Privacy notice
Datenschutzerklärung for machinebehavior.io under Article 13 of the General Data Protection Regulation (GDPR).
Short version. Reading this site needs no account and sets no cookies. The host receives your IP address to deliver each page, and my access logs do not record it. I run no analytics, and no page requests anything from another company when it loads. Two features load more content: the Grafana dashboards on Inside and Mission Control, and the page previews on the Map of the Work. Both are described below.
1. Who is responsible
Verantwortlicher under Article 4(7) of the GDPR: Stefan Coetzee, Wilhelmstraße 74, 38100 Braunschweig, Germany. Email: stefan@uncovertechtalent.com. The same details are in the Impressum. This notice covers machinebehavior.io. tychat.io and uncovertechtalent.com have their own notices.
2. Opening a page: hosting and access logs
Amazon CloudFront delivers the pages of this site from a private Amazon S3 bucket in the AWS Region Europe (Frankfurt). The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, the AWS contracting party for customers in Europe, the Middle East, and Africa. It works for me as a processor under the AWS Data Processing Addendum (Article 28 GDPR). GitHub Pages stays deployed as a fallback host. If the domain points back to it, GitHub receives your IP address as described in the notice on tychat.io, and I will update this notice at the same time.
To deliver a page, CloudFront receives your IP address and the details of your request. It needs them to answer you and to protect the service. AWS sets how long it keeps the connection data it needs to run CloudFront. I have not configured that and cannot see it.
My own access log records, for each request: the date and time, the AWS edge location, the host name and path, the HTTP method and status, the bytes sent, the response times, the cache result, the protocol and its version, the content type, a request ID, the referring page (the Referer header), your browser's User-Agent string, and the country AWS derives from your IP address. The log never contains your IP address, your port, cookies, or the query string of the address.
I use the log to count visits, find errors, and see which pages and sources bring readers. The legal basis is my legitimate interest in running the site and knowing which pages are read (Article 6(1)(f) GDPR). I weighed this against your interests. The log holds no IP address, it expires after 30 days, and I build no profile of any reader.
- The raw log in Amazon S3 is deleted after 30 days.
- A job on a server that I operate in Germany copies new log files from S3 within minutes and keeps its copy for up to 32 days.
- The same job writes one statistics line per request to a database on that server: the path, the status, the method, page or file, human or bot with the bot's name, the country, the host name of the referring site, the cache result, the bytes, the time to first byte, and the first 12 characters of the request ID. It drops the User-Agent string and the full referrer. The database deletes these lines after 90 days.
3. Name servers
The name servers of machinebehavior.io run on Amazon Route 53, also operated by AWS. When your device looks up the address of this site, your resolver asks them.
4. Grafana dashboards on Inside and Mission Control
The pages Inside and Mission Control show public Grafana dashboards in a frame. On Inside, the frame opens when the dashboards section scrolls into view. On Mission Control, it opens when you press the load button. The only other place that can open a frame is the Map of the Work (section 5).
The frames come from grafana.scoetzee.de, a Grafana server that I operate myself. Its address points to a reverse proxy on an Amazon EC2 server in the AWS Region Europe (Frankfurt). The proxy passes only the public dashboard paths to Grafana, which runs on a server that I operate in Germany. When a frame opens, your browser sends your IP address, your User-Agent string, and the dashboard path to that proxy. The site opens the frame with an instruction to send no referrer. The proxy writes no access log.
On 2026-10-19 I opened a public dashboard in a clean browser. Grafana set no cookie, all 51 requests went to grafana.scoetzee.de, and Grafana wrote two entries to the browser's local storage for that host: a list of dashboards viewed and the time picker history. I cannot read them. They stay on your device until you clear them.
The legal basis is Article 6(1)(f) GDPR: showing the live operating data of this site next to the text that describes it. Amazon Web Services EMEA SARL provides the server for the proxy as my processor (section 10).
5. Map of the work
On /map/, selecting a node can open that page in a frame next to the map. Frames open only for pages on machinebehavior.io, tychat.io, uncovertechtalent.com, and the Grafana dashboards from section 4. Pages on Substack, GitHub, and Reddit open only if you follow the link. tychat.io and uncovertechtalent.com are hosted by GitHub, so opening one in a frame sends your IP address to GitHub. Their notices describe what happens there.
