[stefan-azentrius]

The privacy pages omitted scroll depth and active time measurement, overstated what the daily Plausible identifier guarantees, and did not distinguish access logs from error/security logs. Both language versions now describe the actual processing, identify Hetzner's website, analytics and email hosting roles, explain email deletion criteria, and give the right to object its own section.

The operator confirmed the implemented server configuration on 2026-10-19. The text now reflects:

• Truncated IP addresses in website/analytics access logs, retained for at most 14 days.
• Full IP addresses in error/security logs, retained for at most 14 days; the separate fail2ban access logs are retained for at most two days.
• 24 months for Plausible event/session records in the active database, with records potentially remaining in backups for up to six further months.
• Email hosted exclusively by Hetzner without forwarding to another email provider.

Image Update Monitor copy specifies rollback images and supported database dumps, including their backup limits and the optional command-line skip. Homepage and page metadata consistently include Codex alongside Claude Code. The German privacy heading wraps at a word boundary on narrow screens.

Validation

• npm run build: 19 pages, 18 sitemap entries; metadata, schema and internal-link checks pass. Product versions remain at the committed cache values because the local version fetch was unavailable.
• German and English privacy pages and the revised German homepage were checked at 319 px without horizontal overflow.
• git diff --check passes.

Scope and remaining considerations

The pending operational confirmation is resolved by the operator's confirmation. This PR does not rerun the server audit. The logging disclosure concerns this website and its analytics service, not every application on the infrastructure. Email deletion criteria must remain aligned with actual handling.

The operator explicitly chose to keep the existing email/postal contact details without adding another contact channel. Both legal notices therefore remain unchanged; this decision does not establish compliance with Section 5 DDG.

The concrete analytics setup still needs assessment under Section 25 TDDDG and the GDPR, including engagement measurement. The existing Art. 6 (1) (f) GDPR basis is not independently validated by this text update. The README records this scope. No server configuration, version or deployment is changed by this PR.