Privacy policy

The German Datenschutzerklärung is the binding version.

Who is responsible

The controller for data processing on this website is:
Ralf D. Müller, Ginnheimer Str. 7, 65824 Schwalbach, Germany
Email: ralf.d.mueller@gmail.com

No cookies

This site sets no cookies and shows no ads. Fonts, images and scripts come from the same server as the page. Your browser contacts servers other than this site's in three cases: when GoatCounter counts a visit, when you click to load the video from YouTube, and when you submit the notification form. The sections below describe each one.

The site stores two things in your browser, and each only when you click: your language choice and, if you object to visitor counting, that objection (more on this below). About the language choice: when you click a language link (such as "Deutsch" or "English"), your browser remembers that choice in its local storage (localStorage, key lang), so the start page opens in your language next time. This entry never leaves your browser, and you can delete it at any time in your browser settings. Under Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), this needs no consent, because the entry only stores the language you chose.

Hosting on GitHub Pages

This site is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you visit the site, GitHub processes technical data such as your IP address, the date and time, the page you requested and your browser's user agent. GitHub needs this data to deliver the site and protect it from attacks, and keeps it in server logs for that purpose. GitHub doesn't say how long it keeps these logs. The legal basis is Art. 6(1)(f) GDPR: we have a legitimate interest in running the site reliably and securely.

GitHub may transfer data to the USA. GitHub states that it has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework. For details, see GitHub's privacy statement.

Visitor counting with GoatCounter

We count how often each page is viewed. We use GoatCounter for this, a service run by Martin Tournoij, Ireland. GoatCounter says the data is stored on servers at Hetzner Online GmbH in Germany and Finland, both in the EU.

When you open a page, your browser sends a request to plotbot.goatcounter.com. It contains the address of the page, including any parameters after the question mark, its title, the page you came from (the referrer) and the width of your screen. As with any request on the web, the server also sees your IP address, your browser's language setting and its user agent (a line of text naming your browser and operating system). GoatCounter works out your country from the IP address. It counts how often each page is viewed. Separately, it counts where views came from and which browser, operating system, country, language and screen width they came with.

GoatCounter sets no cookies and stores nothing in your browser when it counts. According to GoatCounter, it doesn't write your IP address or the full user agent to its database; it keeps both in memory for up to eight hours and then discards them. That's how it can tell that several views belong to one visit. In the statistics we see totals, not individual visitors.

The legal basis is Art. 6(1)(f) GDPR: we have a legitimate interest in knowing which pages people read, so we can improve the site. You can object to being counted: switch off counting in this browser. The link opens the start page. Your browser then notes in its local storage (key skipgc) that it shouldn't be counted, and confirms this with a message. The same link switches counting back on, and so does reloading that address. The link needs JavaScript. With JavaScript switched off, an invisible image counts the view instead; you can prevent that by blocking plotbot.goatcounter.com in your browser.

For more, see GoatCounter's privacy policy.

Video from YouTube

The video on the start page is hosted on YouTube. Until you start it, the page shows only a preview image from our own server, and your browser doesn't contact YouTube. Only when you click the picture does your browser load the player from www.youtube-nocookie.com and the video from other Google servers. For users in the European Economic Area, YouTube is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you click, Google sees your IP address, your browser's user agent and the fact that the request comes from our website. We embed the video in YouTube's "privacy-enhanced mode". Google says that in this mode it doesn't use the view to personalise YouTube or ads for you. What else Google processes, and whether the player sets cookies or stores anything else in your browser, is up to Google; we have no control over it.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give by clicking the picture. You can withdraw your consent at any time for the future; reloading or closing the page is enough. The site doesn't remember your consent: reload the page and the player is gone, and your browser won't contact YouTube again until you click once more.

Google may transfer data to Google LLC in the USA. Google LLC states that it has certified its adherence to the EU-U.S. Data Privacy Framework; in its decision of 10 July 2023, the European Commission found that companies taking part in the framework provide an adequate level of data protection. For details, see Google's privacy policy.

With JavaScript switched off, the picture is an ordinary link to the video on YouTube, where Google's privacy policy applies.

Flashing the firmware with ESP Launchpad

The “Flash the firmware” button on the Flash the firmware page is a link to ESP Launchpad at espressif.github.io. Until you click it, your browser doesn't contact that site. Launchpad is a web page run by Espressif Systems, the company that makes the ESP32 chip. Like our site, it's hosted on GitHub Pages; when you open it, GitHub processes the technical data described under “Hosting on GitHub Pages” above. Espressif is responsible for Launchpad, not us.

Launchpad downloads a configuration file and the firmware from our website – so again from GitHub Pages – and sends the firmware over the USB cable to the board. On 13 November 2026 we checked what happens when Launchpad opens with our configuration file: the browser loaded Launchpad from espressif.github.io and, apart from that, only our configuration file and our logo, and Launchpad set no cookies. We couldn't observe the flashing itself in that check. Espressif can change its page without telling us.

Email notification via Brevo

If you sign up for the notification, we use your email address to let you know when the book and the PlotBot-Kit come out. We use Brevo for this, a service of Brevo SAS, 9-17 rue Salneuve, 75017 Paris, France. The form sends your details straight to Brevo; your browser only contacts Brevo when you submit it. Brevo processes the data in the EU, mainly in France and Belgium. Some of Brevo's sub-processors are outside the EU; for them, the EU-U.S. Data Privacy Framework or standard contractual clauses apply (see the list in Brevo's data processing agreement, Appendix 3 of its terms of use). The page you see after clicking the confirmation link is served by Brevo, and Brevo's privacy policy applies there. Giving your email address is voluntary; if you don't, you just won't get the notification.

Double opt-in: after you sign up, you'll get an email with a confirmation link. You're only on the list once you've clicked it. Brevo records when you signed up and confirmed, along with your IP address, so that your consent can be proven later.

Legal basis: your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time, using the unsubscribe link in every email or by writing to ralf.d.mueller@gmail.com. Withdrawing your consent only affects the future; it doesn't make any processing before that unlawful.

How long we keep it: until you unsubscribe or we close the list. If you never confirm your sign-up, your address isn't added to the list; the confirmation link expires after 30 days. After you unsubscribe, we delete your address; we keep proof of your earlier consent only as long as the law requires.

Data processing agreement: we have a data processing agreement with Brevo under Art. 28 GDPR. Brevo processes the data only on our instructions.

Statistics: Brevo counts how often emails are opened and links in them are clicked. This counting is set to anonymous: opens and clicks aren't linked to any individual person.

For more, see Brevo's privacy policy.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To use them, write to ralf.d.mueller@gmail.com.

You can also complain to a data protection authority, for example the one where you live or the one responsible for us: the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

Last updated: 13 November 2026