Privacy Policy

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

Daniel Kurfess
Forststr. 7
70794 Filderstadt, Germany
Email: hello [at] leandesignsystem [dot] org

Lean Design System is maintained in Germany and both the website and the documentation site are hosted in the European Union.

No cookies, no analytics, no tracking

Neither site sets cookies, uses analytics or tracking services, or embeds third-party content. Fonts are hosted on our own servers, so opening either site does not trigger requests to font providers such as Google Fonts.

The documentation site remembers your light/dark theme choice using your browser's local storage. This value stays on your device, is never sent to us, and exists only so the site can restore your preference on your next visit.

The documentation site's search runs entirely in your browser against a static index built at deploy time (Pagefind). No search query is sent to us or to any third party.

Hosting

Both sites are hosted by BunnyWay d.o.o. (bunny.net), a company based in Slovenia in the European Union, each on its own storage and pull zone. Your data does not leave the EU when you visit either site.

We have switched off request logging for both sites: Bunny does not write your IP address, the requested page, the referring page, or your browser and operating system information to any log. Bunny still needs to see your IP address for the brief moment it takes to send you the page, the same way any server on the internet does, but nothing is stored afterwards.

Legal basis for this transient connection handling: our legitimate interest in operating the sites, Art. 6(1)(f) GDPR.

Domain name resolution

Both leandesignsystem.org and docs.leandesignsystem.org use Cloudflare, Inc. (USA) as their DNS provider. Website traffic itself is not routed through Cloudflare; only the technical lookup of the domain name is answered by Cloudflare's name servers.

Links to other sites

The sites link to GitHub. Once you follow such a link, GitHub's own privacy policy applies: docs.github.com/privacy.

Contact by email

If you write to us, we process your email address and the content of your message to answer you. Legal basis: Art. 6(1)(f) GDPR (answering your enquiry) or Art. 6(1)(b) GDPR where your enquiry relates to a contract. We delete correspondence once it is no longer needed, unless statutory retention duties apply.

An open methodology, no account needed

The methodology itself is published as a public repository on GitHub. Reading it requires no account, no sign-in, and no personal data: you can browse the website, the documentation, and the repository without telling us who you are. We run no backend servers and keep no user database.

Visiting the repository

The repository is hosted by GitHub, Inc. (USA). When you open a page on github.com, GitHub processes your data under its own privacy policy (docs.github.com/privacy). We receive none of this data.

Contributing

If you choose to contribute, for example by starring the repository, opening an issue, or submitting a pull request, you do so with your own GitHub account under your own agreement with GitHub. Contributions to a public repository are public: your GitHub username and the content you submit become part of the project's openly visible history. We see this public activity like anyone else, and nothing beyond it.

Legal basis for processing the contributions we receive: our legitimate interest in maintaining an open-source project, Art. 6(1)(f) GDPR.

We do not sell or share your personal data with third parties for their own purposes. The recipients that exist are:

• BunnyWay d.o.o. (Slovenia, EU): hosting for both the website and the documentation site, as our processor under Art. 28 GDPR.
• GitHub, Inc. (USA): hosting of the public repository, under your own agreement with GitHub. Where data is transferred to the USA, GitHub is certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection (Art. 45 GDPR).
• Cloudflare, Inc. (USA): DNS resolution for both domains only; no website content or visitor traffic passes through Cloudflare.

We keep no user database and no request logs for either site. The documentation site's theme preference lives only in your browser's local storage; we never receive it, and it stays until you clear your browser data. Email correspondence is deleted once it is no longer needed, unless statutory retention duties apply. Public contributions on GitHub (issues, pull requests, commits) remain part of the repository's history; they are managed through GitHub and your GitHub account.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have inaccurate data corrected (Art. 16),
• have your data deleted (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object to processing based on legitimate interests (Art. 21), and
• withdraw any consent at any time with effect for the future (Art. 7(3)).

In practice we hold almost no personal data about you, usually nothing beyond email you have sent us. The fastest way to exercise these rights is to email us at hello [at] leandesignsystem [dot] org.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority of the German federal state where you live or where we are based (Art. 77 GDPR).

We do not use automated decision-making or profiling.

Lean Design System is aimed at design and development professionals and is not directed at children. If you are under 16, please only contact us or contribute with the consent of a parent or guardian.

If we change this policy, we will publish the new version here with an updated date.