Privacy Policy
Introduction
This privacy policy informs you about the types of personal data (hereafter also "data") we process, for what purposes and to what extent, within our online offering 4coders. 4coders is a free collection of developer tools (encode/decode, hashing, JWT inspection, QR/barcode generation and more) that run entirely in your browser. There are no user accounts, no sign-up and no advertising; we process as little data as possible.
Importantly, the content you enter into the tools (e.g. text, tokens, file contents) is processed exclusively locally in your browser and never transmitted to our server or to any third party. Last updated: 29 October 2026.
Controller
Christian Götze, Rathenaustr. 3, 16761 Hennigsdorf, Deutschland
E-mail: hello@4coders.net
Phone: +49 33022015238
Imprint: https://4coders.net/impressum
A data protection officer is not legally required (§ 38 BDSG).
Overview of processing
The following overview summarises the types of data processed and the purposes of their processing.
Types of data processed: meta/communication data (e.g. IP addresses — in full in the server log files, only briefly in memory in the audience measurement — access times, browser type); usage data (which tool was opened — with no input contents); content data (only if you contact us by e-mail).
Categories of data subjects: users (visitors of this site); communication partners (people who write to us by e-mail).
Purposes of processing: provision of the online offering and web hosting; IT security; audience measurement and tool usage statistics; responding to enquiries.
Relevant legal bases
We process personal data on the basis of the General Data Protection Regulation (GDPR); additionally, national requirements in Germany apply, in particular the Federal Data Protection Act (BDSG) and the Telecommunications-Digital-Services Data Protection Act (TDDDG).
Legitimate interests (Art. 6 (1) (f) GDPR): processing is necessary to safeguard our legitimate interests, provided the interests or fundamental rights and freedoms of the data subject do not override them.
Pre-contractual enquiries (Art. 6 (1) (b) GDPR): when responding to contact enquiries.
Security measures
In accordance with legal requirements, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.
TLS encryption (https): to protect the data transmitted via our online offering we use TLS encryption, recognisable by the "https://" prefix in your browser's address bar.
Processing in the browser only: the actual function of the tools (e.g. Base64, hashing, JWT decoding, QR generation) runs entirely client-side in your browser. Your input never leaves your device.
Automated decision-making: there is no automated decision-making within the meaning of Art. 22 GDPR. The automatic blocks set by our attack detection (see "Provision of the online offering and web hosting") are used for IT security and only affect whether our servers can be reached from a blocked address. If you e-mail us about a block as described there, we will review it by hand and lift it where appropriate.
Transfer to recipients and processors
To operate this online offering we use a hosting provider that acts for us under a data processing agreement (Art. 28 GDPR; see below). E-mails to us arrive in a mailbox at Proton AG (Geneva, Switzerland; see "Contact"); for Switzerland an adequacy decision of the EU Commission pursuant to Art. 45 GDPR is in place. In addition, as part of our IT security measures, IP addresses and other details of detected attacks and of addresses blocked by hand are transmitted to CrowdSec SAS in France (see "Provision of the online offering and web hosting"). No further transfer to third countries outside the EEA takes place; only in the course of DNS resolution can a transfer to the USA not be excluded (see below).
Provision of the online offering and web hosting
We operate this online offering on a server in a data centre in Falkenstein, Germany.
Collection of access data and log files: when our online offering is accessed, access data is recorded server-side in server log files (incl. the full IP address — it is neither shortened nor anonymised there —, date and time of the request, URL accessed, HTTP method, amount of data transferred, status message, browser type and version, referrer URL). This serves secure, fault-free operation, IT security and error analysis. The log files are stored exclusively on our own server in Germany and, except for the reports to CrowdSec SAS described below, not transmitted to any external provider. Retention: the access log is rotated daily and an entry is deleted automatically after 31 days at the latest. Further application log output is deleted from the logging system after 30 days. On the server itself it is, as a rule, deleted automatically the next time the server restarts or after several updates of the site; there is no fixed period for this. If a specific security incident is being investigated, the entries concerned may be kept until it is resolved. The log files are not included in backups.
Defence against attacks: for this, security software for attack detection runs on this site's server. It automatically analyses the server's access log and recognises patterns in it such as repeated intrusion or abuse attempts. It also checks requests to this site for the characteristics of known attacks; the check covers the requested address, the headers and content sent along. This check runs automatically and in memory only; requests that raise no alert are neither stored nor passed to third parties in the process.
