Privacy policy

Last updated: 10 November 2026

Who is responsible

Anselm Hannemann, WDRL c/o Anselm Hannemann Web Development, Hofmark 14, 82393 Iffeldorf, Germany. Email: mail@wdrl.info. The legal notice has the full details.

The short version

No analytics, no advertising trackers, no tracking pixels, no social media buttons.
No cookies for visitors. The theme choice (light or dark) is saved in your browser's local storage on your device only. It never reaches the server and holds no personal data.
The site's fonts are hosted on this site. The only third-party resource is the Cloudflare Turnstile spam check on the newsletter sign-up form (see below).
If you subscribe to the newsletter, your address is stored by the newsletter service Mailcoach with your consent wording. I do not store your IP address; it is only used as a short-lived, non-reversible, salted hash against abuse.

Hosting and server logs

The site runs on a server of Uberspace, Kaiserstr. 15, 55116 Mainz, in a datacenter in Germany.

When you visit a page, the web server logs the technical data of the request: your IP address in shortened form (for IPv4 addresses only the first 16 bits are logged, for IPv6 addresses only the first 32 bits; the rest is set to zero, so the log cannot identify your connection), the time, the requested address, the response status, the amount of data and the browser information (user agent) and referrer your browser sends. I use it only to keep the site available and secure and to find errors. I do not analyse it for behaviour and I do not link it to other data.

Legal basis: Art. 6 (1) (f) GDPR, my legitimate interest in a secure and stable site. Logs are deleted after 7 days of retention.

The connection is encrypted with HTTPS. A strict Content Security Policy limits what a page can load or run.

Cookies and local storage

Visitors: no cookies. The light/dark choice is stored in your browser's local storage under the key wdrl-theme, together with the time of the choice, and is dropped after three hours. This is a function you asked for, it stays on your device and needs no consent.

Spam check: see "Cloudflare Turnstile" below.

You can get the Web Development Reading List by email, about every two weeks. The newsletter service is Mailcoach Cloud by Spatie (Belgium), my processor, on infrastructure in the EU/EEA.

How signing up works (double opt-in).

You enter your email address in the form. Next to the button you see the wording that you consent to.

This website passes your address to Mailcoach together with that wording, which creates the subscriber as not yet confirmed. Mailcoach sends you a confirmation email. Only when you click the link in that email are you subscribed. Without the click your data gets deleted after a short retention time.

What is stored. Mailcoach stores your email address, the status of your subscription, the times of the sign-up and of the confirmation and of an unsubscribe, and the data the list needs to send the newsletter. Along with the address, this website sends Mailcoach the exact consent wording you saw, its version, the address of the form and the time of the sign-up, so that it is documented what you agreed to. Apart from the server logs described above, this website itself stores nothing about your sign-up and no IP address.

Abuse protection without storing your IP address. To stop bots from using the form, the website briefly counts requests. For that it keeps a salted hash of your IP address (not the address itself) for at most 10 minutes, and a salted hash of the email address you enter for at most one day, so that nobody can flood a stranger's inbox with confirmation mails. These hashes cannot be turned back into the address and are deleted automatically. There are also sitewide counters without any personal data. Logs contain counts only.

Legal basis for the newsletter: your consent, Art. 6 (1) (a) GDPR. Legal basis for the abuse protection: Art. 6 (1) (f) GDPR, my legitimate interest in keeping the form and the list free of abuse.

Retention. Your address stays on the list while you are subscribed. You can ask me to delete it, of course. If you unsubscribe, your data is kept for some time to document the decision.

Sending. The newsletter is sent by Mailcoach. Every email has an unsubscribe link that works with one click.

Spam protection with Cloudflare Turnstile

The sign-up form uses Cloudflare Turnstile to tell people from bots. Turnstile is provided by Cloudflare, Inc. (USA). When a page with the sign-up form is shown, your browser loads a script from challenges.cloudflare.com and Cloudflare therefore receives your IP address and technical data about your browser and its behaviour on the page, in order to decide whether you are a human. Cloudflare gives me only the result (passed or not). I do not send your email address to Cloudflare, and I do not pass your IP address on from my server.

Legal basis: Art. 6 (1) (f) GDPR, my legitimate interest in protecting the form from automated abuse. Transfer to the USA: Cloudflare is certified under the EU-US Data Privacy Framework. More in Cloudflare's privacy policy.

Turnstile needs JavaScript. If you cannot use it, write to mail@wdrl.info and I add you by hand with the same confirmation.

Webmentions

The site can receive and send Webmentions. When another website links to a page here and notifies this site, the server fetches that page to check that the link really exists. This contacts the other site from my server, which shows it my server's address. If the check passes, I store the address of the mentioning page, the type of mention (link, reply, like and so on), the author name and the author's website or profile address as published on that page, the publication date and a short excerpt of the mention text. I do not store profile pictures. Mentions can be shown under the page they refer to.

Legal basis: Art. 6 (1) (f) GDPR. To have a mention removed, write to me with the address of the mention. When I publish a page that links to other websites, my server also notifies those sites.

GitHub Sponsors

You can support WDRL through GitHub Sponsors, a service of GitHub, Inc. (USA). The payment is handled entirely by GitHub; I never see your payment details. GitHub tells me who sponsors me, and this website fetches that from GitHub's interface about twice a day: your GitHub username, your name and profile picture as shown on your GitHub profile, the address of your profile, whether you sponsor monthly or once, your tier and amount, whether your sponsorship is public or private, and the history of your sponsorship (start, tier changes, cancellation, refunds) with the total you have given. I store this on my server to keep track of contributions and to thank sponsors. Your profile picture is copied to my server only while you are shown as a supporter (see below), so showing it does not load anything from GitHub, and it is deleted again when you are no longer shown.

Being shown in editions. If you sponsor monthly with a public sponsorship, I may show your name, your username and your profile picture as a supporter in the newsletter and in the archived edition on this website. Nobody is shown automatically: I decide for each sponsor, and you are only shown while your monthly sponsorship is active. An edition keeps the supporters it showed when it was sent, also after a sponsorship ends. If you chose a private sponsorship on GitHub, you are never shown anywhere. The list of sponsors on this website is not publicly accessible.

Legal basis: Art. 6 (1) (b) GDPR for keeping track of your sponsorship, and Art. 6 (1) (f) GDPR, my legitimate interest in thanking supporters publicly, for showing a public sponsor [TO VERIFY]. You can object at any time: write to mail@wdrl.info and I stop showing you in new editions and remove you from archived editions on this website. Emails that were already sent cannot be changed. I keep the data of former sponsors for as long as they are shown in archived editions and as tax and accounting rules require [TO VERIFY: retention period].

Contact

There is no contact form. If you write to mail@wdrl.info, I use your address and message only to answer you and delete them when the matter is done, unless a legal duty requires me to keep them.

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw your consent to the newsletter at any time with the unsubscribe link, with effect for the future.

Write to mail@wdrl.info. On request I send you the data I hold about you, which is usually just your email address with its subscription data in Mailcoach.

You also have the right to complain to a data protection supervisory authority. For me that is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de. You can also contact the authority of your own country or residence.

Changes

If the site changes what it does with data, this page changes with it and the date at the top is updated. The version of the newsletter consent text is stored with every sign-up.