privacy_

Last updated: October 12, 2026

This page explains what aocn.dev does with your data and what rights you have under the GDPR. The short version: your email address is stored only if you ask for door emails, and there are no cookies and no tracking. Visits are counted, but not who made them.

who is responsible

Katharina Sick, Linz, Austria. aocn.dev is a personal project. For questions, requests or to have your data deleted, write to adventofcloudnative@protonmail.com.

door emails

If you sign up for door emails:

• What is stored: your email address, when you signed up and when you confirmed.
• Why: to send you one email whenever a door opens. Nothing else, and never to anyone else.
• Legal basis: your consent (Art. 6(1)(a) GDPR). Signing up only sends a confirmation email; you are on the list once you click the link in it.
• Abuse protection: so that nobody can flood an inbox with confirmation emails, a keyed hash of the address (not the address itself) is kept for 24 hours, and requests are counted per IP address in memory. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

visiting the site

• No cookies and no tracking. Fonts and scripts come from aocn.dev itself.
• Visit counts: each page tells counter.dev that it was opened. When you arrive from another site, counter.dev also receives that site's address, and works out your country, browser, device type, operating system and language from the request. It keeps totals per day, plus a list of the last 30 visits (time, country, the site you came from, device type and operating system), never your IP address. Nothing is stored in or read from your browser for this. Legal basis: our legitimate interest in knowing how many people the calendar reaches (Art. 6(1)(f) GDPR).
• Your browser remembers whether you switched the vim keys off. That setting never leaves your browser.
• The hosting providers log requests, including your IP address, to run and protect the service. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

who processes your data

• Resend sends the emails and keeps the list of subscribers.
• Neon hosts the database with the signup records, on servers in Frankfurt, Germany.
• Google Cloud runs the API, on servers in Belgium.
• Netlify hosts the website.

Each name links to that provider's own privacy policy. Each of them processes data only on our behalf, under a data processing agreement. All four are US companies, so data may be transferred to the USA; those transfers are covered by the EU-US Data Privacy Framework or the EU's standard contractual clauses.

counter.dev counts visits, without cookies. It is run from Germany, on servers at Linode in Frankfurt, behind Cloudflare.

how long it is kept

• The hash for abuse protection: 24 hours.
• Your email address and the record of your confirmation: until you ask for them to be deleted, and at the latest until January 31, 2027, when the whole list is deleted after the calendar's last emails.
• Request logs: as long as the hosting providers keep them, for Google Cloud 30 days.
• Daily visit totals: as long as counter.dev keeps them, which is indefinitely. The list of recent visits only ever holds the last 30.

your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to its processing, and get it in a machine-readable form. You can withdraw your consent to door emails at any time: write to adventofcloudnative@protonmail.com, or use the unsubscribe link in any door email. Withdrawing does not make earlier emails unlawful.

If you think your data is processed unlawfully, you can complain to a data protection authority: in Austria the Datenschutzbehörde, or the one in your country. Reaching out first is usually quicker.

changes

When the site starts doing more with data, for example once logins arrive, this page changes first, and the date at the top with it.