Your data, explained

Privacy Policy

philipp.fyi collects a small amount of personal data through its contact form, hosting infrastructure, performance monitoring, server-side analytics, and browser security reports. This page explains what's collected, who processes it, and how to exercise your rights.

Controller

Philipp Storl, based in the Chemnitz / Leipzig area, Germany, is the controller responsible for the personal data processed on this site (philipp.fyi). You can reach me through the contact form.

What this site collects

Contact form

When you submit the contact form, I collect your name, email address, and the message you write. Netlify Forms also records your IP address, your browser's user agent, the page you sent the form from (referrer), and the time of submission with every message. I use this data only to respond to your inquiry, after Netlify has screened it for spam (see below).

Using the form is voluntary, and no law or contract requires you to provide this data. The form can't be sent without all three fields, though, and without your email address I can't reply to you.

  • Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in answering messages sent to me. Where your inquiry is about working together, also Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract.
  • Recipient: Netlify, Inc. (opens in a new tab), which stores form submissions on my behalf as a processor (Netlify Forms). Netlify checks every submission for spam with Akismet, a service of Automattic Inc.
  • Retention: kept for as long as needed to respond to and follow up on your inquiry, then deleted, unless statutory retention periods require keeping it longer (for example, when an inquiry leads to a contract, business correspondence is kept for up to 6 years under § 257 HGB and § 147 AO). You can ask me to delete it sooner at any time.

Hosting and server logs

This site is hosted on Netlify. Like most hosting providers, Netlify's infrastructure automatically logs technical request data (for example IP address, requested URL, timestamp, and user agent) to operate, secure, and troubleshoot the site.

  • Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in operating a secure, reliable website.
  • Recipient: Netlify, Inc.
  • Retention: Netlify doesn't publish a fixed period for these logs. Under its privacy policy (opens in a new tab), it keeps personal data only as long as needed for the purpose it was collected for, or as long as the law requires, weighing how sensitive the data is and the risk of misuse.

Performance monitoring

Netlify's Real User Monitoring measures how fast pages load for real visitors. On every page view, a script served from this domain reads your browser's user agent, platform and screen size, reduces the user agent to browser, operating system and device type, and sends one record per page view to Netlify: those values, the page's address, the time, and load-time measurements (Core Web Vitals). Your IP address reaches Netlify with that request. The script sets no cookies and stores nothing in your browser. I only see figures Netlify aggregates from these records.

  • Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in noticing and fixing slow or broken pages.
  • Reading information from your device: under § 25(2) Nr. 2 TDDDG this needs no consent, because reading these properties is strictly necessary to deliver the service you requested, a website that loads and works without errors. The German data protection authorities' guidance on digital services (DSK Orientierungshilfe Digitale Dienste, Rn. 90) counts error-free delivery of a website as part of what a visitor asks for.
  • Recipient: Netlify, Inc.
  • Retention: on this site's Netlify plan, the figures I can see cover the last 7 days, per Netlify's Real User Monitoring documentation (opens in a new tab). Netlify doesn't publish a separate period for the underlying records, so the same criteria as for the hosting logs above apply.

Site analytics

To understand which pages are read and where visitors come from, this site uses Netlify Analytics. It works entirely on Netlify's side, from the same request logs described above: no script runs in your browser and no cookies are set. It processes request data such as your IP address (used to count unique visitors), the page you requested, and the site that referred you. I only see aggregate figures such as pageviews, top pages, and referring sites, never individual visitors.

  • Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in understanding how the site is used.
  • Recipient: Netlify, Inc.
  • Retention: the figures I can see cover the last 30 days. The underlying request data is the hosting logs above, with the same retention.

CSP violation reports

This site's browser security policy asks your browser to report any blocked or unexpected script/style activity. If your browser sends one, it's stored (via Netlify Blobs) so it can be investigated, then automatically deleted about 30 days later. A report contains the page's URL, the blocked address, the referring page, the policy rule and the file and line that triggered it, a short sample of the blocked code, the time it was received, and your browser's user agent.

  • Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in detecting and fixing security issues.
  • Recipients: Netlify, Inc. If a Slack alert channel is configured, the report (shortened if very long), including your browser's user agent, is also posted to Slack (Slack Technologies Limited, Dublin, Ireland) so I can investigate promptly.
  • Retention: the stored copy is deleted automatically, as described above. The Slack copy is kept only as long as needed to investigate the violation, then deleted.

International data transfers

Netlify, Inc. is based in the United States. Where data is transferred outside the European Economic Area, Netlify relies on the Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework as a safeguard. See Netlify's privacy policy (opens in a new tab) for details. Akismet, the spam filter Netlify runs on contact form submissions, is operated by Automattic Inc., also based in the United States. Netlify engages Akismet as a sub-processor, and Automattic relies on the Standard Contractual Clauses for transfers from the European Economic Area; see Automattic's privacy policy (opens in a new tab).

Slack Technologies Limited, which receives CSP violation reports, also processes data in the United States. For those transfers Slack relies on the EU-U.S. Data Privacy Framework (through its parent company Salesforce) and the Standard Contractual Clauses; see Slack's privacy policy (opens in a new tab).

Cookies and local storage

This site doesn't use cookies and doesn't run any third-party advertising or tracking scripts. The performance-monitoring script and site analytics described above use no cookies or browser storage. Separately, this site stores exactly one preference, your light/dark theme choice, in your browser's local storage. That value never leaves your browser and isn't linked to you personally.

Your rights

Under the GDPR, you have the right to:

  • access the personal data I hold about you (Art. 15)
  • have inaccurate data corrected (Art. 16)
  • have your data deleted (Art. 17)
  • restrict how your data is processed (Art. 18)
  • receive the data you gave me in a portable format, where I process it to prepare working together (Art. 20)

Right to object (Art. 21): where I process your data based on my legitimate interest (Art. 6(1)(f) GDPR), you can object at any time, on grounds relating to your particular situation. I'll then stop processing it unless I can show compelling legitimate grounds that override your interests, or need it to establish, exercise, or defend legal claims.

To exercise any of these, use the contact form. You also have the right to lodge a complaint with a supervisory authority, in particular the Sächsische Datenschutz- und Transparenzbeauftragte (opens in a new tab) (the data protection authority for Saxony, Germany, where I'm based), or the authority in your own country of residence.

Changes to this policy

I'll update this page if what this site collects or how it's processed changes. Last updated: September 25, 2026.