// data protection
Privacy
This site runs no analytics, sets no tracking cookies, and embeds no advertising. What follows is the honest, short version of the data protection notice required by the GDPR — and it is short because there is very little to describe.// controller
Who is responsible
The controller for this website within the meaning of Art. 4(7) GDPR is Tobias David Kilga, Höhenstraße 24, 6410 Telfs, Austria, reachable at tobias@kilga.io. The statutory disclosure for the business behind it is on the Impressum.This notice covers kilga.io only. Work delivered through SQUER runs under SQUER's own agreements and privacy notices, and client engagements are governed by the contracts and data processing agreements signed for them.
// hosting
Hosting and server logs
The site is hosted on Vercel's global edge network (Vercel Inc., United States). Serving a page necessarily means the hosting provider processes the request: IP address, requested URL, referrer, user agent, and timestamp. Those records exist to deliver the page, keep the service available, and investigate abuse.Legal basis is the legitimate interest in operating a secure website, Art. 6(1)(f) GDPR. Because the provider is based in the United States, the transfer safeguards are those set out in Vercel's data processing agreement, which incorporates the European Commission's standard contractual clauses. Log retention follows the provider's own retention periods; no server log is copied into any separate analytics system by me.
// no tracking
What this site does not do
- No analyticsNo Google Analytics, no Plausible, no Vercel Analytics, no pixels, no session recording.
- No tracking cookiesThe site sets no cookies. Display preferences are kept in your browser's own local storage and are never transmitted.
- No advertisingNo ad networks, no remarketing, no data brokers, and nothing is sold or shared for advertising purposes.
- No third-party fonts at runtimeWeb fonts are compiled into the site at build time and served from this domain, so loading a page makes no request to a font CDN.
- No newsletterThere is no signup form and no mailing list on this site.
// contact data
When you get in touch
If you email tobias@kilga.io, that message and the address it came from are processed to answer it — legal basis Art. 6(1)(b) GDPR for a request about a possible engagement, otherwise Art. 6(1)(f). Correspondence is kept as long as it is needed for the conversation and any resulting engagement, and for the statutory retention periods that apply to business records in Austria (up to seven years under §132 BAO) where a document is a business record.Booking a call uses Cal.com, an external scheduling service (Cal.com, Inc.). Anything you enter into the booking form is processed by that provider under its own privacy policy, and I receive the name, email address, and any notes you submit in order to hold the meeting. If you would rather not use it, email works just as well.
// outbound
Links off this site
Links to LinkedIn, GitHub, Cal.com, and the sources cited in essays and in the AI data protection reference lead to services I do not control. Nothing on this site embeds them: no like buttons, no iframes, no beacons — following a link is the only way your visit becomes visible to them. Once you are there, the operator's own privacy notice applies.
// your rights
Your rights
You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Requests go to tobias@kilga.io and are answered within one month.If you believe your data is being handled unlawfully, you can lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb.gv.at) or with the supervisory authority for your place of residence.
// changes
// last reviewed 2026-08-21Changes to this notice
This notice is versioned with the rest of the site in a public repository, so its history is auditable. It will be updated if the site starts doing something new — and if that ever includes analytics, it will say so here before it ships, in plain language.