6. Search
The site search runs in your browser against a file on this site. The words you type become part of the address of the results page. That address is a request to the host. My access log does not record the query string.
7. Cookies, storage, and tracking
The pages of this site set no cookies, write nothing to your browser's storage, and load no analytics, advertising, or tracking code. No page requests a script, font, image, or stylesheet from another company when it loads. The decision record is ADR-0010. On 2026-10-19 I scanned every HTML, CSS, and JavaScript file of the site for requests to other hosts and for cookie and storage calls and found none. The Grafana frame (section 4) writes to browser storage under its own host name.
8. Links to other sites
Pages link to other sites: GitHub (the source, history, and issue links in every footer, and the repositories), Substack, Reddit, LinkedIn, standards bodies, and documentation. Nothing is sent to them before you click. When you click, your browser connects to that site and its own privacy notice applies. Your browser sends the address of this site as the referrer; the policy of this site is strict-origin-when-cross-origin, which sends the domain and no path. The footer link "Report an issue" opens a prefilled issue form on GitHub. An issue you post there is public and stays under your GitHub account.
9. Email
If you write to stefan@uncovertechtalent.com, I receive your address, the message, and the time you sent it. I use them to answer you. The legal basis is Article 6(1)(f) GDPR, my interest in answering the people who write to me, and Article 6(1)(b) where you ask about a contract. I keep the message as long as I need it to handle your request, and longer only where a legal retention duty applies. Mail for this address is handled by Google (the MX records of uncovertechtalent.com point to smtp.google.com). Google LLC is on the Data Privacy Framework List.
10. Recipients and transfers outside the EU
The European Commission found that the United States ensures an adequate level of protection for organisations on the Data Privacy Framework List (Implementing Decision (EU) 2023/1795, Article 1). Statuses below were read on that list on 2026-10-19.
| Recipient | Role | Safeguard for transfers to the USA |
|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) with Amazon Web Services, Inc. (USA): CloudFront, S3, Route 53, EC2 | Processor (Article 28) | EU-U.S. Data Privacy Framework: Amazon Web Services, Inc. is a covered entity of Amazon.com, Inc., status Active. The AWS Service Terms also include the Standard Contractual Clauses. |
| GitHub, Inc. (USA), listed as "GitHub": host of tychat.io and uncovertechtalent.com | Independent host of those two sites; it receives your IP address only when you open one of them from this site | EU-U.S. Data Privacy Framework, status Active. |
| Google (mail for stefan@uncovertechtalent.com) | Processor | EU-U.S. Data Privacy Framework: Google LLC, status Active. |
I sell no data and pass none on for advertising.
11. How long data is kept
| Data | Where | Kept |
|---|---|---|
| IP address and request details | AWS CloudFront | Set by AWS (section 2) |
| Raw access log without IP address | Amazon S3 | 30 days |
| Copy of the raw log | My server in Germany | Up to 32 days |
| Statistics lines without User-Agent and full referrer | My server in Germany | 90 days |
| Access log of the reverse proxy for the Grafana frames | Reverse proxy | None is written |
| Google mailbox | As long as needed to handle your request (section 9) |
12. Your rights
You have the right to access your data (Article 15 GDPR), to have it corrected (Article 16), erased (Article 17), or restricted (Article 18), to receive it in a portable format (Article 20), and to object (Article 21). Where I process data under Article 6(1)(f), you can object at any time on grounds relating to your particular situation (Article 21(1)). Write to stefan@uncovertechtalent.com to use any of these rights.
My access logs hold no IP address, so I usually cannot tell which lines are yours. In that case Article 11(2) GDPR applies: Articles 15 to 20 apply once you give me information that lets me identify your data. The page, the time, and your country are a good start.
13. Complaint to a supervisory authority
You have the right to lodge a complaint with a data protection authority (Article 77 GDPR), in particular in the Member State where you live, where you work, or where the alleged infringement took place. The authority responsible for me is Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany (postal address: Postfach 221, 30002 Hannover). Its complaint form is online.
14. Required data and automated decisions
Your browser sends your IP address and the details of your request because the technology needs them to deliver a page. Without them the page cannot reach you. No law and no contract requires you to give me any other data. I use no automated decision-making and no profiling (Article 22 GDPR).
15. Changes
This notice was last updated on 2026-10-19. I update it when the way this site handles data changes. The history of this page shows every version.