Privacy

Jan Stecher
Stecher Solutions
Im Stöcklesbrunnen 2
71665 Vaihingen an der Enz
Email: info@janstecher.dev

This website works without advertising cookies, without cross-site tracking and without a cookie banner. I only process personal data as far as it is needed to run the site, for simple statistics without cookies and to answer your enquiry. The details follow in the sections below.

The website runs on Cloudflare Workers, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages and protects them against attacks. To do so, technically necessary data is processed when you visit: IP address, date and time, requested address, browser and operating system, and the country that Cloudflare derives from the IP address. The start address uses the country to send you to the German or English version as long as you have not chosen a language yourself. The country is not stored for this.

For requests that my server answers itself (the redirect to a language version, the appointment search, the enquiry form and the contribution calendar in the footer), Cloudflare writes logs containing this data, plus the interface called, the result and, for a booking, its cal.com booking ID. I only use the logs to find errors and detect abuse. They are deleted automatically after 7 days at the latest.

To keep anyone from abusing the enquiry form at scale, its interfaces accept no more than 10 requests per interface and IP address within 60 seconds. Cloudflare briefly counts the requests for this; I do not store the IP address for this purpose.

The legal basis is my legitimate interest in delivering the website securely and reliably and in protecting it against abuse (Art. 6 (1) (f) GDPR). Cloudflare processes the data on my behalf; I have concluded a data processing agreement with Cloudflare (Art. 28 GDPR). Because Cloudflare operates a global network, the data may also be processed in the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, the EU standard contractual clauses apply (Art. 46 (2) (c) GDPR). The European Commission has published their text; I will send you a copy of the version agreed with Cloudflare on request.

To see how often the pages are visited and how fast they load, I use Cloudflare Web Analytics (provider as above: Cloudflare, Inc.). For this, your browser loads a small script from static.cloudflareinsights.com. When a page loads, it reads loading times and performance values from the browser (such as Core Web Vitals and the page’s memory use) and reports them to Cloudflare together with the visited and the referring page and a random ID for this single page view. Cloudflare adds country, device type, browser and operating system. Your IP address necessarily reaches Cloudflare in the process, but according to Cloudflare it is discarded at the nearest data centre and not stored.

Cloudflare does not set any cookies for this, does not store anything in your browser and, according to Cloudflare, does not fingerprint visitors via their IP address, user agent or any other data. I only see aggregated figures and cannot identify individual visitors or recognise them across visits. Cloudflare keeps the full measurement data for 7 days and after that only a sample of about 10 percent. Cloudflare does not state a fixed deletion period for this sample.

The legal basis is my legitimate interest in knowing the reach and loading times of my website and improving them (Art. 6 (1) (f) GDPR). Since the measurement works without cookies and without recognising visitors and only delivers aggregated figures, I consider that your interests do not override mine. You can object (see “Right to object”) or block the script with a content blocker. Data processing on my behalf and the transfer to the USA are covered by the section “Hosting and delivery”.

Via “Start a project” you can send me an enquiry. I process:

• your answers in the form, such as the type and stage of the project, needs, company size, systems in use, timeframe, budget and your description or message,
• name and email address, and for enquiries on behalf of a company also the company name,
• language, time zone and the currency derived from it,
• the link through which you started the enquiry,
• a booked appointment or your preferred time for a call.

When you click “Continue” in the contact step, your enquiry is sent to me, even if you do not book an appointment afterwards. Later details such as an appointment or preferred time are added to the same enquiry.

I use this information to answer your enquiry, prepare a call and initiate a possible project. If it concerns a project with you as a potential client, the legal basis is taking steps prior to entering into a contract at your request (Art. 6 (1) (b) GDPR). If you enquire on behalf of a company or it concerns something else, such as exchange, recruiting or press, I rely on my legitimate interest in answering enquiries and maintaining business contacts (Art. 6 (1) (f) GDPR).

There is no legal or contractual obligation to provide the information. However, the form cannot be submitted without the required details of the chosen path, and without your name and email address I cannot reply to you. Instead of using the form, you can also simply send me an email.

Your browser sends the information only to my own server, not to any analytics or advertising service. From there it is transferred encrypted to my own database (Supabase, operated by myself) on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centre in Helsinki, Finland. Hetzner provides the server and processes the data on my behalf (Art. 28 GDPR). Only I handle the enquiries personally; the service providers named here process them technically on my behalf.

