# Privacy

> What this site collects and why: hosting logs, Cloudflare Web Analytics, PostHog, one referral cookie, and the newsletter. Plus your GDPR rights.

This is a personal blog. It sells nothing, runs no ads, and has no user accounts. The sections below list every place where it touches your data, and what you can do about it. Questions and requests go to
[hello@lukasvonkunhardt.com](mailto:hello@lukasvonkunhardt.com).

## Who is responsible

Lukas von Kunhardt, Berlin, Germany, is the controller for the data described here. Full name, postal address and legal details are in the
[Impressum](https://lukasvonkunhardt.com/impressum/). Contact: [hello@lukasvonkunhardt.com](mailto:hello@lukasvonkunhardt.com).

## Hosting and delivery

The site is a set of static files on a server in Germany, rented from Hetzner
Online GmbH. [Cloudflare](https://www.cloudflare.com/privacypolicy/) sits in front of it as a CDN and terminates TLS, so Cloudflare processes the IP address of every request. The web server writes an access log — timestamp, path, status, referrer, user agent, IP address — which I use to debug problems and to count clicks that arrive from the newsletter.

## Analytics

Two analytics tools run on the page, both configured to collect as little as
possible:

- **Cloudflare Web Analytics.** Aggregate page views and referrers. It sets no cookies and does not fingerprint visitors.
- **PostHog**, on its EU servers. Page views and page exits only. Session
  recording is off, autocapture is off, and no profile is created for an
  anonymous visitor. PostHog sets cookies to recognise a returning browser.

## Cookies

The site sets one cookie of its own, `newsletter_ref`, and only when you arrive through a link in the newsletter that carries a `?r=` referral code. It stores that code for seven days so a signup can be credited to the reader who forwarded the mail. PostHog sets its own analytics cookies as described above. There are no advertising cookies and no third-party trackers beyond the two tools named here.

## Newsletter

Signing up stores your email address, a random token for the confirm and
unsubscribe links, the page the form was on, and the timestamps. Nothing else, no IP address, no name. Confirmation is double opt-in: you get one mail with a confirm link, and you receive nothing further until you click it. Every mail carries an unsubscribe link that works in one click. Delivery runs through [Resend](https://resend.com/legal/privacy-policy). Unsubscribing keeps the row
marked as unsubscribed so that a later re-subscribe stays clean; write to me if you want the record deleted instead.

## Your rights

Under the GDPR you can ask for access to your data, correction, deletion,
restriction of processing, portability, and you can object to processing. Mail [hello@lukasvonkunhardt.com](mailto:hello@lukasvonkunhardt.com) and I will answer.
You can also complain to a supervisory authority; for Berlin that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

## Changes

This page changes when the site does. The date of the last change to its text is in the [sitemap](https://lukasvonkunhardt.com/sitemap-index.xml) and in the page's structured data.

---

Source: https://lukasvonkunhardt.com/privacy/ · Author: Lukas von Kunhardt · Updated: 2026-08-23