Skip to content

Privacy Policy

As of: 24 October 2026.

1. Controller

Petrit Isufi
Paradestr. 50
42107 Wuppertal, Germany
E-Mail: mail@petrit.dev

2. Hosting

This website is hosted on a virtual server at Hetzner:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen, Germany

The server sits in the Helsinki, Finland data centre, inside the EU. Hosting involves no transfer of personal data to a third country. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in operating this website reliably. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

On each request, the web server (Caddy) automatically logs:

The current log file is closed at 100 MB. Closed files are deleted after 30 days, and at most five are kept. Entries can therefore be stored for longer than 30 days.

3. Attack protection (CrowdSec)

The server runs the security software CrowdSec. It analyses the server log files from section 2 for attack patterns, such as many requests for non-existent addresses or attempts to exploit known vulnerabilities. If an IP address triggers such a pattern, the server’s firewall blocks it for four hours, and CrowdSec reports it to the CrowdSec central service. IP addresses on the blocklist that CrowdSec compiles from such reports by other servers are blocked as well.

A report contains the IP address with location details where available, the name of the pattern, the time and an identifier of this server. It contains no other data from the log files, such as requested addresses or browser details. The recipient is CrowdSec, 20 rue Maurice Arnoux, 92120 Montrouge, France. According to CrowdSec, it keeps the full IP address for at most three months, in individual cases up to one year, and only in coarsened form after that. Where CrowdSec passes data to recipients outside the EU, it says it does so on the basis of the European Commission’s standard contractual clauses.

On the server, CrowdSec deletes detections from its database after seven days at most. Detections and blocks are also written, with the IP address, to CrowdSec’s own log file, which is rotated by size only; these entries can therefore be several months old. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in protecting the server and this website from attacks.

4. Domain & DNS

The domain petrit.dev is registered with the US-based registrar Namecheap, Inc. (4600 East Washington Street, Suite 305, Phoenix, AZ 85034, USA). DNS lookups for the domain are answered by Namecheap’s nameservers. They are usually sent not by your device but by the DNS resolver of your internet provider or one you chose, so Namecheap sees the resolver’s IP address. Some resolvers also pass on a truncated part of your IP address (EDNS Client Subnet, for IPv4 usually the first three blocks); Namecheap’s nameservers accept it. Legal basis: Art. 6(1)(f) GDPR.

5. Analytics

I measure traffic to this website using a self-hosted script. It is loaded from petrit.dev/m-20261024.js and sends data to /m/c on the same domain, where my analytics service receives it. For each page view, I store:

What I do not collect for analytics: no cookies and no identifier that lasts longer than a day. The script reads neither the screen size nor the browser’s User-Agent string on your device; the server gets the User-Agent from the request header. Your IP address is not stored on the analytics endpoint, not even in the web server’s log file. From your IP address and User-Agent string, the server derives the daily identifier: an HMAC-SHA256 with a random key, truncated to 16 characters. The key exists only in the server’s memory. A new random key applies to each calendar day (UTC). The service deletes the previous day’s key as soon as the first request of the new day arrives. The service runs two processes; a process that receives no request on a given day keeps the previous day’s key in memory until it handles its next request. The identifier links page views from the same day to one visitor, but not views from different days. Once the key is deleted everywhere, the identifier can no longer be traced to an IP address. It is a pseudonym, not an anonymous value.

Legal basis of the processing: Art. 6(1)(f) GDPR (legitimate interest in cookie-less reach analysis without personal profiles). The script accesses your device only to read the opt-out entry and, when you request it, to set or remove it (Section 25(2) no. 2 TDDDG).

Opting out: You can turn off analytics for this browser. This stores the entry za_optout in the browser’s localStorage. It applies immediately, even to the page that has the parameter in its address. The script then sends no analytics data any more; it reads the entry before every send. If browser storage is blocked, the script sends nothing. The server logs described in section 2 keep running. You can also turn analytics back on; this removes the entry. Both also work on any other page of this website with ?za_optout=1 or ?za_optout=0 appended. The entry applies to this website in this browser profile; if you clear the site data, you clear the entry with it.

A hidden easter egg also keeps its progress in the tab’s sessionStorage; that entry stays in your browser and is gone when you close the tab. The site stores nothing else in your browser.

Retention: stored page views are deleted automatically after 24 months in the analytics service’s database. Backups keep entries longer. The server and my computer at home each hold one current copy of the database, which is overwritten on every sync. Earlier states are kept by daily backups: on my computer at home seven daily, four weekly and three monthly snapshots, the oldest kept for at most three months; externally at Hetzner (Storage Box), from the server and from my computer, 14 daily, eight weekly and twelve monthly snapshots, the oldest kept for at most twelve months. Entries that have already been deleted can remain there until the relevant snapshot expires.

6. External fonts

Fonts are loaded from this site only. There are no calls to Google Fonts or comparable external services.

7. Email contact

If you send an email to mail@petrit.dev, your information is stored for the purpose of handling your request. The mailbox is part of the web hosting package at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany); the mail servers are located in Germany. Legal basis: Art. 6(1)(b)/(f) GDPR. Data is deleted after the request is closed, unless statutory retention requirements apply.

8. Your rights

You have the right to, at any time:

To exercise your rights, an email to mail@petrit.dev is sufficient.

9. Right to lodge a complaint

You may lodge a complaint with a data-protection supervisory authority. The competent authority for this site is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44, 40102 Düsseldorf, Germany
www.ldi.nrw.de