. Vercel privacy policy.
Kit Inc. — newsletter delivery (only after you opt in). Kit privacy policy.
YouTube / Google LLC — when you click "Latest Video", your browser navigates to YouTube. From that point on, YouTube's privacy policy applies. The thumbnail you see on this page is fetched server-side, so Google does not see your IP until you actually click through.

6. Changes

This notice may be updated as the site evolves. Material changes will be reflected in the "last updated" date at the top.