Privacy Policy

This English version is a convenience translation. Only the German version (Datenschutzerklärung) is legally binding.

This policy explains which personal data we process when you visit entropic.software, why, on what legal basis, and for how long.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

Louis Escher, Entropic Software (sole proprietorship, Einzelunternehmen)
Marsweilerstraße 20
88255 Baindt
Germany

Phone: +49 174 3405241
Email: [email protected]

2. Overview

You can use this website without providing any personal information. We set a single cookie, and only after you switch the website’s language (section 6). We don’t embed third-party content such as social media plugins, YouTube videos, or maps. Fonts are served from our own server.

We process personal data when you load the website (server log files), for privacy-friendly analytics with Rybbit if you consent, when you contact us through the form or by email, and when you book an appointment with us through Proton Calendar.

3. Hosting and server log files

The website runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in a Hetzner data center in Helsinki, Finland, inside the European Union, so no data is transferred to a third country. It is rendered by Astro on our own Node server. For each request, the server logs your IP address, date and time, the requested resource, the referrer, your user agent, the HTTP status code, and the number of bytes transferred.

We need this data to deliver the website and keep it secure and stable. The legal basis is Art. 6(1)(f) GDPR. Logs are deleted after 7 days, unless an entry is needed to investigate a security incident. We have a data processing agreement with Hetzner under Art. 28 GDPR.

4. Content management system

We manage content with EmDash, which runs on the same server at Hetzner in Helsinki, Finland. Only Entropic staff sign in to it. There are no visitor accounts, and EmDash processes no additional visitor data.

5. Fonts

All fonts are self-hosted. Your browser doesn’t contact Google Fonts or any other font provider.

6. Local storage in your browser and language cookie

If you use the theme toggle (light or dark) or the reduced motion toggle, or decide whether to allow analytics, your browser stores your choice in localStorage under entropic-theme, entropic-motion, and entropic-analytics (granted or denied). These localStorage values stay on your device and are never sent to our server.

The website shows its pages in the language your browser sends with each request in the Accept-Language header. If the website doesn’t offer any of those languages, it shows the English version. The server only uses the header for this choice and doesn’t store it. If you switch the language yourself with “DE” or “EN” at the top of the page, your browser sets the cookie locale with the value de or en. The cookie lasts one year for entropic.software and takes precedence over your browser’s language setting. Your browser sends it to our server with each request, and the server only reads it to decide which language to show you.

The website itself stores nothing until you use a toggle, switch the language, or make an analytics choice. The Rybbit analytics script only creates its own entry after you consent, as described in section 7.

The legal basis is § 25(2) No. 2 TDDDG, because the storage is strictly necessary to provide a display setting or language you explicitly requested and to respect your analytics choice. To delete the entries and the cookie, clear the stored site data and cookies for entropic.software in your browser settings.

7. Analytics with Rybbit

If you agree, we use Rybbit to understand how our website is used. Rybbit is an open-source, cookieless analytics tool that we host ourselves at rybbit.lou.gg on a Hetzner server in Helsinki, Finland. No data goes to an external analytics provider.

Consent and withdrawal

On your first visit, the website shows a notice at the bottom edge with two equal buttons, “Allow” and “Decline”. Until you click “Allow”, your browser doesn’t load any script from rybbit.lou.gg and no analytics take place. If you close the notice with the Escape key, that doesn’t count as a decision, and the notice appears again on your next visit.

Your browser stores your choice in localStorage under the key entropic-analytics with the value granted or denied, as described in section 6.

You can withdraw your consent at any time with effect for the future. Click “Analytics settings” in the footer of any page and choose “Decline”. The website then removes the entries rybbit-visitor-id and rybbit-user-id from localStorage and stops loading the script from the next page load on. Withdrawal doesn’t affect the lawfulness of processing before it. In the website’s terminal, the privacy command shows your current choice.

Data collected

After you consent, your browser loads a script from rybbit.lou.gg on each page view and fetches the settings for our website from there. The script sends data to rybbit.lou.gg in these cases. It sends a page view event for each page view. When you click a link to another website, it sends the target address, the link text, and the link target. When a JavaScript error occurs on our website, it sends the error type, the message (up to 500 characters), the stack trace (up to 2,000 characters), the file name, and the line and column. It doesn’t report errors from scripts of other origins. With each of these events, it also sends the page you’re on (domain and path, without URL parameters) and its title, the referrer, your screen width and height, your browser language, and a score and bitmask used to detect automated traffic (bots).

