Slowlights

Privacy

Slowlights collects as little as it can. This site sets no cookies and doesn't follow you around the web. Its fonts, pictures and films all come from this site's own server.

Three things do involve personal data: the hosting, a cookieless visitor count, and the waiting list. All three are explained below.

Who is responsible

Thomas Plat - Slowlights
c/o Autorenglück #21808
Albert-Einstein-Straße 47
02977 Hoyerswerda
Germany
Email: hello@slowlights.app

Hosting

This site is hosted on Cloudflare Pages, run by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. To deliver a page, Cloudflare's servers have to process technical data your browser sends with every request: your IP address, the date and time, the page you asked for, the page you came from, and your browser and operating system. We don't keep or look at server logs ourselves. Cloudflare keeps this data only briefly, to deliver the site and protect it from attacks, and then deletes it. If Cloudflare has to check whether a visitor is a bot, it may set a strictly necessary security cookie for that.

The legal basis is our legitimate interest in a safe, working website (Art. 6 (1) (f) GDPR). Cloudflare processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Data may be processed in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has decided that data protection is adequate (Art. 45 GDPR). In addition, the EU standard contractual clauses apply (Art. 46 (2) (c) GDPR).

The site is only served over an encrypted connection (HTTPS).

Visitor statistics

To see how many people visit and which pages they read, we use Umami, run by Umami Software, Inc., 1362 42nd Ave., San Francisco, CA 94122, USA. Umami sets no cookies and stores nothing on your device. It counts page views, the page you came from, your browser, operating system and device type, your country, region and city, and whether you joined the waiting list. Your IP address is used only to work out that location and is not stored. Umami can't tell who you are, and it can't follow you to other websites.

The legal basis is our legitimate interest in knowing how the site is used, so we can improve it (Art. 6 (1) (f) GDPR). Umami processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Where data reaches the USA, the transfer is covered by the EU standard contractual clauses (Art. 46 (2) (c) GDPR).

If your browser sends a Do Not Track signal, Umami doesn't count your visit at all. You can also object at any time (Art. 21 GDPR), for example by blocking cloud.umami.is in your browser or by emailing us.

The waiting list

When you join the waiting list, we store your email address. We then send you an email with a link, and you're only on the list once you open it (double opt-in). To be able to show that you agreed, we also keep the time you signed up, the time you confirmed and the IP address used for each.

We use your email address for one thing: to tell you about Slowlights, its beta invites and its launch. The legal basis is your consent (Art. 6 (1) (a) GDPR). You don't have to give us your email address, but without it we can't put you on the list.

The list is kept with Brevo, run by Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France, on servers in the EU. Brevo also sends the confirmation email and our emails to the list. It processes this data on our behalf under a data processing agreement (Art. 28 GDPR).

We don't measure whether you open our emails or which links you click.

You can leave the list at any time with the link at the bottom of every email, or by emailing us. Your address is then deleted. Leaving doesn't affect anything we did with your consent before. If you never confirm, you're not added to the list. The confirmation link expires after 30 days. After that, the only trace is the sign-up attempt and the confirmation email in Brevo's sending log, and we delete those. If we close the list, we delete it.

Emailing us

If you email us, we use your address and your message to reply. The legal basis is our legitimate interest in answering you (Art. 6 (1) (f) GDPR), or taking steps towards a contract if that's what you're asking about (Art. 6 (1) (b) GDPR). We delete the conversation once it's done, unless the law requires us to keep it.

Links to other sites

This site links to other websites, for example to the source of the screen-time figure. Nothing is sent to them until you click such a link. From then on, their own privacy policy applies.

Your rights

You have the right to:

  • find out what data we hold about you (Art. 15 GDPR)
  • have it corrected (Art. 16 GDPR)
  • have it deleted (Art. 17 GDPR)
  • have its use restricted (Art. 18 GDPR)
  • receive it in a portable format (Art. 20 GDPR)
  • object to its use where it's based on our legitimate interest (Art. 21 GDPR)
  • withdraw your consent at any time, for the future (Art. 7 (3) GDPR)

To use any of these, email us. You also have the right to complain to a data protection authority (Art. 77 GDPR), in particular in the EU country where you live or work, or where you think the breach happened.

As of October 2026.