Requests showing the characteristics of an attack may be rejected immediately. If an attack is detected, whether in the access log or in this check, our attack detection blocks the IP address it originates from, or a suspicious address range, as a rule for four days at most; during a block, this site cannot be reached from the address concerned. For each detected attack, our attack detection stores a record (incident) with the IP address, the time, the type of attack and details from the triggering requests (such as the requested address and the browser identification). Stored incidents are deleted after seven days at the latest; if a block belonging to an incident is still running, the incident may be kept until that block expires. Messages about detected attacks, with the IP address, also appear in the log output of the attack detection. It is deleted from the logging system after 30 days. On the server itself it is, as a rule, deleted automatically the next time the server restarts or after several updates of the software; there is no fixed period for this. We may additionally block by hand, for a longer period or permanently, individual addresses or address ranges from which abuse originated; such a block lasts at most until it expires or until we lift it. If you consider a block unjustified, please write to us at the e-mail address given in the section "Controller".
For detected attacks, our attack detection reports in particular the attacker's IP address, the type of attack detected and the time to CrowdSec SAS (France, EU), together with details from the triggering requests such as the requested address and the browser identification; there, such reports feed into a shared list of attacker addresses for collective abuse prevention. Addresses and address ranges that are blocked by hand (see above) are reported as well, with the time and the details of the block, even if the occasion was not an attack. No other IP addresses are reported; normal use of this site is not reported. In addition, our attack detection regularly receives blocklists of IP addresses from CrowdSec SAS; requests from addresses on them are blocked as well, for as long as the address is on one of the lists and, as a rule, for up to seven days after that. Legal basis: legitimate interests (Art. 6 (1) (f) GDPR — IT security). Privacy policy of CrowdSec SAS: https://www.crowdsec.net/privacy-policy.
DNS resolution: the DNS zones of our domain are hosted with Amazon Route 53 (Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg). A transfer to the USA cannot be excluded during DNS resolution; AWS is certified under the EU-US Data Privacy Framework. Legal basis: legitimate interest in the reliable availability of our online offering (Art. 6 (1) (f) GDPR).
Hosting provider used: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (servers in Falkenstein/Germany); privacy policy: https://www.hetzner.com/de/rechtliches/datenschutz.
Audience measurement with tally
To see how many people visit and which pages are read, this site uses tally, analytics software written by the site's operator and run on self-operated infrastructure, on a server of Hetzner Online GmbH in Germany (address t.cgoetze.de). No third-party service is involved, and the audience-measurement data is not passed on to any third party. Hetzner provides the server as a processor (see "Provision of the online offering and web hosting").
When you open a page, your browser loads a small script from t.cgoetze.de and then sends a short report there, plus one more for every page change within this site. The report contains only: the short name of this site; the path of the page you opened, without parameters or anchor (for example "/impressum", never the part after "?" or "#"); the address of the site you came from, without any path (for example "https://www.google.com"), and only as far as your browser discloses it; and, only if the address you opened contains them, the campaign values "utm_source" and "utm_campaign". The script sets no cookies, stores nothing in your browser's storage, reads nothing from it and queries no features of your device, such as screen size, fonts or extensions.
As with every request, your IP address and your browser identification (user agent) reach the server along with the report. The audience measurement uses the IP address in memory only, and only for three purposes, described below: the country, the daily identifier and protection against overload. The audience measurement itself never writes the IP address, the browser identification or the daily identifier to disk and never logs them; for the server's access log, see below.
The country is determined from the IP address with a country database ("IP to Country Lite" by DB-IP) that is kept as a file on the same server. No request goes to DB-IP or any other third party in the process, and only the country is derived, neither region nor town.
From the IP address, the browser identification and the site's short name, the audience measurement forms a daily identifier. This identifier is a keyed hash, built with a secret random value; the random value exists only in memory and is replaced by a new one every night when the day changes (midnight German time) and whenever the service restarts. Through this identifier, a visit therefore cannot be linked to a visit on another day, and without the random value, which never leaves memory, the identifier does not lead back to your IP address. The daily identifier serves only to avoid counting you twice within a day, whether for the whole site or for a single page, to tell which page views belong to the same visit (a visit ends after 30 minutes without a page view), and to show the number of visitors in the last five minutes, a number that is never stored. For this, the audience measurement holds in memory the daily identifier, the time of your last page view, the number of page views in the current visit and, for each page you open, a further keyed hash of the daily identifier and the page; all of it is discarded together with the random value.