With every request, the server also receives your IP address and your browser’s user agent. Rybbit derives your country, browser, operating system, and device type from them. Rybbit doesn’t store IP addresses. To group repeat visits, Rybbit computes a pseudonymous identifier on the server. It’s a truncated SHA-256 hash of your IP address, your user agent, and a salt that changes daily. The identifier therefore changes every day. The server creates it, and your browser doesn’t store it.

Session replay, Web Vitals, feature flags, and tracking of button clicks, copying, and form input are turned off for our website. The script doesn’t respond to the Do Not Track or Global Privacy Control browser settings. It only runs after you consent.

Access to your device

Rybbit doesn’t set cookies and doesn’t use sessionStorage or IndexedDB. After you consent, the script does access your device:

• On every page load, it reads the localStorage key disable-rybbit. If the key is set, no analytics take place.
• On the first page load after you consent, it writes a random ID to localStorage under rybbit-visitor-id. On later page loads, it reads this ID. With our configuration, the script doesn’t send this ID. If you withdraw consent, the website removes the entry.
• On every page load, it reads the key rybbit-user-id. Only a feature for identifying signed-in users creates this entry, and we don’t use it.
• When it sends an event, it reads your screen and window size, the list of browser plugins, the automated-browser flag (navigator.webdriver), and the name of your graphics processor through WebGL. Only the score and bitmask listed above are sent.

Legal basis

The legal basis for the processing is your consent under Art. 6(1)(a) GDPR. The legal basis for the script storing information on your device and accessing it is your consent under § 25(1) TDDDG. Storing your choice under entropic-analytics is strictly necessary under § 25(2) No. 2 TDDDG so we can respect your decision, and it needs no consent. We only look at aggregated data and don’t build individual profiles.

Regardless of your choice on the website, you can also block the analytics technically with a content blocker that blocks requests to rybbit.lou.gg.

8. Contact form

The contact form collects your name, email address, the topic you choose, your message, and optionally your company. We use this data to handle and answer your request. The form sends it to our mailbox by email through the SMTP service of Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland, which also hosts the mailbox. Proton processes the data on our behalf under Art. 28 GDPR. We have a data processing agreement with Proton. Switzerland has an adequacy decision from the European Commission under Art. 45 GDPR, and the transfer is based on that decision. Form submissions are only delivered by email. We don’t store them in EmDash or any database.

For spam protection, the form uses a hidden honeypot field and a minimum fill time. Both checks run only in your browser and on our own server, with no third party involved.

The legal basis is Art. 6(1)(b) GDPR for requests related to a contract or its preparation, and Art. 6(1)(f) GDPR for all other requests. We delete your request once it is resolved, subject to statutory retention periods.

9. Contact by email

If you email us directly, we process your email address, your name if given, and your message. Purpose, legal basis, and retention are the same as for the contact form. The mailbox [email protected] is hosted by Proton AG in Switzerland, as described in section 8.

10. Appointment booking with Proton Calendar

The booking link leads to a Proton Calendar booking page at calendar.proton.me, provided by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland. No data reaches Proton until you click the link. When you book, we process your name, email address, the chosen time, and any notes, to schedule and prepare the appointment. The legal basis is Art. 6(1)(b) GDPR. Proton processes booking data on our behalf, as described in section 8. When you open the booking page, Proton also processes technical connection data under its own privacy policy at proton.me/legal/privacy. We delete booking data once it is no longer needed for the appointment and any follow-up, subject to statutory retention periods.

11. External links and crossfeed

The website links to other sites such as GitHub, crossfeed.live, and client websites. These are plain links with no embedded content. Once you follow one, the privacy policy of that site applies. crossfeed is a separate product, and its own privacy policy at crossfeed.live/privacy applies to it.

12. Recipients and transfers outside the EU

Only we and the service providers named in this policy receive your data: Hetzner Online GmbH for hosting and Proton AG for sending email, hosting the mailbox, and appointment booking. The website, EmDash, and Rybbit run in Helsinki, Finland, inside the EU. Email and appointment bookings are processed by Proton in Switzerland, based on the European Commission’s adequacy decision for Switzerland (Art. 45 GDPR). We don’t transfer your data to any other country outside the EU or the EEA.

13. Encryption

This website uses SSL/TLS encryption. You can recognize it by https:// and the lock icon in your browser’s address bar.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)), for analytics through “Analytics settings” in the footer. Send any request to [email protected].

Right to object: where we process your data based on Art. 6(1)(f) GDPR, such as server logs, you can object at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany
www.baden-wuerttemberg.datenschutz.de

You aren’t obliged to provide personal data, but without it we can’t answer your request or book an appointment. We don’t use automated decision-making or profiling under Art. 22 GDPR.

15. Changes

We update this policy when the website, our services, or the law change.

Last updated: 04.10.2026