Matt Fletcher

Privacy

Privacy policy / Datenschutzerklärung. What this site collects, why, and what you can do about it.

Last updated: 28 October 2026

This site is a personal author and teacher website. I keep data collection to a minimum: there are no accounts, no advertising and no tracking unless you say yes. This policy applies to every visitor, wherever you are. It is written to meet the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG), which are among the strictest rules in the world.

1. Who is responsible

The controller under Art. 4(7) GDPR is:

Matthew Fletcher
[Address service: street and house number]
[Postcode] [Town], Germany
Email: matt@mtfletcher.com

I am not required to appoint a data protection officer.

2. Hosting and server logs

This site is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you visit, your browser automatically sends information that the host records in server log files: your IP address, the date and time, the page requested, the referring page, and your browser and operating system.

This is needed to deliver the site and keep it secure. The legal basis is my legitimate interest in running a stable, secure website (Art. 6(1)(f) GDPR). Netlify keeps logs only as long as needed for these purposes (see the Netlify Privacy Statement). Netlify's data processing agreement is part of its terms (Art. 28 GDPR). Data may be transferred to the USA; Netlify, Inc. is certified under the EU–US Data Privacy Framework (adequacy decision under Art. 45 GDPR).

3. Fonts and icons

All fonts, icons and images are stored on this site's own server. Your browser does not connect to Google Fonts, icon libraries or any other third-party service to display these pages.

4. Your cookie choice

When you press Accept or Decline, your choice is saved in your browser's local storage (key: mf-consent) so you aren't asked again on every page. This is strictly necessary to respect your choice (§ 25(2) no. 2 TDDDG). It stays until you clear your browser data. You can change it at any time using Cookie settings at the bottom of every page.

If your browser sends a Global Privacy Control (GPC) signal, I treat it as a decline and analytics is not loaded.

5. Google Analytics (only if you accept)

If, and only if, you press Accept, this site loads Google Analytics 4, a web analytics service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps me see how many people visit and which pages are useful. Nothing is loaded from Google before you agree.

Google Analytics sets cookies (_ga and _ga_*, which last up to 2 years) and processes information such as the pages you view, how long you stay, the approximate location (country/city), device and browser type, and where you came from. According to Google, Google Analytics 4 does not log or store full IP addresses. I do not use Google Signals, advertising features or user IDs, and I can't identify you personally from this data. Data is kept for 2 months and then deleted automatically.

The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can withdraw it at any time with Cookie settings; this doesn't affect processing before you withdrew. Data may be transferred to Google LLC in the USA, which is certified under the EU–US Data Privacy Framework (adequacy decision under Art. 45 GDPR). I have accepted Google's data processing terms. More information: Google Privacy Policy.

6. The Resources page

The list of downloads on the Resources page is loaded from a published Google Sheet. When you open that page, your browser requests the list from Google's servers (Google Ireland Limited / Google LLC), which receive your IP address and browser information. No cookies are set by this request. Downloads may also be stored on Google Drive, which you connect to when you click a download link.

The legal basis is my legitimate interest in keeping the free resources up to date easily (Art. 6(1)(f) GDPR). Transfers to the USA are covered by the EU–US Data Privacy Framework.

7. Newsletter sign-up

The sign-up forms send the email address you type to Substack, where my Fletchucation newsletter is hosted (Substack, Inc., San Francisco, USA). You then confirm your subscription on Substack. From that point on, Substack handles your subscription under its own privacy policy, and I can see your email address as a subscriber. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in every email.

8. Contacting me

You can reach me by email or with the contact form on the homepage. The form asks for your name, email address, what your message is about and the message itself. Form messages are received and stored by Netlify (see section 2) and forwarded to my email inbox. A hidden spam-trap field helps block automated spam; no cookies are set.

Whichever way you contact me, I use your details and what you write only to reply and, if we agree to work together, to arrange that work. The legal basis is taking steps towards or performing a contract (Art. 6(1)(b) GDPR) or my legitimate interest in answering your message (Art. 6(1)(f) GDPR). I delete the correspondence when it is no longer needed, unless I must keep it for legal reasons (for example, tax records). My email is provided by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), with which I have a data processing agreement. I delete form submissions from Netlify once I have received them.

9. Links to other sites

This site links to my books, newsletter, podcast, SortedClass, Buy Me a Coffee and social media profiles (Instagram, Threads, Bluesky, LinkedIn, Facebook). These are plain links. No data is sent to those services until you click one, and there are no embedded social media plugins. Once you are on another site, its own privacy policy applies.

10. Your rights

Under the GDPR you have the right to:

  • get a copy of the personal data I hold about you (Art. 15)
  • have incorrect data corrected (Art. 16)
  • have your data deleted (Art. 17)
  • restrict how I use it (Art. 18)
  • receive your data in a portable format (Art. 20)
  • withdraw consent at any time, with effect for the future (Art. 7(3))

Right to object (Art. 21 GDPR): where I process your data on the basis of legitimate interest, you can object at any time for reasons arising from your particular situation.

To use any of these rights, email matt@mtfletcher.com. You also have the right to complain to a data protection supervisory authority. The authority responsible for me is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (www.lda.bayern.de).

11. Visitors outside the EU

United Kingdom: you have equivalent rights under the UK GDPR and can complain to the Information Commissioner's Office (ico.org.uk).

United States and elsewhere: I do not sell or share personal information, and I do not use it for targeted advertising or profiling. Residents of California and other US states with privacy laws can ask what I hold, ask me to delete it, or correct it, by emailing me. I will not treat you differently for using these rights.

12. Children

This site is meant for teachers, parents and adult learners. It is not directed at children under 16, and I don't knowingly collect their data. If you believe a child has sent me personal data, please contact me and I will delete it.

13. Security and automated decisions

The site is served only over an encrypted HTTPS connection. I don't use automated decision-making or profiling within the meaning of Art. 22 GDPR.

14. Changes

I'll update this page if the site changes, for example if I add a new service. The date at the top shows when it was last changed.

Rechtlicher Hinweis: Diese Datenschutzerklärung ist auf Englisch verfasst, weil sich die Website auf Englisch an ihr Publikum richtet. Auf Anfrage sende ich gern eine deutsche Fassung. See also the Impressum.