Responsible for data processing
Thomas Neulinger
Halbgasse 27/5, 1070 Vienna, Austria
thomas@thomasneulinger.com
Hosting
The site is hosted by Vercel Inc. in the USA. On every visit its servers log technical data such as IP address, browser, time and the page requested, which running a website securely requires (Art. 6 (1) (f) GDPR). Vercel is certified under the EU–US Data Privacy Framework. All traffic is encrypted.
Cookies and storage
The site sets no cookies. The browser stores the chosen theme and whether keyboard shortcuts are on, and for the open tab the view. These values never leave the device. Fonts, images and videos load from this site.
Analytics
The site counts page views with Vercel Web Analytics by Vercel Inc. in the USA, to see which pages are read (Art. 6 (1) (f) GDPR). It records the page, the site the visitor came from, the country and region, and the device, operating system and browser, without cookies and without tying a view to a person or an IP address. Vercel shows the data for one month and may keep it longer.
Bandcamp
The pages of Crux and Settings show Bandcamp’s player. When one of them opens, the player loads from Bandcamp in the USA, which receives the visitor’s IP address, loads Google Tag Manager and Google Analytics and stores data in the browser (Art. 6 (1) (f) GDPR). Bandcamp’s privacy policy applies.
Newsletter and downloads
Subscribing to the newsletter or downloading a device asks for an email address. An email with a link follows. Only when the link is clicked is the address added to the list, and for a device the download starts. The address is stored with the time of the click, the page it came from and the version of the text agreed to, as the record of consent (Art. 6 (1) (a) GDPR). Before the email is sent, Cloudflare Turnstile by Cloudflare Inc. in the USA checks that the form was not filled in by a bot (Art. 6 (1) (f) GDPR). It loads only when a form is on screen, receives the IP address and technical data of the browser, and stores one entry in the browser. Cloudflare is certified under the EU–US Data Privacy Framework. Cloudflare’s privacy notice for Turnstile applies. Emails are sent by Resend Inc. in the USA, which is certified under the EU–US Data Privacy Framework. An address whose link is never clicked is not added to the list. Resend keeps a record of every email sent, with its address, for 30 days. Every newsletter has an unsubscribe link. After unsubscribing no more emails are sent, and the address is deleted on request.
External links
Links to Instagram, Bandcamp and other platforms lead to their own sites, where their privacy policies apply.
Your rights
Everyone can request access to their data, its correction or deletion, a restriction of its processing or a copy of it, and can object to its processing (Art. 15–21 GDPR), by email to thomas@thomasneulinger.com. Complaints can be made to the Austrian Data Protection Authority (dsb.gv.at).
Last updated 1 November 2026.