Privacy Policy

1. Overview

This blog is a personal publishing project operated by Michael Kagerer. We take your privacy seriously and collect the absolute minimum amount of data necessary to operate the site. There are no third-party trackers, no analytics scripts, and no advertising networks on this site.

2. Data we collect

Session cookie

When you visit the site, a single session cookie is set. This cookie is strictly necessary for security purposes — specifically to prevent cross-site request forgery (CSRF) attacks. It does not track you across sites or contain any personal information. It expires after 7 days or when you close your browser session.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating a secure website.

Newsletter subscription

If you voluntarily subscribe to our newsletter, we store your email address in our database hosted on Railway (see Third-Party Services below). Your email is used solely to send you newsletters related to this blog. You can unsubscribe at any time by clicking the unsubscribe link included in every email, or by contacting us directly at michaelkagerer@icloud.com.

Legal basis: Art. 6(1)(a) GDPR — your explicit, freely given consent.

Retention: Until you unsubscribe. We delete your email address promptly upon request.

Post reactions

If you react to a post (e.g. "Loved it"), your choice is stored locally in your browser (localStorage) and an anonymous counter is incremented on our server. No personal data is stored server-side — we cannot identify who reacted.

Legal basis: No personal data is processed on the server.

Server logs

Our hosting provider Railway automatically records standard server logs (IP address, request URL, HTTP status code, timestamp) for error diagnosis. These logs are retained for 7 days by Railway and are not used for any tracking purpose.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in diagnosing technical errors.

3. What we do NOT collect

• No analytics or behavioural tracking
• No advertising cookies or user profiles
• No browser fingerprinting
• No social media tracking pixels
• No location data

4. Third-party services

Google Fonts

This site loads typefaces from Google Fonts (fonts.googleapis.com, fonts.gstatic.com). When your browser requests a font file, Google may log your IP address and the referring page. See Google's Privacy Policy. You can prevent font requests using a content-blocking browser extension.

Railway (hosting)

The site is hosted on Railway, Inc. (US). Railway processes server logs as described above. See Railway's Privacy Policy.

Email delivery

If you subscribe to the newsletter, outgoing emails may be sent via an SMTP relay provider (e.g. Resend). Your email address is transmitted to this provider solely for the purpose of delivery. No profiling or tracking is performed by us on email interactions.

5. Your rights under GDPR

As a data subject under the EU General Data Protection Regulation, you have the following rights:

• Right of access (Art. 15) — Request a copy of personal data we hold about you.
• Right to rectification (Art. 16) — Ask us to correct inaccurate data.
• Right to erasure (Art. 17) — Ask us to delete your data ("right to be forgotten").
• Right to restriction of processing (Art. 18) — Ask us to limit how we use your data.
• Right to data portability (Art. 20) — Receive your data in a machine-readable format.
• Right to object (Art. 21) — Object to processing based on legitimate interests.
• Right to withdraw consent — Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at michaelkagerer@icloud.com. We will respond within 30 days.

6. Right to lodge a complaint

You have the right to lodge a complaint with the competent data protection supervisory authority. For Austria:

7. Contact & data requests