Privacy Policy and Cookie Policy
Last updated: 4 October 2026
This page explains which personal data is processed when you visit niklas-heringer.com, why, on what legal basis, and what rights you have. It also covers cookies and similar technologies. I try to keep it short and accurate: if a service is not listed here, it is not used.
1. Who is responsible
Niklas Heringer, Spreeallee 1, 67071 Ludwigshafen am Rhein, Germany
Email: [email protected]
See also the Imprint.
2. Overview
| Purpose | Data | Legal basis | Recipient |
|---|---|---|---|
| Delivering and securing this website | IP address, requested page, time, browser information | Art. 6 (1) (f) GDPR | Cloudflare, my own server |
| Member account and comments | Email address, name, comments, subscription status | Art. 6 (1) (b) GDPR | Ghost (my own server) |
| Newsletter | Email address, name, delivery and open events | Art. 6 (1) (a) GDPR | Mailgun |
| Visitor statistics | Visited page, referrer, browser, country, pseudonymous identifier | Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG (consent) | Tinybird |
| Contact by email | Your message and email address | Art. 6 (1) (b) and (f) GDPR | Hostinger |
| Libraries loaded from other servers | IP address | Art. 6 (1) (f) GDPR | jsDelivr, Cloudflare (cdnjs), GitHub |
| Payments (only if paid memberships are offered) | Payment and device data | Art. 6 (1) (b) GDPR | Stripe |
3. Visiting the website (hosting and Cloudflare)
This website runs on the Ghost publishing software on a server that I operate myself. Your requests pass through Cloudflare, which provides DNS, TLS encryption, caching, protection against abuse (for example rate limiting) and a secure connection to my server. For this, your IP address and request details are processed by Cloudflare and, for a short time, in the technical logs of my server. Simply visiting the site does not set cookies.
Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a fast, secure and available website).
4. Members, comments and newsletter
If you sign up, I store your email address, your name (if you give one), your subscription status and, if you comment, your comments. You sign in with a one-time link sent by email; no password is stored. After you sign in, a cookie keeps you signed in (see section 9).
Legal basis: Art. 6 (1) (b) GDPR for the membership and comments, Art. 6 (1) (a) GDPR for the newsletter. You can withdraw consent at any time with the unsubscribe link in every email or in your account. You can delete your account in your account settings or by writing to me.
Email delivery: Emails (sign-in links and newsletter) are sent through Mailgun Technologies, Inc., a Sinch group company in the USA. I use Mailgun’s EU region. Mailgun processes the recipient address, the message and delivery events (delivered, opened, bounced) on my behalf under a data processing agreement.
Measuring: The opening of newsletters is measured with a small tracking image, and clicks on links are counted through this website. If you do not want this, block remote images in your email program or unsubscribe.
5. Visitor statistics (only with your consent)
I use the built-in Ghost Traffic Analytics to see which content is read. Data is sent only if you agree in the privacy notice shown on your first visit. Until you decide, and if you decline, nothing is sent. Measured data: visited page, referrer, time, browser, operating system and device type, country, and a pseudonymous identifier derived from technical request data that I cannot trace back to you. No cookies are used.
Provider: Tinybird Inc., 41 East 11th Street, 11th Floor, New York, NY 10003, USA, as processor. I use the EU region.
Legal basis: Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG (consent). You can withdraw consent at any time with the small privacy icon in the corner of the page. Withdrawal does not affect processing that happened before.
6. Contact by email
If you write to me, I process your message and address to answer you. The mailbox is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The website itself is not hosted by Hostinger.
Legal basis: Art. 6 (1) (b) GDPR (answering your request) and Art. 6 (1) (f) GDPR.
7. Payments (Stripe)
Only if paid memberships are offered: payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe also collects information about the devices that connect to its services to operate its services and to detect fraud.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).
8. Libraries loaded from other servers
Fonts are hosted on this website; no fonts are loaded from Google or other font services. For some functions your browser loads files from the following providers, which receive your IP address when doing so:
- jsDelivr: Prospect One sp. z o.o., ul. Królewska 65A/1, 30-081 Kraków, Poland. Delivers JavaScript libraries and components of the Ghost software (for example sign-in, search and comments). Libraries for code highlighting, diagrams and formulas load only on pages that need them.
- cdnjs (Cloudflare): Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Hosts icons (Font Awesome) and other common libraries.
- GitHub: GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. The CV, About, Armory and Next pages load their data from a public GitHub repository.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in an efficient, working website).
9. Cookies and local storage
Visiting the website normally sets no cookies. Cookies appear only in these cases:
| Name | Set by | Purpose | Lifetime | When |
|---|---|---|---|---|
| ghost-members-ssr, ghost-members-ssr.sig | This website (Ghost) | Keeps you signed in as a member | up to about 6 months | Only after you sign in |
| cf_clearance | Cloudflare | Remembers that you passed a security check | up to 30 minutes | Only if Cloudflare shows a security check |
| _cfuvid | Cloudflare | Abuse protection (rate limiting) | Session | Only if Cloudflare sets it |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention | 1 year, 30 minutes | Only on payment pages, if payments are offered |
These cookies are strictly necessary for the function you request, so no consent is needed (Section 25 (2) TDDDG). Cookies for the administration area are set only for the site owner.
Local storage in your browser (not sent to a server): nh_cookie_consent stores your choice from the privacy notice with a random consent ID and a timestamp, and theme stores your light or dark mode choice. Both are needed so that the site works the way you set it up. Components of the Ghost software may keep further technical entries for sign-in and comments.
10. Your choices
- Change or withdraw your decision on visitor statistics at any time with the small privacy icon in the corner of the page.
- Unsubscribe from the newsletter with the link in every email or in your account.
- Delete or block cookies and local storage in your browser settings.
11. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interests (Art. 21 GDPR) and to withdraw consent at any time. To use these rights, write to [email protected]. I answer within one month.
You also have the right to complain to a data protection authority. For me this is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz). You can also contact the authority at your place of residence.
12. How long data is kept
- Member data: until you delete your account or ask me to delete it.
- Newsletter data: until you unsubscribe. Delivery logs at Mailgun are kept for a limited time.
- Technical logs: only as long as needed to operate and secure the site.
- Emails to me: as long as needed to answer, and as long as legal retention rules require.
13. Data transfers outside the EU
Cloudflare, Mailgun, Tinybird, GitHub and Stripe are or belong to companies based in the USA. Where personal data is transferred there, this relies on appropriate safeguards, in particular the EU Standard Contractual Clauses as part of the data processing agreements, or on an adequacy decision such as the EU-US Data Privacy Framework (Mailgun states that it complies with it). Mailgun and Tinybird process data for me in their EU regions.
14. Changes
If I change services or how data is processed, I update this page and the date at the top. If a change needs your consent, I ask again.