Privacy Policy — Quirin Schlegel

Controller

Quirin Schlegel — [ADD POSTAL ADDRESS] — [email protected].

What we collect and why

Newsletter. If you subscribe, we store your email address (and name, if provided), the consent text and version you agreed to, the time of consent, and your IP address. We use a confirmed double opt-in: your address is only added to the active list after you click the confirmation link. Lawful basis: your consent (Art. 6(1)(a) GDPR). We use it solely to email you when a new six-pager is published. You can withdraw consent at any time via the one-click unsubscribe link in every email.

PDF downloads. When you request a PDF, we store your email address, which document you requested, the time, and your IP address, so we can email you the download link. Lawful basis: taking steps at your request and our legitimate interest in delivering the file you asked for (Art. 6(1)(b)/(f) GDPR). We do not add you to the newsletter unless you separately tick that box.

Authentication. If you use the passkey-secured chat, we store the account and passkey data needed to sign you in. Lawful basis: performance of the service you requested (Art. 6(1)(b) GDPR).

Analytics. We use Umami, a privacy-friendly, cookieless analytics tool, to understand aggregate traffic. It does not set tracking cookies or build cross-site profiles.

Reading theme.Your light/dark reading preference is stored in your browser's localStorage only. It never reaches our servers.

Processors

We share data with service providers who process it on our behalf under data-processing agreements: Resend (email delivery), Railway (hosting), and our self-hosted Umami instance (analytics). Where a processor transfers data outside the EU/EEA, that transfer is covered by appropriate safeguards such as the EU Standard Contractual Clauses.

Retention

Newsletter subscribers are kept until you unsubscribe; on unsubscribe we mark the record inactive and erase it on request. Download records are kept only as long as needed for the service and abuse prevention, then deleted.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and to object, as well as to withdraw consent at any time. If you have an account, the easiest way to exercise erasure is the Danger zone button on your Account page, which deletes everything we hold for you and unsubscribes you from the newsletter in one step. For anything else, email [email protected]. You also have the right to lodge a complaint with a supervisory authority.