Privacy Policy

This policy explains which personal data is processed when you visit this website, and why. In short: no tracking cookies, no advertising and no third-party tracking. To see how the site is used, I run a privacy-friendly analytics tool on my own server.

Controller

Samuel von Tucher
Lennéstr. 9
53113 Bonn
Germany
Email: hello[at]samuelvontucher[dot]com

Storage period

Unless a more specific period is stated below, personal data is kept only as long as it is needed for the purpose it was collected for. It is deleted once that purpose no longer applies, unless statutory retention periods (for example under tax or commercial law) require me to keep it longer.

Hosting and server log files

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers located in Germany. Hetzner processes data on my behalf under a data processing agreement pursuant to Art. 28 GDPR.

Whenever you open a page, your browser automatically transmits information that is stored in server log files:

IP address, in shortened form (the last part is removed before it is stored)
date and time of the request
requested page or file and the amount of data transferred
referrer URL
browser and operating system (user agent)

This data is needed to deliver the website and to keep it secure and stable, for example to detect abuse. It is not combined with other data sources. The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest lies in the technically error-free and secure operation of this website. The log files are deleted after twelve months at the latest.

SSL/TLS encryption

For security reasons, this website is delivered exclusively over an encrypted connection (TLS). You can recognise it by the "https://" in your browser's address bar. Data you transmit to this website cannot be read by third parties in transit.

No tracking cookies, no third parties

This website sets no cookies for tracking or advertising. The only cookie is the one for protected projects described below, and only once you enter a password. Fonts and the analytics tool described below are hosted on this server; no data is sent to font providers, analytics companies or other third parties when you load a page.

Web analytics with Umami

To understand which pages are read and how visitors find this website, I use Umami, an open-source analytics tool that runs on my own server at Hetzner (see above). Nothing is shared with the Umami project or anyone else.

Umami does not set cookies, does not store your IP address and does not build profiles across websites. When you open a page, it records:

the page visited, including campaign parameters in the address (such as utm_source), and the referring website
browser, operating system, device type, screen size and language
country, region and city, derived from your IP address, which is then discarded
clicks on selected buttons and links

To count visits rather than page views, Umami derives an identifier from your IP address and browser, combined with a secret value that changes every month. The identifier cannot be traced back to you, and visits in different months cannot be linked.

The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest is understanding how this website is used so I can improve it. The analytics data is stored for 24 months and then deleted. A copy is kept as a backup in a private repository at GitHub Inc., 88 Colin P Kelly Jr St, San Francisco, CA 94107, USA, which stores it on my behalf. Transfers to the USA are based on the EU-US Data Privacy Framework, under which GitHub is certified.

You can object to this at any time (see "Your rights"); browsers with tracking protection or content blockers usually prevent the analytics script from loading.

Access to protected projects

Some projects are shown only to companies I have given a password. If you enter one, this website sets a cookie named project_access that contains a signed access token, so the projects stay unlocked while you browse. The cookie is strictly necessary to provide the function you requested (§ 25 (2) no. 2 TDDDG) and expires after 30 days or when access is revoked.

To be able to trace and revoke access per company, I record for each password how often it was used, which protected projects were opened and when they were last viewed. This record contains no IP addresses. To prevent passwords from being guessed, failed attempts are counted per IP address in the server's memory for a few minutes and are not stored permanently. The legal basis is Art. 6 (1) (f) GDPR; my legitimate interest is protecting confidential client work.

Theme preference

If you switch between light and dark mode, your choice is stored in your browser's local storage (key theme) so that it is still there on your next visit. This information stays on your device and is not transmitted to me. Storing it is strictly necessary to provide the function you requested (§ 25 (2) no. 2 TDDDG). You can delete it at any time via your browser settings.

Contact by email

If you send me an email, I process your email address, your name if given, and the content of your message to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to a contract or its preparation, otherwise Art. 6 (1) (f) GDPR; my legitimate interest is answering your message. I delete the data once your enquiry has been dealt with, unless statutory retention periods apply.

Links to other websites

This website links to external services such as social networks. These are plain links: no data is transmitted to these services until you click on them. After that, the privacy policy of the respective provider applies.

Your rights

You have the right to

access the personal data I hold about you (Art. 15 GDPR),
have incorrect data rectified (Art. 16 GDPR),
have your data erased (Art. 17 GDPR),
restrict processing (Art. 18 GDPR),
data portability (Art. 20 GDPR).

To exercise these rights, an email to the address above is enough.

Right to object (Art. 21 GDPR): Where processing is based on Art. 6 (1) (f) GDPR, you have the right to object to it at any time on grounds relating to your particular situation. I will then no longer process the data concerned, unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Changes

I update this policy when the website changes. Last updated: October 2026.