Privacy notice

Controller

Website delivery and server logs

When the website is accessed, technically necessary connection data may be processed, in particular the IP address, time, requested resource, transferred data volume, referrer, browser, operating system and HTTP status. Processing serves the secure and stable delivery of the website. The legal basis is Article 6(1)(f) GDPR. The legitimate interest lies in operation, troubleshooting and protection of the website. Log data is deleted when it is no longer required for these purposes and no statutory obligation prevents deletion.

Audience measurement with Umami

This website embeds a self-hosted Umami instance at analytics.mysteryland.biz. According to the vendor, Umami does not use cookies and does not store directly identifying profile data. Page views, referrers, browser, operating system, device type and a country derived from the IP address may be processed. The analysis is used solely for anonymised audience and usage measurement. The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in improving the technical and editorial quality of the service.

Local settings

The selected appearance (light, dark or system setting) is stored in the browser’s Local Storage. This storage is necessary to restore the expressly selected setting on later visits. Access to the terminal equipment is based on Section 25(2)(2) TDDDG.

GitHub sign-in for internal functions

Sign-in is optional and intended solely for approved internal functions. A connection to GitHub is initiated only after a deliberate click. GitHub then processes the connection and account data required for OAuth under its own privacy terms. This website subsequently processes the approved GitHub username, the sign-in time and a technically necessary session. The session uses a secure HttpOnly cookie and ends after no more than eight hours or upon sign-out. The legal basis is Article 6(1)(f) GDPR; Section 25(2)(2) TDDDG applies to the technically necessary cookie.

Contact by email

If you contact the operator by email, the information you provide is processed to handle the request. The legal basis is Article 6(1)(b) GDPR for pre-contractual communication and Article 6(1)(f) GDPR in other cases. The data is deleted when the request has been completed and no retention obligation applies.

Recipients and third-party providers

Recipients may include technical hosting and infrastructure providers where necessary for operation. If the optional sign-in is used, GitHub receives the data required to perform OAuth. Further transfers take place only where technically necessary, legally required or expressly initiated.

Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. You may also lodge a complaint with a data protection supervisory authority. The authority responsible at the controller’s place of residence is, in particular, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. ldi.nrw.de

Automated decision-making

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

Last updated: 31 July 2026