Privacy Policy

1. Overview #

This website is a private, non-commercial blog. I do not show ads, sell anything or set cookies. Personal data is only processed where this is necessary to operate the website and to produce aggregated visitor statistics, or when you actively load the comment section. Below I explain what data is involved, who receives it and what rights you have.

2. Controller #

Emily Buchner
Am Gut Vogelsang 3
46499 Hamminkeln
Germany
Email: emily@samily.it

No data protection officer has been appointed; none is legally required.

3. Hosting via GitHub Pages #

This website is served via GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, using a worldwide content delivery network. Whenever you request a page, your IP address is transmitted to GitHub, because your browser could not load the content otherwise.

The legal basis is my legitimate interest in a secure, free-of-charge provision of the website (Art. 6(1)(f) GDPR).

GitHub also processes data in the USA. GitHub participates in the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

More information: GitHub General Privacy Statement

4. Server log files #

According to its documentation, GitHub logs the IP address of visitors for security purposes. Technically, this usually also includes date and time, the requested page, browser and operating system details (user agent) and the referring page. I have no access to these log files and do not analyse them.

The legal basis is Art. 6(1)(f) GDPR (security and stability). The retention period is determined by GitHub.

5. Visitor statistics with Umami #

To see which posts are read and how often, I use Umami Cloud, a service of Umami Software, Inc. Umami does not set cookies and does not create cross-site user profiles.

When you open a page, your browser loads the Umami script from cloud.umami.is and sends the following to Umami: the page address (without parameters and anchors), the page title, the referring page, screen size, browser language, browser and operating system type, and your IP address. Umami derives country and region from the IP address. Together with the browser identifier and a regularly rotating random value, it creates a pseudonymous session identifier. According to Umami, the IP address itself is not stored. I only see aggregated statistics and do not attempt to identify you.

The legal basis is my legitimate interest in evaluating the use of my blog in aggregated form and improving it (Art. 6(1)(f) GDPR). The statistics data is stored by Umami Cloud in its EU data region.

If your browser sends the “Do Not Track” signal, the Umami script is not loaded at all and no data is sent to Umami. The same applies if you object to the statistics for this browser here. Your choice is stored in your browser’s local storage (key “umami.disabled”) and never leaves your device:

6. Comments with Giscus and GitHub #

You can comment on blog posts via Giscus. Comments are stored as public posts in GitHub Discussions of the repository ItsMly/itsmly.github.io.

Two-click solution: Comments are only loaded after you click “Load comments”. Before that, no connection to Giscus or GitHub is made. After the click, your browser loads content from giscus.app (run by the open-source project Giscus) and from GitHub, such as profile pictures. Your IP address, browser details and the address of the current page are transmitted.

Commenting: To comment or react, you sign in with your GitHub account. Giscus stores a sign-in token in your browser’s local storage (key “giscus-session”) so you stay signed in. Your comment, GitHub username and profile picture will then be publicly visible on this website and on GitHub. GitHub’s privacy statement applies to your GitHub account.

The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR). Storing the sign-in token is strictly necessary for the function you requested (Sec. 25(2) no. 2 TDDDG). GitHub participates in the EU-U.S. Data Privacy Framework. I have no safeguards under Art. 44 et seq. GDPR for giscus.app; to that extent, any transfer to the USA is based on your explicit consent (Art. 49(1)(a) GDPR). This may involve risks, such as access by US authorities. You can withdraw your consent at any time with effect for the future by no longer loading the comments and signing out of Giscus.

Comments remain until you delete them on GitHub or I remove them. Signing out deletes the token from your browser. I moderate comments and remove unlawful content.

More information: Giscus Privacy Policy, GitHub General Privacy Statement

7. Local storage for appearance #

If you switch between light and dark mode, the website stores your choice in your browser’s local storage (key “appearance”). This information never leaves your device. It is only stored at your request (Sec. 25(2) no. 2 TDDDG) and can be removed via your browser settings.

8. Fonts and icons #

This website does not load external fonts (e.g. Google Fonts) and does not use external content delivery networks for scripts or stylesheets. Your device’s system fonts are used; icons are embedded directly in the pages.

Posts contain links to other websites. Below each post there are share links, e.g. for LinkedIn, X, Bluesky, Reddit, Mastodon, Threads or email. These are plain links without embedded scripts. No data is sent to the respective provider until you click a link; from then on, that provider’s privacy policy applies.

10. Contact by email #

If you email me, I process your email address, your name (if provided) and the content of your message in order to reply. The message is also processed by my email provider. The legal basis is my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). I delete the message once your request has been dealt with and no further communication is expected.

11. Your rights #

You have the rights under Art. 15 to 21 GDPR, in particular the right of access, rectification, erasure, restriction of processing and data portability. You can withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where I process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. For the visitor statistics, you can also use the switch in section 5.

12. Right to lodge a complaint #

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

13. Updates #

Last updated: October 2026. I will update this policy if the website or the legal situation changes.