Privacy Policy
Last updated: October 21, 2026
Who is responsible
This is the private website of Leon Dror Heuser. For anything about your data, write to dror@dror.de.
In short
This site sets no cookies, shows no ads and embeds no fonts, images or scripts from other companies, apart from the services named below. You need to send the technical connection data to see the site at all; the statistics are not needed for that, and writing to me is voluntary.
Hosting: Cloudflare
The site is delivered by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page, your browser sends the usual technical data: your IP address, the page you asked for, the time, your browser's user agent and the page you came from. Cloudflare needs this to deliver the site and to protect it against attacks, and processes it on my behalf under its data processing agreement. It keeps the data only as long as it needs it for that, as described in Cloudflare's privacy policy.
Cloudflare may process data outside the EU, including in the USA. It is certified under the EU–U.S. Data Privacy Framework, so transfers to the USA rest on the European Commission's adequacy decision (Art. 45 GDPR).
Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in delivering the site reliably and securely.
Visitor statistics: Umami
To see how many people visit and which pages they read, I run Umami, an open-source analytics tool, on my own server at Hetzner Online GmbH in Germany; requests to it also pass through Cloudflare. Umami uses no cookies. It records the page address (including any query parameters) and title, the site you came from, your browser, operating system, device type, screen size and language, and your approximate location (country, region, city) as supplied by Cloudflare.
To count visitors, Umami creates a pseudonymous visitor ID from your IP address and browser identifier, combined with a secret key and a value that changes every month. Visits with the same ID are grouped within that month; the next month the ID is different. Your IP address is used to create the ID but is not stored in Umami's database. The statistics are kept without a fixed deletion date.
Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in knowing how the site is read. You can object at any time (see below); blocking umami.dror.de in your browser or with a content blocker works too.
Cloudflare Web Analytics
Cloudflare also loads a small script that measures page views and performance, such as loading times. Its reports show the page address, the site you came from, country, browser, operating system and device type. According to Cloudflare, the script uses no cookies or other storage in your browser and doesn't identify individual visitors by IP address or user agent; it keeps the full, unsampled measurements for 7 days. Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in seeing how the site is used and spotting performance problems.
If you write to me, I use your address and message only to reply, and delete them once they're no longer needed. Mail for dror.de is hosted in Germany by ALL-INKL.COM – Neue Medien Münnich. Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in answering messages; where the processing is needed for a contract with you or for steps you ask for before one, Art. 6(1)(b) GDPR.
Links to other sites
The links to GitHub, X and LinkedIn are plain links: this page embeds no content or tracking scripts from those services. Once you follow a link, their own privacy policies apply.
Your rights
You can ask me which of your data I have (Art. 15 GDPR) and have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18). Where the legal conditions apply, you can also receive data you gave me in a common machine-readable format (Art. 20).
You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21 GDPR).
For all of this, write to dror@dror.de. You can also complain to a data protection supervisory authority, for example the one in the EU country where you live (Art. 77 GDPR).