Privacy Policy

1. Data controller

The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

An informal message is enough for any data protection enquiry: [email protected]

No data protection officer has been appointed; the statutory requirements for doing so are not met.

2. What this website processes — and what it does not

The website at appstellar.de is Martin Rost's personal portfolio and is purely static. It presents three iOS apps and links to the App Store as well as to contactkeeper.de, sylph.appstellar.de and prepora.de; the respective operator is responsible for those destination pages. There are no user accounts, no sign-in, no shopping cart and no payment processing here.

The only place where you actively send us data is the contact form (section 7). Alongside that, a self-hosted, cookie-free audience measurement is running (section 5). Everything else is limited to the technical data that necessarily arises whenever a website is retrieved.

The following are not used:

• advertising networks, retargeting or conversion measurement
• tracking across websites or cross-device recognition
• social media plugins, embedded videos, map services or comment services
• newsletters or profiling
• externally loaded fonts (section 6)
• automated decision-making or profiling within the meaning of Art. 22 GDPR

3. Hosting, delivery and Cloudflare

The site is a static export: your browser receives finished HTML, CSS, JavaScript and image files; there is no server-side rendering and no database. Delivery is handled by a Caddy web server on our own hardware in Germany, connected through a Cloudflare Tunnel. The origin server therefore does not receive your IP address but the internal address of the tunnel connector. Log data there serves operation and troubleshooting alone.

All traffic passes through Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA — DNS, content delivery network, TLS encryption, the tunnel connection and the mitigation of automated access. Cloudflare thereby processes your IP address, the time and the URL requested with its status code, the volume of data transferred, browser type and operating system, and the page previously visited.

The legal basis is our legitimate interest in secure and resilient operation (Art. 6 (1) (f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare; for the transfer to the USA, see section 8.

Details of the processing by Cloudflare: cloudflare.com/privacypolicy

4. Cookies and browser storage

This website sets no cookies of its own, and we embed no services that set cookies for analytics or advertising purposes. A consent banner is therefore not required.

Cloudflare may set strictly necessary cookies to distinguish automated access from human visitors: __cf_bm (bot management, around 30 minutes) and cf_clearance (records a passed security check). Their use is permitted without consent under Section 25 (2) no. 2 TDDDG (the German Telecommunications Digital Services Data Protection Act) because it is strictly necessary for the service you have requested.

Your browser's local storage (localStorage) may hold a language or appearance setting you have chosen and the entry that switches off the audience measurement (section 5). Both remain on your device, are never transmitted, and can be deleted via your browser settings.

5. Audience measurement with Umami

For audience measurement we use Umami. We run the software ourselves on our own hardware in Germany, reachable at syqtera.de — no data is passed to third parties, there is no processing arrangement with an external provider and no transfer to a third country. Section 3 applies to the transport path.

Umami sets no cookies and assigns no cross-device identifier. What is recorded is:

• the page requested and the referrer
• browser, operating system and device type
• screen size and language setting
• an approximate location derived from the IP address — usually the country, in some cases also the region and city

Your IP address is not stored; it only feeds into a hash formed with a regularly changing random value, which groups page views belonging to the same visit. The data is not combined into a user profile, and there is no recognition across other websites. The legal basis is our legitimate interest in a data-minimising analysis of website use (Art. 6 (1) (f) GDPR); we do not consider consent under Section 25 TDDDG to be required, because the measurement stores nothing on your device and reads no identifier stored there.

You may object to the measurement at any time under Art. 21 GDPR. You can also switch it off yourself: if you store the value 1 under the key umami.disabled in this website's local storage, the page sends no further measurement data; a script blocker has the same effect. The measurement does not currently evaluate your browser's Do Not Track signal.

6. Fonts are served locally

The website uses the typefaces DM Sans and Instrument Serif. Both are downloaded once when the site is built and are then served together with the website from our own server. Your browser therefore establishes no connection to fonts.googleapis.com or fonts.gstatic.com; no IP address is transmitted to Google.

7. Contact form and email

Through the contact form you transmit your name, email address and the text of your message; technically, your IP address, a timestamp and the referrer are sent along with it. Transmission runs through Web3Forms (Web3Creative, Kerala, India). The service delivers the message as an email to our contact address and at the same time stores the submission on its infrastructure; according to the provider it is automatically deleted no later than three years after submission.

The legal basis is the consent you give by submitting the form (Art. 6 (1) (a) GDPR); for contract-related enquiries, Art. 6 (1) (b) GDPR applies in addition. You may withdraw your consent at any time with effect for the future.

The address [email protected] is not a mailbox in its own right; it is forwarded to a mailbox of Google Ireland Limited via Cloudflare Email Routing. Both process the sender, recipient, subject and content in order to deliver and hold the message (Art. 6 (1) (f) GDPR). While email is usually encrypted in transit, it is not end-to-end secure — please do not send us particularly sensitive information unencrypted.

In our own mailbox we delete your enquiry once it is settled and no retention periods stand in the way, as a rule no later than six months after the last correspondence.

Privacy policy of the form service: web3forms.com/privacy

8. Recipients of your data and transfers to third countries

Beyond the following parties, we do not pass on any personal data; it is never sold and never shared for advertising purposes. We disclose it to public authorities only where legally obliged. The audience measurement in section 5 is deliberately absent from this list — we evaluate that data ourselves.

• Cloudflare, Inc. (USA) — website delivery, DNS, tunnel, attack protection, email forwarding
• Web3Creative / Web3Forms (India) — receipt and delivery of the form messages
• Amazon Web Services, Inc. (US company, server region not fixed by contract) — for Web3Forms: hosting, storage of submissions, email delivery
• CleanTalk Inc. and Automattic Inc. / Akismet (both USA and global) — for Web3Forms: spam prevention; they receive the sender's IP and email address
• Hetzner Online GmbH (Germany, Finland) — for Web3Forms: application infrastructure
• Google Ireland Limited (Ireland) — mailbox behind our contact address

Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023), and the standard contractual clauses apply in addition. There is no adequacy decision for India; a data processing agreement pursuant to Art. 28 GDPR is in place with Web3Creative, incorporating the Standard Contractual Clauses annexed to Implementing Decision (EU) 2021/914 and binding the sub-processors named above to an equivalent level of protection. Even so, neither India nor the USA guarantees by law a level of data protection equivalent to the European one — your rights may be harder to enforce there. If you would rather avoid this, write to us directly by email instead of using the form.

Web3Forms' data processing agreement and sub-processors: web3forms.com/dpa

9. Your rights and the right to complain

You have the following rights in relation to us:

• access to the data processed about you (Art. 15 GDPR)
• rectification of inaccurate and completion of incomplete data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

An informal message is enough to exercise them: [email protected]

Irrespective of the above, you may lodge a complaint with a supervisory authority under Art. 77 GDPR, in particular where you live, where you work or where the alleged infringement took place. The authority responsible for us is:

Further information and ways to make contact: datenschutz.rlp.de

10. Changes to this privacy policy

We update this policy whenever the technology behind the website, the services used or the legal situation change. The version published here is the one that applies; the date is given above.