Privacy Policy

The controller under Art. 4 No. 7 GDPR is the publisher named in the legal notice. We have not appointed a data protection officer, as we are not required to.

The site, its database and its image cache run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which processes data on our behalf under a data processing agreement (Art. 28 GDPR). Data does not leave the EU for hosting.

When you open a page, your browser sends technical data the server needs to deliver it: IP address, date and time, the page requested, the referring page, and browser and operating system (user agent). The web server writes this to an access log to run the site and to detect and fend off attacks. Logs are kept only as long as needed for that and are then deleted.

Legal basis: Art. 6 (1) (f) GDPR – our interest in a working, secure website.

We count page views ourselves, on our own server, and publish the totals on Analytics. No cookie is set and nothing is stored in your browser. When a page loads, your browser sends us the page’s path, the page that linked to it, your device’s time zone and the window width. We keep: the path, the day, the linking website (domain only), a country derived from the time zone, the device class (phone, tablet, desktop), and the browser and operating system family.

To count unique visitors per day we compute a hash of your IP address and user agent together with a random value that exists only in the server’s memory and is replaced every day. Neither the IP address nor the user agent nor that random value is stored, so the hash cannot be traced back to you and visits on different days cannot be linked. If your browser sends Do Not Track or Global Privacy Control, the page view is not counted.

Legal basis: Art. 6 (1) (f) GDPR – our interest in knowing, in aggregate, how the site is used. Because nothing is stored on or read from your device beyond what is needed to deliver the page, no consent is required under § 25 TDDDG. The stored rows contain no personal data.

• No third-party analytics, no tracking pixels, no advertising networks, no cross-site or long-term fingerprinting.
• No accounts. The only time we ask for your email address is when you sign up for the newsletter yourself.
• No tracking in our mails: no pixels, no redirected links – we don’t know who opens or clicks what.
• Fonts are served from our own server. Story pictures, publisher logos, podcast covers and video thumbnails are fetched once by our server and delivered from our cache, so loading them does not contact the publishers.

If you sign up for the morning mail, we store your email address, the time of sign-up, the version of the consent wording you agreed to and – once you click the link in the confirmation mail – the time of confirmation (double opt-in). Nothing is sent before you confirm; unconfirmed addresses are deleted after 30 days. For every issue we note whether it was delivered to you, so no one gets it twice.

Mails are delivered by a mail delivery service, which processes the address on our behalf under a data processing agreement (Art. 28 GDPR). Open and click tracking is switched off: the mails contain no tracking pixels and no redirected links.

You can unsubscribe at any time with the link at the bottom of every mail or your mail app’s unsubscribe button. We then keep the address only marked as unsubscribed, to prove the consent you once gave and that you withdrew it; write to themorningdev@entwicklerstube.com to have it deleted completely.

Legal basis: Art. 6 (1) (a) GDPR – your consent, which you can withdraw at any time (Art. 7 (3) GDPR).

You can comment on a story without signing up. We store the name you enter (it can be any name – leaving it empty posts as “Anonymous”), your text and the time. Comments are public on the story page. To slow down spam, the server remembers the IP address of the last comment for a few seconds in memory; it is not written to the database. Please don’t put personal details in a comment that you don’t want published.

Reactions (the emoji under a story) are counted anonymously. So that you can’t vote twice and can take a reaction back, your browser keeps a cookie named r_… per story that lists your emoji. It contains nothing else and expires after 90 days.

Legal basis: Art. 6 (1) (b) and (f) GDPR for comments; the reaction cookie is strictly necessary for the function you use (§ 25 (2) No. 2 TDDDG). Comments stay online as long as the story; ask us and we remove yours.

If you switch between light and dark mode, the choice is saved in your browser’s local storage under theme. It never leaves your device and you can delete it with your browser’s site data.

Legal basis: § 25 (2) No. 2 TDDDG – needed to remember a setting you made.

The front page and the Watch pages embed videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the privacy-enhanced mode (youtube-nocookie.com). Still, as soon as a page with a video loads, your browser connects to Google’s servers and transmits at least your IP address and the page you are on; Google may store information in your browser and may process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework. Details are in Google’s privacy policy.

Legal basis: Art. 6 (1) (f) GDPR – our interest in showing science videos alongside the news.

Podcast episodes play directly from the podcast’s own host, and only after you press play. That host then receives your IP address and browser data like any other website you visit.

“Read the full story” opens the publisher’s article. Where the publisher allows it, the page is shown in a frame here, which means your browser loads it from the publisher; otherwise our server fetches the article and shows a reader version without contacting the publisher from your browser. The publisher’s own privacy policy applies to their page.

Briefings, scores and community summaries are produced with Claude, an AI model by Anthropic. What we send is public: news articles and, for some stories, public comments from Hacker News including the commenters’ usernames. Nothing about readers of this site – no IP addresses, no comments posted here, no cookies – is sent. How AI is used editorially is described on About & Editorial Policy.

Legal basis: Art. 6 (1) (f) GDPR – summarising public discussion of the news we report.

If you write to us, we use your email address and message only to answer and delete them once the matter is settled, unless we have to keep them by law.

Legal basis: Art. 6 (1) (b) or (f) GDPR.

You have the right to

• access the data we hold about you (Art. 15 GDPR),
• have it corrected (Art. 16) or erased (Art. 17),
• restrict its processing (Art. 18) and receive it in a portable format (Art. 20),
• object at any time to processing based on Art. 6 (1) (f) GDPR, on grounds relating to your particular situation (Art. 21),
• withdraw any consent you gave, with effect for the future (Art. 7 (3)).

Write to themorningdev@entwicklerstube.com.

You can also complain to a data protection authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, lda.bayern.de.