Privacy policy

Last updated: October 2026

Controller

In short

This website sets no cookies and embeds no third-party advertising, social media or analytics services. For simple visitor statistics and to protect against attacks, requests are evaluated on my own server. Full IP addresses are stored for at most 30 days. Data is never sold and is only shared with my hosting provider acting as a processor.

Hosting

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. Hetzner processes the data solely on my behalf under a data processing agreement (Art. 28 GDPR).

Server log files

For every request the web server logs technically necessary data: IP address, date and time, requested address, status code, amount of data transferred, the previously visited page (referrer) and browser and operating system (user agent). This keeps the site secure and stable, for example to detect attacks and fix errors. The legal basis is my legitimate interest (Art. 6 (1) (f) GDPR). Log files are deleted automatically after 14 days at the latest.

Visitor statistics

To see which pages are visited how often and through which channels (e.g. a link on Instagram) visitors arrive, and to detect automated requests (bots, scanners), I use self-hosted analytics on my own servers:

Access log: time, requested page, channel, referrer, user agent, the browser's preferred language (Accept-Language) and IP address are stored in a database. The approximate country, region and city are derived from the IP address directly on my server using a locally stored database (DB-IP) and stored as well — the IP address is not sent to any third party for this. Each page also sends a short request without any further data when it loads, which marks the visit as a real browser. After 30 days the IP address is truncated (the last byte for IPv4, everything after the first 48 bits for IPv6) so that it can no longer be attributed to an individual connection.

Page view counting via api.burazer.at: a small script reports the requested page and the previously visited page. Only browser, operating system and device type are derived from the user agent. To count the visitors of a day, a hash of IP address and user agent is computed with a random key that changes daily. The IP address itself is not stored, and the hash can neither be traced back to it nor linked across days.

Nothing is stored on or read from your device for this. The legal basis is my legitimate interest in measuring reach and protecting the website (Art. 6 (1) (f) GDPR). You may object to this processing at any time.

Fonts

All fonts are served directly from this server. Loading the page does not connect to Google or any other font provider.

Language and colour scheme

Your choice of language and light or dark colour scheme is kept in your browser's local storage (localStorage, entries “piy-lang” and “piy-theme”; on the instructions page additionally “piy-anl-lang” and “piy-anl-color” for language and puzzle colour) so the page looks the same on your next visit. These entries never leave your device and are strictly necessary for the function you requested (§ 165 (3) of the Austrian Telecommunications Act 2021). You can delete them at any time in your browser settings.

Buying on Etsy and links to social networks

This website links to Etsy, Instagram, Pinterest and TikTok. These are plain links: only when you click one are you taken to the respective provider. Orders are handled exclusively through Etsy, and Etsy's privacy policy applies to the data processed there.

Contact by e-mail

If you e-mail me, I process your address and message to answer your enquiry (Art. 6 (1) (b) or (f) GDPR). The data is deleted once it is no longer needed for that purpose and no statutory retention obligations apply.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). An informal e-mail to office@puzzleityourself.com is enough.

If you believe the processing of your data violates data protection law, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

This translation is provided for convenience; the German version is authoritative.