Privacy Policy and Cookie Policy
Last updated: 17 October 2026
This page explains which personal data is processed when you visit niklas-heringer.com, why, on what legal basis, and what rights you have. It also covers cookies and similar technologies. I try to keep it short and accurate: if a service is not listed here, it is not used.
1. Who is responsible
Niklas Heringer, Spreeallee 1, 67071 Ludwigshafen am Rhein, Germany
Email: [email protected]
See also the Imprint.
2. Overview
| Purpose | Data | Legal basis | Recipient |
|---|---|---|---|
| Delivering and securing this website | IP address, requested page, time, browser information | Art. 6 (1) (f) GDPR | Cloudflare, my own server |
| Member account and comments | Email address, name, comments, subscription status | Art. 6 (1) (b) GDPR | Ghost (my own server) |
| Newsletter | Email address, name, delivery events | Art. 6 (1) (a) GDPR | Mailgun |
| Visitor statistics | Visited page, referrer, browser, country, pseudonymous identifier | Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG (consent) | Tinybird |
| Contact by email | Your message and email address | Art. 6 (1) (b) and (f) GDPR | Hostinger |
| Libraries loaded from other servers | IP address | Art. 6 (1) (f) GDPR | jsDelivr, Cloudflare (cdnjs), GitHub |
3. Visiting the website (hosting and Cloudflare)
This website runs on the Ghost publishing software on a server located in Germany that I operate myself. Your requests pass through Cloudflare, which provides DNS, TLS encryption, caching, protection against abuse (for example rate limiting) and a secure connection to my server. For this, your IP address and request details are processed by Cloudflare and, for a short time, in the technical logs of my server. Simply visiting the site does not set cookies.
Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a fast, secure and available website).
4. Members, comments and newsletter
If you sign up, I store your email address, your name (if you give one), your subscription status and, if you comment, your comments. You sign in with a one-time link sent by email; no password is stored. After you sign in, a cookie keeps you signed in (see section 9).
Providing your data: Signing up and subscribing to the newsletter are voluntary. There is no statutory obligation to provide your data. Your email address is required to create and use a member account and to receive the newsletter; without it, I cannot provide these services. Your name is optional. You can read publicly accessible pages without signing up.
Legal basis: Art. 6 (1) (b) GDPR for the membership and comments, Art. 6 (1) (a) GDPR for the newsletter. You can withdraw consent at any time with the unsubscribe link in every email or in your account. You can delete your account in your account settings or by writing to me.
Email delivery: Emails (sign-in links and newsletter) are sent through Mailgun Technologies, Inc., a Sinch group company in the USA. I use Mailgun’s EU region. Mailgun processes the recipient address, the message and delivery events (such as delivery, bounces and spam complaints) on my behalf under a data processing agreement.
Newsletter statistics: Open and click tracking are disabled for newly sent newsletters. I do not add tracking pixels to measure opens or rewrite newsletter links to measure clicks. Technical delivery events are still processed to deliver emails and handle delivery problems. Newsletters sent before tracking was disabled may still contain tracking pixels or tracking links.
5. Visitor statistics (only with your consent)
I use the built-in Ghost Traffic Analytics to see which content is read. Data is sent only if you agree in the privacy notice shown on your first visit. Until you decide, and if you decline, nothing is sent. Measured data: visited page, referrer, time, browser, operating system and device type, country, and a pseudonymous identifier derived from technical request data that I cannot trace back to you. No cookies are used.
Provider: Tinybird Inc., 41 East 11th Street, 11th Floor, New York, NY 10003, USA, as processor. I use the EU region.
Legal basis: Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG (consent). You can withdraw consent at any time with the small privacy icon in the corner of the page. Withdrawal does not affect processing that happened before.
6. Contact by email
If you write to me, I process your message and address to answer you. The mailbox is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The website itself is not hosted by Hostinger.
Legal basis: Art. 6 (1) (b) GDPR (answering your request) and Art. 6 (1) (f) GDPR.
7. Memberships and payments
Memberships are currently free. This website does not offer paid memberships or process payments through Stripe. If this changes, I will update this page before introducing payment processing.
8. Libraries loaded from other servers
Fonts are hosted on this website; no fonts are loaded from Google or other font services. For some functions your browser loads files from the following providers, which receive your IP address when doing so:
- jsDelivr: Prospect One sp. z o.o., ul. Królewska 65A/1, 30-081 Kraków, Poland. Delivers JavaScript libraries and components of the Ghost software (for example sign-in, search and comments). Libraries for code highlighting, diagrams and formulas load only on pages that need them.
- cdnjs (Cloudflare): Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Hosts icons (Font Awesome) and other common libraries.
- GitHub: GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. The CV, About, Armory and Next pages load their data from a public GitHub repository.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in an efficient, working website).
9. Cookies and local storage
Visiting the website normally sets no cookies. Cookies appear only in these cases:
| Name | Set by | Purpose | Lifetime | When |
|---|---|---|---|---|
| ghost-members-ssr, ghost-members-ssr.sig | This website (Ghost) | Keeps you signed in as a member | up to about 6 months | Only after you sign in |
| cf_clearance | Cloudflare | Remembers that you passed a security check | up to 30 minutes | Only if Cloudflare shows a security check |
| _cfuvid | Cloudflare | Abuse protection (rate limiting) | Session | Only if Cloudflare sets it |
These cookies are strictly necessary for the function you request, so no consent is needed (Section 25 (2) TDDDG). Cookies for the administration area are set only for the site owner.
Local storage in your browser (not sent to a server): nh_cookie_consent stores your choice from the privacy notice with a random consent ID and a timestamp, and theme stores your light or dark mode choice. Both are needed so that the site works the way you set it up. Components of the Ghost software may keep further technical entries for sign-in and comments.
10. Your choices
- Change or withdraw your decision on visitor statistics at any time with the small privacy icon in the corner of the page.
- Unsubscribe from the newsletter with the link in every email or in your account.
- Delete or block cookies and local storage in your browser settings.
11. Your rights
Automated decisions: I do not use automated decision-making, including profiling, within the meaning of Art. 22 (1) and (4) GDPR that produces legal effects concerning you or similarly significantly affects you.
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interests (Art. 21 GDPR) and to withdraw consent at any time. To use these rights, write to [email protected]. I answer within one month.
You also have the right to complain to a data protection authority. For me this is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz). You can also contact the authority at your place of residence.
12. How long data is kept
- Member data: until you delete your account or ask me to delete it.
- Newsletter data: until you unsubscribe. Delivery logs at Mailgun are kept for a limited time.
- Technical logs: only as long as needed to operate and secure the site.
- Emails to me: as long as needed to answer, and as long as legal retention rules require.
13. Data transfers outside the EU
Cloudflare, Mailgun, Tinybird and GitHub are or belong to companies based in the USA. Where personal data is transferred there, this relies on appropriate safeguards, in particular the EU Standard Contractual Clauses as part of the data processing agreements, or on an adequacy decision such as the EU-US Data Privacy Framework (Mailgun states that it complies with it). Mailgun and Tinybird process data for me in their EU regions. The website server itself is located in Germany; this does not exclude international data transfers by the providers listed above.
14. Changes
If I change services or how data is processed, I update this page and the date at the top. If a change needs your consent, I ask again.