What this site processes, why, on which legal basis, and the rights you have — under the GDPR and the German TDDDG.
Last updated: 21 August 2026
The controller responsible for processing on this website (hastoggle.dev) is:
Ernst Stolz
Limberger Straße 40
49080 Osnabrück
Germany
Email: eric@hastoggle.dev
This site has no accounts, no advertising, and no cross-site tracking. Most of it is static pages with running demos. What does get processed: server logs when pages are delivered, cookieless usage statistics, error reports when something breaks, an email address if you sign up for the Monday digest, and whatever you write us through the contact form. One demo sets one cookie, and it says so right next to the button. The details, legal bases and your rights follow below.
Where this policy names a legal basis, it refers to Art. 6 (1) GDPR:
For storing or reading information on your device (cookies, local storage), § 25 TDDDG applies; this site only uses storage that is strictly necessary for a function you use (§ 25 (2) TDDDG), so no consent banner is required.
This site is hosted by Vercel Inc., 650 California St, San Francisco, CA 94108, USA. When you open a page, Vercel processes the technical data every web server needs: your IP address, the requested URL, date and time, transferred data volume, referrer, and user-agent. This happens in server logs, on the legal basis of our legitimate interest (Art. 6 (1) (f) GDPR) in delivering the site securely. Server-side functions run in Vercel's Frankfurt region; static content is delivered by Vercel's global edge network. Vercel is certified under the EU–US Data Privacy Framework, and a data processing agreement is in place (vercel.com/legal/dpa).
When something on the site crashes, an error report is sent to Sentry (Functional Software, Inc., 45 Fremont Street, San Francisco, CA 94105, USA), containing the technical context of the error — which may include your IP address, user-agent, and the state of the page at the time. Our Sentry project uses EU data residency, so error data is processed within the European Union; a data processing agreement is in place. Legal basis: legitimate interest (Art. 6 (1) (f) GDPR) in finding and fixing defects. IP addresses are not used to identify visitors, and error events are retained for 90 days.
This site uses Vercel Web Analytics, which counts page views and interactions without cookies and without persistent identifiers: visitors are distinguished by a short-lived hash that cannot be traced across sites or days. No advertising IDs, no cross-site profiles. Legal basis: legitimate interest (Art. 6 (1) (f) GDPR) in knowing which pages are read.
This site sets exactly one cookie: playground-presses, an httpOnly
cookie holding the press count of the Server Actions demo — it exists
so the demo can prove a point about cookies your JavaScript cannot
read, and it is functional storage under § 25 (2) TDDDG. It expires
after one year and identifies nothing but a number.
Your theme choice (light, dark, or system) is kept in your browser's local storage, never sent to us. Fonts are self-hosted; no requests go to font CDNs.
If you sign up for the weekly email, we process your email address — nothing else — to send you the digest. Signup is double opt-in: you get a confirmation email, and only a confirmed address is ever written to the list. We store the address, the confirmation status, and its timestamps in our database, hosted in the EU (MongoDB Atlas, Frankfurt region); emails are sent through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as our processor. Legal basis: your consent (Art. 6 (1) (a) GDPR). Every digest email contains an unsubscribe link; unsubscribing is one click, and your address is then deleted from the list.
If you write to us through the contact form, we process the data you enter — name, email address, and your message — to answer you. Your message reaches us as an email, delivered through Resend to our support inbox. Legal basis: Art. 6 (1) (b) GDPR where your message concerns a contract or pre-contractual question, otherwise our legitimate interest in answering (Art. 6 (1) (f) GDPR). Messages are retained as long as the conversation requires, then deleted.
The processors named above — Vercel, Sentry, and Resend — act on our behalf under data processing agreements. Where processing touches the United States, transfers rest on the EU–US Data Privacy Framework (Vercel and Resend are certified participants) and, where applicable, EU standard contractual clauses; Sentry keeps this site's error data in the EU. We do not sell personal data, and no data is shared for advertising.
Server logs are kept for the hosting provider's technical retention period, error events for 90 days, the digest address until you unsubscribe, and contact messages for the duration of the conversation. Beyond that, personal data is deleted when the purpose it was collected for ends.
Under the GDPR you have the right to:
To exercise any of these, one email to eric@hastoggle.dev is enough.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence. The authority responsible for us is:
Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover, Germany
lfd.niedersachsen.de
This policy is updated when the site's processing changes — for example, when a new chapter of the lab genuinely needs a new mechanism. The current version always lives at this address; the date at the top says when it last moved.