privacy notice · 16 websites, one choice
privacy.
how the public unbrained.dev services measure how they are used: only with your consent, with one choice for all of them, and with your data in your hands.
at a glance
- opt-in only. until you agree, your browser loads neither the statistics nor the recording script and sends nothing to the measurement.
- saying no is as easy as saying yes. “reject”, “settings” and “accept all” carry equal weight. global privacy control or do not track count as refusal; then no banner appears at all.
- your IP address is not stored.
- one choice for 16 websites. it applies to every public unbrained.dev service in this group, not to bot.unbrained.dev.
- your data, your receipt. in the privacy portal /_ua/privacy you download or delete everything stored under your receipt.
controller
the controller is Stefan Preu, email stefan@preu.at. postal address and further details are in the legal notice.
measurement runs on unbrained analytics, self-hosted open-source analytics software on our own server in austria. your browser reaches it only through the website you are visiting. no ads, no sharing.
purposes
the purpose is audience measurement and improving the public unbrained.dev services. you decide on two purposes separately:
- statistics: page views, clicks, load times.
- session recordings & heatmaps: how pages are used, as replays and heatmaps. requires statistics.
neither is preselected. without your consent nothing is measured.
what data
with statistics: pages visited (cleaned), referring domain, browser, operating system, device type, screen size, language, country, region and city derived from the IP address, load times and click events.
with recordings, additionally: mouse movement, clicks, scrolling and page structure.
your IP address is not stored. unbrained analytics uses it only to derive country, region and city, and for a pseudonymous session id: a hash of the IP address, the browser identifier, a secret key and a value that changes every month. whoever holds the key could recompute that id within the same month.
receipt and pseudonymous id
when you first agree, your browser creates a random receipt. unbrained analytics never receives the receipt itself, only a pseudonymous id computed from it: distinct_id = sha256(scope:receipt)[:40], where the scope is “unbrained-public”.
it links your consented visits across the websites of this group, and keeps apart people who share an IP address. the data is pseudonymous, not anonymous. without your receipt we cannot link it to a person.
the receipt is also your proof in the privacy portal: there you can see and copy it, and use it to download or delete your data.
which websites
the consent is shared by these 16 websites (the group “unbrained-public”). agreeing, refusing or withdrawing on one of them applies to all of them:
- pm-cli.unbrained.dev
- pm-web.unbrained.dev
- pm-gpt.unbrained.dev
- pm-mcp.unbrained.dev
- pm-search.unbrained.dev
- hub.unbrained.dev
- schema.unbrained.dev
- blog.unbrained.dev
- it-tools.unbrained.dev
- bytes.unbrained.dev
- pause.unbrained.dev
- 2d-bots.unbrained.dev
- 3d-bots.unbrained.dev
- 2d-mmo.unbrained.dev
- unbrained.dev
- services.unbrained.dev · this site
the banner settings and the privacy portal always show the current list.
bot.unbrained.dev is not part of it. steve’s bot asks for its own consent and measures statistics only, without recordings. preu.at and the operator’s private applications are separate scopes too; no data is linked between scopes.
after you agree
inside the group, unbrained analytics links your visits through the pseudonymous id. that shows how visitors move between the services, for example from pm-cli to hub.
if you also allow session recordings & heatmaps:
- replays of 25 % of consenting sessions, heatmaps of all consenting sessions.
- form inputs are masked, password fields are never recorded. on pm-web, pm-gpt and pm-mcp all text is masked.
- query strings (the parameters in addresses) are removed from a recording before it is uploaded.
- recordings are kept for 30 days.
retention
- statistics: 36 months.
- recordings: 30 days.
- backups: up to 400 days. what you delete may survive in backups until then; deletions are applied again after any restore.
recipients
there are no recipients: the data stays on the operator’s own server and is neither shared nor used for advertising. the websites are delivered through cloudflare, acting as a processor.
legal basis
your consent under Art. 6(1)(a) GDPR, and for access to your device § 165(3) of the austrian TKG 2021. you can withdraw it at any time with effect for the future.
your rights
you have the right of access, erasure, objection and withdrawal of your consent with effect for the future, and the right to lodge a complaint with the austrian data protection authority (dsb.gv.at).
do it yourself: in the privacy portal /_ua/privacy, at /_ua/privacy on every website of the group, you see and change your choice, see and copy your receipt, download everything stored under it (JSON) or delete it.
lost your receipt? then self-service is not possible. write to stefan@preu.at; your request is assessed with whatever identifying information you provide (Art. 11(2) GDPR). nothing is disclosed or deleted by IP address, browser identifier or time alone, because several people can share them.
change your choice
you can change or withdraw your choice at any time: with the button here, with “privacy settings” at the end of every page, with the address #ua-consent on every website of the group, or in the privacy portal. the change applies from the next upload, in every open tab.
without javascript nothing is measured, and the button cannot open anything. if your browser sends global privacy control or do not track, nothing is measured and the settings do not open.
this website
services.unbrained.dev has no banner and no measurement of its own: banner and measurement are the same as on every website of the group.
when you open it, the web server processes the connection data it needs (IP address, requested address, time, browser identifier and other headers without cookies or credentials) in access logs. they and the operating statistics built from them are deleted after 90 days. the legal basis is Art. 6(1)(f) GDPR: delivering the website and keeping it secure.
this server checks the status of the services itself. your browser contacts no other site for it, and no data about you is sent.
if you explicitly choose a light or dark theme, your browser stores that choice locally (entry “unbrained-theme”). it never leaves your device.