To protect the service against overload, it accepts only a limited number of reports per internet connection within a given period. This limit, too, works in memory only and only with a keyed hash of the IP address (for IPv6 addresses, of their front part, which identifies the connection), formed with the same random value and discarded with it, never with the address itself.
The browser identification is reduced to coarse classes (browser family such as Firefox, operating-system family such as Android, and device type: computer, smartphone or tablet) and checked for whether a program rather than a person is making the request; reports from such programs are discarded. Of the previous page's address only the domain name remains (for example "google.com"); if it is this site itself, it is discarded entirely.
Only daily totals are stored: for the whole site, the number of page views, visitors, visits and visits with a single page, plus breakdowns by page, entry page, referring domain, kind of origin (direct, search engine, social network, other website, campaign), campaign value, country, browser family, operating-system family and device type. Parts of a page address that look like an automatically generated identifier (such as a long string of digits and letters) are replaced by a placeholder before counting. There are no individual records, no row per visitor, no IP addresses, no daily identifiers and no times of day; the smallest unit is the calendar day. Someone who comes on two days therefore counts as two visitors: the audience measurement forms no identifier that lasts beyond the day. On days with very few visits, however, a daily total can describe a single visit; someone who knows that you were here on that day could, for example, read from it which pages you opened.
If your browser sends "Do Not Track" or "Global Privacy Control", the script sends no report (it is still loaded; see the access log below); should a report with one of these signals arrive anyway, the server discards it. In local development and on hosts other than the production addresses, the script is not loaded.
Not every browser offers these signals. You can also switch the measurement off by blocking the address t.cgoetze.de, for example with a content or ad blocker; the site keeps working unchanged.
Right to object: you may object to the audience measurement at any time under Art. 21(1) GDPR, informally, by email or by post to the contact details given in the imprint. Because the audience measurement forms no identifier that lasts beyond the day, an objection cannot be recorded for your browser; the measurement is reliably switched off by the signals mentioned above or by blocking t.cgoetze.de. The daily totals already stored contain no identifier, so it cannot be determined which figures stem from your visits (Art. 11 GDPR).
Loading the script and each report are ordinary requests to this server and therefore appear in the server's access log like any other request, with IP address, browser identification and time (see "Provision of the online offering and web hosting"). In these entries the referring page is only this site's address, without a path, and the path of the page you opened does not appear.
Storage period: the audience measurement uses the IP address and the browser identification only while it processes a report. The daily identifier, the hashes and the time of the last page view are discarded when the day changes, a few seconds after midnight at the latest. The breakdowns (by page, entry page, referring domain, kind of origin, campaign value, country, browser family, operating-system family and device type) are deleted after 25 months: every day, all entries for a day more than 25 months back are removed. The daily totals for the whole site (page views, visitors, visits and visits with a single page) are kept for as long as the site is operated, so that its use can be compared over the years; if the site is discontinued, they are deleted too. These totals contain nothing about pages, origin, country or device. The entries in the server's access log (IP address, browser identification, time, this site's address) are deleted after 31 days at the latest; only entries needed to investigate a specific security incident may be kept longer, until it is resolved.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly statistics on the use of the site and in protecting this measurement against overload and distortion; for the access log, the legitimate interest in secure and trouble-free operation, see "Provision of the online offering and web hosting"). No consent under § 25(1) TDDDG is asked for, because it is not considered necessary here: the script stores nothing on your device. It reads only what your browser transmits with the page request anyway (the address requested, the previous page and, where set, the "Do Not Track" and "Global Privacy Control" signals); apart from that, it checks whether the page is being preloaded in the background, so that it is counted once you actually open it. That information does not leave your device.
Until 21 October 2026, Matomo was used for audience measurement. From the data recorded with it, daily totals and breakdowns of the kind described above, covering up to twelve months before the switch, were transferred to tally (no IP addresses, no visitor identifiers and no individual visits). Since then, the storage periods above apply to the transferred figures. This departs from the earlier statement that after twelve months only monthly and yearly figures of the daily reports would have been kept; the figures were transferred so that the statistics stay comparable across the switch. The Matomo data itself was deleted on 30 October 2026 at the latest: the individual visits with truncated IP address, daily changing visitor identifier, time, pages viewed with their address and title, approximate location, browser and device type, language setting, referring domain and campaign values; the recorded clicks on outbound links and downloads; the interaction events from a fixed list; and the reports derived from them. Backup copies that still contain it will be deleted by 14 November 2026 at the latest. Older versions of this site running in a tab that is still open may keep trying to send reports to the former Matomo address (matomo.cgoetze.de); that address has not existed since 24 October 2026, so such reports do not reach the server and are not recorded.
