Privacy

Controller

Artur Susdorf, Franz-Sigrist-Str. 6, 79206 Breisach am Rhein, Germany. Data-protection contact: privacy@zetlyn.com.

What we process when you search

• Your search query — sent to the server to compute results, and recorded without anything that identifies you. This page said the query was not stored at all and promised to be updated before that changed. It has changed, so here is what is actually written down: the query text, which corpus it was asked of, how many results it found, how long that took, and which result pages were shown and at which position.
  What is not written down beside it: no IP address, no cookie, no session, no account, no browser or device identifier. There is nothing to link two queries to each other, or any query to you. Purpose is measuring and improving result quality — which pages we show for which question, and whether that is any good (Art. 6 (1) (f) GDPR, legitimate interest in the quality of the service).
  How long. The query text is deleted after 180 days. Before that happens it is folded into a permanent per-day summary, and what survives there is deliberately narrower: daily totals (how many queries, how many found nothing, average time) which contain no text at all; per result page, how often it was shown and at which average position; and a query itself only if it was asked at least three times on that day. A question asked once by one person is not carried forward — that long tail is the part that can describe somebody, and it is dropped rather than kept.
  A query is free text, so it contains whatever you typed. If you would rather not have a particular query recorded at all, do not send it — there is no identifier next to it, so it cannot be found and removed afterwards; see Your rights below.
• Pages you tell us you have already read. The /route endpoint takes an optional have= list of URLs so it can plan a reading order that does not repeat what you have. That is a reading history, and it is treated like the query: used to answer the request, then gone. It is not stored and not logged. The website does not send it; only an API client that chooses to.
• IP address — held in memory only, to enforce a per-client rate limit (Art. 6 (1) (f) GDPR, legitimate interest in preventing abuse). It is not written to any store and is discarded when the window elapses.
• Reported relations — if you report a relation between two pages as wrong (/report-edge), the report is appended to a log file. It contains the two page identifiers, the relation kind, the note you submit, a timestamp and your IP address, kept to make abuse of that endpoint traceable (Art. 6 (1) (f) GDPR). No account is required. If you would rather report a relation without sending one, write to privacy@zetlyn.com instead. This is the only place where an address is written down, and it happens only if you press that button.
• No accounts are needed to search, no tracking cookies, no third-party analytics. The pages set no cookies and load nothing from another host — the wordmark and the icon are served from this domain. There is no CDN in front of the site.

Server logs & hosting

The site is served by Caddy on a server rented from Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany), acting as processor. A move to netcup GmbH is planned; this page will name whoever holds the server.

There is no access log. Caddy does not write one unless it is asked to, and it is not asked to: its journal holds only service events — start, reload, TLS certificate renewal — a few hundred lines in total. No request line is recorded, so no IP address, requested path, query string, user agent or referrer is retained by the web layer. This is why the query record described above contains no address: the web layer never sees one that could be written next to it, and the application is not given one. The query text is recorded by the application deliberately and by itself; everything the web layer could have added is absent because it is never collected.

The machine runs other, unrelated services whose own logs sit in the same system journal. Those are not part of this service and no Zetlyn request data is among them.

Crawled websites

Separately, Zetlyn's crawler fetches public pages to build the index. What it stores and how to block it is described on the crawler page. Operators of crawled sites can request removal via the contact there.

Your rights

On the query records, we have to tell you what we cannot do. They carry no identifier, so there is no way to find the entries that came from you — not for us either. We cannot produce them on request, correct them or delete them individually, because nothing connects them to a person (Art. 11 (2) GDPR). That is a consequence of collecting less, not a refusal: the alternative would be to store something identifying so that it could later be searched for. Reported relations (/report-edge) DO contain your address and can be found and erased — write to the contact below.

Under the GDPR you have the right to access, rectification, erasure, restriction, objection and data portability, and to lodge a complaint with a supervisory authority. The competent authority here is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg — the state data-protection commissioner for Baden-Württemberg. Contact us at privacy@zetlyn.com.