To prevent spam, my server checks how long it took to fill in the form and whether a field that is invisible to people was filled in. These check values are not stored in the database, and no external bot detection service is involved.

I delete enquiries automatically 12 months after receipt. If a conversation or project is still ongoing at that point, I extend the period and delete them no later than 12 months after our last contact. If the enquiry leads to an assignment, I keep the records relevant for tax purposes in accordance with § 147 of the German Fiscal Code (AO): business letters such as quotes for 6 years, invoices and other accounting records for 8 years, each from the end of the calendar year (Art. 6 (1) (c) GDPR).

If you choose an appointment in the form, my server looks up free times at cal.com and books the appointment there. The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. Your browser does not connect to cal.com. The data transferred is your name, email address, time zone, language, the chosen time and a note with your answers from the form, including the company name if given. cal.com uses this to send you the booking confirmation by email.

cal.com processes the data on my behalf; I have concluded a data processing agreement with cal.com (Art. 28 GDPR). The data is processed in the USA. Cal.com, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).

The call takes place via Google Meet. cal.com creates the link through my Google Calendar, where the appointment is entered with your name, email address and the note. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you join the call, Google processes technically necessary data such as your IP address and device data, as well as video and audio for as long as you enable your camera and microphone. Data may be transferred to Google LLC in the USA in the process. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

The legal basis is the same as for the enquiry. I delete appointments at cal.com and in my calendar according to the same periods as the enquiry.

If you write to me at info@janstecher.dev, I process your email address, your name and the content of your message in order to reply. The legal basis is the same as for enquiries via the form.

My mailbox is hosted by iCloud Mail of Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple may also transfer data to Apple Inc. in the USA, according to Apple on the basis of the EU standard contractual clauses (Art. 46 (2) (c) GDPR). Apple explains how to obtain a copy in its privacy policy. Emails are deleted according to the same periods as enquiries via the form.

The site sets only one cookie, and only if you switch the language yourself: “jan-lang” remembers your choice for one year. Your browser sends it along when you visit this website, so that the start address greets you in your language.

In addition, the site uses your browser’s sessionStorage, which is cleared when you close the tab. It holds:

• whether the intro has already played in this session, so that it does not play again when you return to the home page,
• where on the home page or the blog list you return to,
• the link through which you opened “Start a project” and where the back link leads,
• in the “Start a project” form, your progress so far: answers, contact details, suggested times and booking status, when you started filling in the form and the spam check values, as well as technical IDs that allow my server to match and update your enquiry (valid for 30 minutes and 24 hours respectively). This way nothing is lost if you reload the page. If you leave the form via the back link after completing it, the form clears this data.

The cookie and sessionStorage serve functions you use yourself (language choice, returning to where you were, continuing the form) and are strictly necessary for them (§ 25 (2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). The information you enter in the form is covered by the same legal basis as the enquiry.

Fonts, scripts, images and videos are served from this website’s own server. There is no connection to Google Fonts, CDNs or embedded third-party content. The only exception is the measurement script of Cloudflare Web Analytics (see “Analytics”).

My server fetches the GitHub contribution calendar in the footer from GitHub and caches it at Cloudflare. Your browser only loads it from my server. No data about you is transferred to GitHub.

The site links to other services, such as GitHub, LinkedIn or X, and after a booking offers links to add the appointment to Google Calendar or Outlook. Only when you click such a link does your browser connect to the respective provider. With the calendar links, it passes the appointment details, including the note with your answers, to Google or Microsoft. You trigger this transfer yourself; the provider then processes the data under its own responsibility. The .ics file is created by your browser itself; nothing is transferred for it.

Personal data is only received by the service providers named above: Cloudflare (hosting and analytics), Hetzner (database server), cal.com (appointments), Google (video call and calendar) and Apple (email). If you use the calendar links after a booking, your browser also passes the appointment details to Google or Microsoft. Beyond that, I only pass on data if I am legally obliged to. I do not sell data. There is no automated decision-making or profiling.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Just write to me at info@janstecher.dev. You can also lodge a complaint with a data protection supervisory authority (Art. 77), for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Where I process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object to this at any time on grounds relating to your particular situation (Art. 21 (1) GDPR). I will then no longer process the data unless I can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal message to info@janstecher.dev is enough.

October 2026 (draft)