Privacy.

Last updated 29 September 2026

Too long, didn't read

Your privacy matters to me, so you should know at any time which of your data is used and what it is used for. This site follows the European General Data Protection Regulation (GDPR) and the additional rules of the Austrian Data Protection Act (DSG).

As a visitor to this site:

  • no cookies are set while you browse
  • no ads, no third-party analytics, nothing that follows you to other sites
  • no third-party scripts, fonts or CDNs — everything comes from this domain
  • nothing is sold, shared or handed to anyone else
  • page views are counted on my own server, with a shortened IP address that no longer points at you
  • the guestbook is public, and only what you type into it is published
  • the theme switch and the gallery hint live in your browser only

The full version

This privacy policy tells you, as a visitor of this website, the kind, the extent and the purpose of the collection and the use of personal data. It applies to all processing on this website (mathias-schuh.duckdns.org).

Controller under Art 4 no. 7 GDPR is Mathias Schuh, Graz, Austria. You can reach me at satalicious@proton.me.

Visiting the site

When you open a page, your browser sends the usual request data to my server. That data is technically necessary to show the page to you. The server then hands the page view to Umami, an analytics tool I run myself on the same server. Your browser never talks to it, and no script or cookie is involved. For every page view Umami keeps:

  • the path you opened
  • the site that linked you here, if your browser sent one
  • browser, operating system and device type, read from the user-agent string
  • the first language your browser asks for
  • country, region and city, looked up from a shortened IP address
  • the date and the time of the request

Shortened means the last block is dropped before the address leaves the site — 203.0.113.47 becomes 203.0.113.0. Umami uses it for the location lookup and to build a visit id: a hash of the shortened address, the user-agent string and a secret that changes every month. The address itself is not stored, and the hash cannot be turned back into it. Automated traffic — crawlers, scanners and probes for paths no person requests — is not counted at all.

A few clicks are counted the same way: opening a photo, copying a photo link or the e-mail address, switching the theme, following a link to another site, and signing the guestbook. Your browser tells this site about the click, and the site passes it on to Umami with the page it happened on. For a photo that is the photo's name, for a link the address it points to, for the theme which one you picked. Nothing you type is sent.

The totals are public on /stats. They show counts per page, source, browser and country, never a single visit. No analytics provider is involved, and the data never leaves my server.

Before September 2026 page views went into a log of one row per view: shortened IP address, path, referrer, user-agent string and time. That log is no longer written. What is left of it is kept for comparison and pruned by hand.

The guestbook

Signing the guestbook is voluntary. Your name, your message, the sigil you picked and the time you signed appear publicly on the home page — so please do not write anything you would not want in public, and pick any name you like. A shortened IP address is stored next to the entry to limit spam. It is never shown on the page and never sent to a browser.

In your browser

Two values are kept in your browser's local storage: the theme you picked, and a flag that hides the gallery hint after you have used it once. Both stay on your side and are never sent to the server. No cookie is set while you browse the site.

E-mail contact

This site shows e-mail links you can use to write to me. In such a message you may pass personal data to me — your name, for example, if it is part of your address. I process it only to answer you, and I delete the message and its data once the matter is settled and no legal retention period applies.

Links

This site links to other websites, for example to my profiles and to projects I mention. Those sites are not under my control, and this policy does not apply to them. If you follow such a link, the operator of that site may collect and process data about you under its own policy.

Legal basis

Page views are processed on the basis of legitimate interests under Art 6 (1) (f) GDPR: delivering the site, keeping it secure, and seeing in rough terms whether anybody reads it. The IP address is shortened before it is used, which is why this interest does not override yours.

A guestbook entry is processed on the basis of your consent under Art 6 (1) (a) GDPR, which you give by signing it, and which you can withdraw at any time by asking me to remove the entry. Answering an e-mail is again a legitimate interest under Art 6 (1) (f) GDPR.

Storage, deletion and processors

The site runs on my own server. There is no hosting company, no analytics company and no other processor: nobody but me touches this data.

Umami keeps page views until I delete them; the old visit log is pruned by hand and deleted as soon as it is no longer needed. Guestbook entries stay visible until you or I remove them. When the purpose of a piece of data ends, it is deleted.

Your rights

If your personal data is processed, you are a data subject under Art 4 (1) GDPR. Towards me as the controller you have:

  • the right of access
  • the right to rectification
  • the right to erasure
  • the right to restriction of processing
  • the right to data portability
  • the right to object to processing

One e-mail to satalicious@proton.me is enough to use any of them. Please note that page views are stored without your address, so I usually cannot tell which ones belong to you and cannot answer such a request for them. A guestbook entry I can find and remove.

If you think the processing of your data breaks the GDPR or the DSG, you may complain to a supervisory authority — in particular in the member state of your residence, your workplace or the place of the suspected breach. In Austria this is the Data Protection Authority (dsb.gv.at).