Privacy policy

Last updated 8 October 2026

This policy covers the website grynlume.com and our own installation of Grynlume at grynlume.grimfaste.com. It does not cover installations of the Grynlume software that other people run on their own servers; those are operated by their respective owners.

Controller

What this website collects

grynlume.com is a static website. It sets no cookies, loads no third-party scripts, fonts or embeds, and runs no analytics or tracking of its own. Video and images are served from this domain.

Server logs

The site is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. When you open a page, the hosting provider's web server records the requested address, the time, the HTTP status, the referring page, your browser's user agent and your IP address in its access logs. This processing is based on Article 6(1)(f) GDPR, our legitimate interest in operating the site securely and diagnosing faults. Logs are retained by the provider for a limited period and then deleted. A data processing agreement is in place with the provider.

Email

If you write to contact@grynlume.com, we keep your message and address for as long as needed to answer it and to document the correspondence (Article 6(1)(b) and (f) GDPR). We do not add you to any mailing list.

Our Grynlume installation

We run one installation of Grynlume ourselves, to measure our own websites. Its dashboards can only be reached from our private network. The public address grynlume.grimfaste.com serves three things: the tracking script, the endpoint that receives measurements, and read-only dashboard links that we share with specific people. For this installation we are the controller; other people who use the Grynlume software run their own installations.

Shared dashboard links

A shared link shows aggregated statistics for one website, such as counts of visits, pages and sources. It contains no information about individual visitors. The link carries an access token: anyone who has the link can open it until we revoke it. Opening it sets no cookies and stores nothing in your browser.

Measurement on our websites

When you visit one of our websites that embeds the script, your browser sends the address of the page, the referring page, the width of your screen and, where present, campaign parameters from the address. Events such as a click on an outbound link, a file download or a page that was not found are sent the same way. Our server also receives your IP address and your browser's user agent. From these it derives a visitor identifier: a SHA-256 hash of a random secret for the current day, the IP address, the user agent and the website's domain. The secret is replaced every day at midnight UTC and deleted after two days, so the identifier cannot be linked from one day to the next. Neither the IP address nor the full user agent is stored. We keep the browser name and version, the operating system and a screen size class. We do not determine your location. To limit abusive request rates, the IP address is also held in working memory; it is never written to disk.

On websites where we have switched it on, we also record the language your browser prefers. Only the primary language code is kept, such as "de" or "en", taken from the Accept-Language header your browser sends with every request. It is stored with the page view and is not used to recognise you.

On websites where we have switched it on, searches made with the website's own search function are counted. A search term is stored only as a daily count for that website, without any visitor identifier, session or time of day. Terms that contain an @ sign, a web address or a sequence of four or more digits are discarded before they are stored. We only display terms that were searched at least five times in the period being viewed.

Some of our websites load the measurement script only after you agree. On those websites nothing is sent to our installation before you click "Allow". Your choice is stored in your browser's local storage under the name pa_consent so that we do not ask again for twelve months, and you can change it at any time with the link provided on the page. If your browser sends a Do Not Track or Global Privacy Control signal, we treat it as a refusal and do not ask.

On websites where we have added it, a second small script measures how quickly the page loads and responds: the time until the largest element is shown, unexpected layout shifts and the delay after an interaction. These timings are sent once per page view together with the address of the page and nothing else.

Some pages show one of several variants of an element, for example a product box, to find out which one works better. The name of the variant that was shown is sent with the measurements; nothing else is added.

To keep automated traffic out of the statistics, user-agent strings and the host names of referring websites are sent to TypeSafe (typesafe.ai), whose service classifies them. No IP address and no identifier is sent with them. User agents classified as human are kept only as a hash. When the statistics show an unusual change, aggregated figures with the names of the pages and sources involved are sent to the same service so that it can suggest a cause.

Requests to grynlume.grimfaste.com reach our server through Cloudflare's network (Cloudflare Tunnel). Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, processes the connection data, including your IP address, in order to deliver the request and to protect the service against attacks. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

This processing is based on Article 6(1)(f) GDPR. Our legitimate interest is understanding how our websites are used, measured without cookies and without identifying anyone. Individual measurement records are deleted after 426 days, at the latest at the end of the following calendar month. Counts aggregated per day, page and month, which contain no information about individual visitors, are kept without a time limit. Daily database backups are kept for seven days; individual copies made before a software update are kept until we delete them. Encrypted copies of the daily backup are stored in our Apple iCloud storage for 14 days; Apple cannot read them.

Your rights

You have the right to access, rectify or erase personal data we hold about you, to restrict or object to its processing, and to data portability, as set out in Articles 15 to 21 GDPR. You may also lodge a complaint with a supervisory authority; the authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht. To exercise your rights, write to contact@grynlume.com.

The Grynlume software

The software itself is designed so that operators do not hold personal data about their visitors: it uses no cookies, stores no raw IP addresses or user agents, and derives a visitor identifier from a secret that is replaced daily and then destroyed. Operators remain responsible for their own installations and their own privacy notices.