Privacy Policy

This website — including the server-side service that receives contact-form submissions — is operated at the RZO data centre in Gais (Appenzell Ausserrhoden, Switzerland). All operations take place exclusively on Swiss infrastructure. No transfer of web-server logs to third countries occurs.

With every page request, technically necessary connection data is recorded in server logs: the requester's IP address, the time of access, the requested URL, the HTTP status, the volume transferred, the referrer URL, and the user agent (browser and OS identifier).

Purpose: secure operation of the infrastructure, defence against attacks, fault analysis. Legal basis: Art. 31(2)(c) revFADP and Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the website). Retention period: a maximum of 30 days, followed by automated deletion. We do not merge log data with other sources nor carry out person-related evaluations.

We use Plausible Analytics (plausible.io), an open-source, privacy-friendly analytics solution. Our Plausible instance runs on our own infrastructure at RZO Gais. No data is transmitted to Plausible Insights OÜ (Estonia) or to any other third party.

The following aggregated data is collected: page views (URL), referrer (linking page), coarse device class (desktop/mobile/tablet), browser and OS identifier, and country of origin (derived offline from the IP via a geolocation database). The IP address itself is never stored; only a daily, salted hash is computed from it in order to recognise returning visits within the same day. The hash is deleted after 24 hours.

In addition, we record a few aggregated, anonymous interaction events (e.g. which solution detail was opened, which filter was used, or which external link was clicked) to improve the directory – always without any personal reference. No cookies are set, no cross-site tracking is performed, no fingerprinting is carried out, and no personal profiles are created. Legal basis: Art. 31(2)(c) revFADP and Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly reach measurement). As no personal data is processed, consent under Art. 6(1)(a) GDPR is not required. Retention of aggregated statistics: 24 months.

The contact form is protected by Altcha – an open-source proof-of-work solution and privacy-friendly alternative to Google reCAPTCHA, Cloudflare Turnstile, etc. Our Altcha instance is self-hosted at RZO Gais (Switzerland). No data is transmitted to third parties.

The visitor's browser solves a cryptographic puzzle locally (HMAC-SHA-256 search). Only the computed solution token and the associated challenge signature are transmitted – no biometric data, no device identifiers, no cookies, no tracking. To defend against automated bulk requests we additionally apply an IP-based rate limit; for this purpose the IP address is held in the server's memory only briefly (at most 10 minutes) and is never stored persistently. Legal basis: Art. 31(2)(c) revFADP and Art. 6(1)(f) GDPR (legitimate interest in defending against automated requests). Tokens are used server-side only once for validation and are not stored persistently.

The contact form on this site allows visitors to send us suggestions or correction notices about open-source solutions. We collect only the information you voluntarily enter into the form: name, email address, name of the suggested solution, and a free-text description. Mandatory fields are marked as such.

Purpose of processing: handling the request, follow-up questions, and adding the solution to the directory. Legal bases: consent under Art. 6(1)(a) GDPR (by actively confirming the privacy notice before submission) and Art. 6(1)(b) GDPR (pre-contractual / preparatory measures). Form data is transmitted to our CRM system for processing. After submitting, you will also receive an automatic confirmation email at the address you provided; it contains the details you submitted. The confirmation email is sent via mail servers operated by hosttech GmbH (Seestrasse 15a, 8805 Richterswil, Switzerland), acting as our processor within the meaning of Art. 28 GDPR; processing takes place exclusively in Switzerland.

Our CRM is Odoo (Odoo SA, Chaussée de Namur 40, 1367 Grand-Rosière, Belgium). It runs on the managed Odoo.sh platform on EU servers. Odoo SA is our processor within the meaning of Art. 28 GDPR; we have concluded a Data Processing Agreement (DPA) based on the EU Standard Contractual Clauses. No transfer to third countries outside the EU/EEA takes place. Further information on data protection at Odoo SA: odoo.com/privacy.

Retention period: form data is retained for as long as is necessary to process your request, but no longer than until your consent is withdrawn. If a business relationship arises from the request, the commercial retention obligations under Art. 958f of the Swiss Code of Obligations (ten years) apply. Requests without follow-up communication are deleted from the CRM after 24 months at the latest.

You may withdraw your consent at any time with effect for the future by sending an email to ping@bluematic.com. The lawfulness of the processing carried out on the basis of the consent prior to its withdrawal remains unaffected.

On the solution cards we display the GitHub star count for the respective open-source project as a quality indicator. These figures are fetched server-side at build time in our CI pipeline (RZO Gais, Switzerland) from the public GitHub API and embedded into the static build. The visitor's browser does NOT establish any connection to api.github.com or to other GitHub services.

Consequently, no personal data is transmitted to GitHub Inc. (USA) – neither your IP address nor your user agent ever leave our Swiss infrastructure in the direction of GitHub. Star counts are refreshed on every deployment (typically daily). Legal basis: Art. 31(2)(c) revFADP and Art. 6(1)(f) GDPR (legitimate interest in providing a quality indicator for the listed projects).