Local storage and usage statistics
Local storage in the browser (localStorage): only your explicit light/dark theme preference is stored locally in your browser and never transmitted to us. This storage is strictly necessary under § 25 (2) no. 2 TDDDG to keep the presentation you chose across page loads and therefore takes place without consent. You can delete it at any time by clearing this site's data in your browser. Tool inputs (payloads, tokens, passwords, etc.) and which tools you used recently are not written to browser storage; they stay only in the current page's memory and are lost when you close or reload — deliberately, so nothing remains on shared or public devices.
Tool usage statistics (separate from the audience measurement): when you open a tool, the site sends a short report to our server, only once per tool until the page is reloaded. The report contains only the name of the tool opened (e.g. "base64") — never your input, no identifier and no cookie. The server then increases a counter for that tool by one; the counters are held only in the application's memory. The report is an ordinary request to our server and therefore appears in the server's access log like any other request, with IP address, browser identification and time (see "Provision of the online offering and web hosting"). In this entry the referring page is the address of the tool's page. Our monitoring system reads the counter values at short intervals and keeps them with the time of each reading; they are deleted automatically after 17 days at the latest. They are not backed up. Because this shows fairly precisely when a counter rose, the opening of a tool could, together with the access log, be matched to a request and thus to an IP address. The counter values serve solely the aggregated analysis of which tools are used. Legal basis: legitimate interests (Art. 6 (1) (f) GDPR).
Contact
If you contact us by e-mail, we process the information you provide to the extent necessary to respond to your enquiry. The information is deleted as soon as it is no longer required for the purpose, generally no later than 6 months after the enquiry has been dealt with, unless statutory retention obligations apply. Legal bases: pre-contractual enquiries (Art. 6 (1) (b) GDPR) and legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).
E-mails to hello@4coders.net arrive in a mailbox at Proton AG (Geneva, Switzerland). For Switzerland an adequacy decision of the EU Commission pursuant to Art. 45 GDPR is in place. There is no contact form, and no other e-mail service provider is used.
Cookies and similar technologies
4coders uses no cookies. Local browser storage (localStorage) is used solely for the light/dark theme preference (see "Local storage and usage statistics"); tool inputs and usage history are not stored in the browser. The audience measurement with tally uses no cookies (see "Audience measurement with tally"). No tracking in the sense of cross-device recognition or profiling takes place.
Deletion of data
The data we process is deleted in accordance with statutory requirements as soon as the permissions required for processing cease to apply (e.g. when the purpose of processing no longer applies). If data is not deleted because it is required for other legally permissible purposes, its processing is restricted to those purposes.
Backups: every night a backup is taken that contains the daily totals of the audience measurement (without IP addresses and without daily identifiers) and the database of the attack detection (with the stored incidents, the IP addresses of detected attackers, the addresses blocked by hand and the addresses from the blocklists received from CrowdSec SAS). It is stored in Germany, kept for 14 days and then deleted automatically; it is restored only in the event of a fault. A record already deleted may therefore still sit in a backup for up to 14 days, and for the audience measurement up to 16 days, because it makes a copy of its database for the backup every night and keeps the last three. The server access log and the application log output are not backed up.
Changes and updates to this privacy policy
Please review the content of our privacy policy regularly. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary.
Rights of data subjects
Right to object (Art. 21 GDPR): you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6 (1) (f) GDPR.
Right of access (Art. 15 GDPR): you have the right to obtain confirmation as to whether data concerning you is processed and to access that data.
Right to rectification (Art. 16 GDPR): you have the right to request the rectification or completion of data concerning you.
Right to erasure (Art. 17 GDPR) and to restriction of processing (Art. 18 GDPR).
Right to data portability (Art. 20 GDPR).
Complaint to a supervisory authority (Art. 77 GDPR): the authority responsible for us is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow; e-mail: poststelle@lda.brandenburg.de.
Definitions
Personal data: any information relating to an identified or identifiable natural person.
Controller: the natural or legal person that alone or jointly with others determines the purposes and means of processing personal data.
Processing: any operation involving personal data, whether collecting, analysing, storing, transmitting or deleting it.
Processor: a person that processes personal data on behalf of the controller (e.g. a hosting provider).