Privacy · what we store, and why.

Controller

Burak Kağan Yılmazer · burak.kagan@protonmail.com. Postal address as stated in the imprint.

Hosting and server logs

The site is hosted by Netlify, Inc. ↗ (San Francisco, USA). When you open a page, your browser sends a request that Netlify's servers necessarily receive and briefly log: your IP address, the page requested, the date and time, the referring page, and your browser and operating system. Netlify uses these logs to deliver the site and to keep it secure, deletes them after a short period, and processes them on our behalf under a data processing agreement. Netlify participates in the EU–US Data Privacy Framework. The legal basis is our legitimate interest in delivering a working, secure website (Art. 6(1)(f) GDPR).

What we collect, and why

If you sign up for announcements, we store the email address you provide, optionally your name, your topic choice (workshops, exhibitions, or both), and any free-text note you leave. The sole purpose is to send you one announcement email when a matching event is confirmed. The legal basis is your consent (Art. 6(1)(a) GDPR), given by submitting the form.

How announcements are sent

Announcement emails are sent manually, with all recipients in BCC, so your address is never visible to other subscribers. There is no newsletter, no automation, and no tracking in the emails.

Where the data lives

Form submissions are stored by our hosting provider, Netlify, Inc. ↗ (the hosting provider described above), which processes them on our behalf as part of its Forms service. To filter spam, Netlify passes each submission to its spam-filtering service Akismet ↗ (Automattic Inc., USA). No one else receives your data, and we never share or sell it.

Retention

Your details stay on the list until you opt out or until the announcements program ends, at which point the list is deleted.

Your rights

• Opt out at any time — reply to any announcement, or email us; we remove you promptly.
• You may request access to, correction of, or deletion of your data (Art. 15–17 GDPR).
• You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
• Where we rely on our legitimate interest (the server logs, the analytics and the in-browser code runner), you may object to that processing at any time for reasons arising from your particular situation (Art. 21 GDPR); email us and we will stop unless there are compelling legitimate grounds.
• You may lodge a complaint with a supervisory authority (Art. 77 GDPR).

Analytics

To learn which lessons are read and where the curriculum can be improved, the site uses Umami ↗ , a cookieless analytics service run by Umami Software, Inc. (USA), with the data stored in its EU region (Germany). For each page visit it records the page, the referring site, your browser, operating system, device type and screen size, and your country, region and city, which are derived from your IP address. The IP address itself is not stored. To count visits rather than page views, Umami forms a visit identifier from your IP address and browser details combined with a secret value that changes every month, so the identifier cannot be traced back to you and visits cannot be linked from one month to the next. Search terms typed into the curriculum search may be recorded with the visit, so we can see what learners look for and close gaps in the curriculum. Umami sets no cookies and stores nothing in your browser, so no consent banner is needed. The legal basis is our legitimate interest in understanding how the lessons are used (Art. 6(1)(f) GDPR); you can object at any time (see Your rights).

Running lesson code in your browser

Some lessons offer a Run button on their Python examples. The code then runs entirely inside your own browser, using Pyodide ↗ (Python compiled for the web). Your code, its output and any images it makes are never sent to us or to anyone else.

To run Python, your browser has to download Pyodide and the Python packages the example needs. These files are loaded from the public open-source file network jsDelivr ↗ (cdn.jsdelivr.net, operated by Volentio JSD Limited, England and Wales). This happens only after you click Run, never on page load. Like any web server, jsDelivr receives your IP address, browser type and the address of the page making the request, and states that it uses these for analytics and security and does not link them to individual users; its traffic is served by third-party network providers, which may be located outside the EU. Our legal basis is our legitimate interest in offering the in-browser exercise you asked for (Art. 6(1)(f) GDPR). If you prefer not to contact jsDelivr, don't click Run: every example can also be copied (or downloaded, where offered) and run on your own computer.

Browser storage

The rest of the site is static and stores a few small values in your own browser to remember preferences. None of it is sent to us or to any third party, and none of it identifies you:

• p2g-theme (localStorage) — your light/dark theme choice.
• p2g-progress (localStorage) — the lessons you mark as complete, so your progress persists.
• p2g-stars (sessionStorage) — a cached copy of the repository star count; cleared when you close the tab.
• p2g-octo-greeted (sessionStorage) — a one-time flag so the header animation plays once per visit; cleared when you close the tab.

The repository star count shown in the header and footer is fetched from our own server endpoint — your browser does not contact GitHub directly, so no request or IP is sent to GitHub on your behalf. All fonts and assets are served from this domain. No advertising, no cross-site tracking, and no embedded third-party content beyond the analytics and the optional, click-to-load Python runner described above.