Privacy
In short: no cookies, no ads, no accounts, no forms. A cookieless, self-hosted audience measurement runs on this site; you can object to it below. Embedded third-party content is loaded only after you explicitly agree.
Controller: Niels Hegmans, Johannes-Dech-Str. 49, 50737 Cologne, Germany — mail@legendarium.page
Hosting: Hetzner Online GmbH (Germany). The server processes technically necessary connection data (IP address, time, requested page) in short-lived logs for operational security (Art. 6 (1) (f) GDPR). Fonts, images and scripts are served from this domain — no third-party connections are made when you load a page. One exception is described under „Embedded content“ below.
Audience measurement
To improve this site we use Matomo, self-hosted open-source analytics running on our own server. Matomo uses no cookies and shares no data with third parties — all data stays on our server. Your IP address is anonymised (truncated) before storage. The browser setting „Do Not Track“ is honoured: if it is on, nothing is recorded. What is recorded: the page requested, the referring page, an approximate region, device type and browser, and — if you start a read-aloud — the fact that a page was read aloud (no personal data). The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a data-minimising statistical analysis of site usage). You can object at any time here. Your objection is kept in your browser's local storage (key leg_notrack); as long as it is there, the analytics script is not loaded on this device at all:
Embedded content
Instagram posts. A few pages embed posts from the Instagram account of the rights holders (currently the pages on the film adaptations). They are loaded only after you explicitly click „Load Instagram posts“. Before that no embed element exists on the page and no connection to Meta is made. After your click your browser fetches the posts from the Instagram platform (Meta Platforms Ireland Limited); your IP address and browser data are transmitted to Meta, and Meta can link the request to an account you are logged into. A transfer to the USA is possible. The legal basis is your consent (Art. 6 (1) (a) GDPR). Your choice is stored in your browser’s local storage for 90 days (key leg-ig-ok) and can be withdrawn in the same place at any time (Art. 7 (3) GDPR); withdrawing unloads the posts immediately. Meta’s own information: Instagram privacy policy.
YouTube videos. Some pages embed a video (currently theatrical trailers on the pages about the film adaptations). It is loaded only after you explicitly click „Load video“; before that no embed element exists on the page. We use the no-cookie player (youtube-nocookie.com), which avoids advertising cookies on mere playback but does not replace your consent: after your click your browser loads the video from Google Ireland Limited, transmitting your IP address and browser data, and Google can link the request to an account you are logged into. A transfer to the USA is possible. The legal basis is your consent (Art. 6 (1) (a) GDPR). That consent covers YouTube only — Instagram and YouTube are asked and stored separately (key leg-yt-ok, 90 days), and can be withdrawn in the same place at any time (Art. 7 (3) GDPR); withdrawing unloads the video immediately. Google’s own information: Google privacy policy.
Press-review preview images. On the News page the press-review tiles can show each outlet’s own preview image (og:image). These images are loaded only after you explicitly click „Load preview images“; before that no image element exists on the page and no connection to any outlet is made. After your click your browser loads the images directly from the outlets’ servers, transmitting your IP address and browser data to them. Which servers those are is named in the consent text on the News page. We store no copies and send no referrer (referrerpolicy="no-referrer"), so the outlets do not learn which page you are reading. The legal basis is your consent (Art. 6 (1) (a) GDPR). That consent covers the preview images only — Instagram, YouTube and the outlets are asked and stored separately (key leg-bild-ok, 90 days), and can be withdrawn in the same place at any time (Art. 7 (3) GDPR); withdrawing removes the images immediately.
Display setting in local storage
On the News page you can hide items about the series “Rings of Power” and limit the list to items written in the language of the page you are on. So that the settings still hold on your next visit, they are kept in your browser's local storage (keys leg-news-ohne-serie and leg-news-nur-sprache). These are pure display settings: they contain no personal data, are transmitted to nobody, and are not a consent — they are required for a function you asked for yourself. Unticking a box at the same place deletes its entry.
Two further entries work the same way. On an entry page you can say how far you have read; the spoiler veil then keeps only what is told later than that (key leg-vorhang-stufe, a number from 1 to 6). And when you open a stage of a reading path, the path, the stage and the page you came from are noted so that the home page can offer you the next one (keyleg-wanderung). Both stay on your device, are transmitted to nobody, and are not a consent. „Veil everything“ and „Forget journey“ delete the respective entry.
Five further entries only remember how you have set the site up. Your choice between light and dark is kept under leg-theme, the one between the book workshop and the modern presentation under leg-stil. The read-aloud player remembers the last recording with its position (leg-ra) and your queue (leg-ra-q), so that an article keeps playing across a page change. And the daily riddle on the home page notes the day and the length of your streak (leg-raetsel). These five also stay on your device, are transmitted to nobody, and are not a consent — they are required for the function you chose yourself (§ 25 (2) no. 2 TDDDG). Clearing your browser's local storage for this site removes them all.
Error reports
You can report an error in a paragraph or summary using the flag symbol. Transmitted and stored are: the address of the page, the chosen sentence with its section and canon mark, the chosen category, your note (if any), the language and the time. Optionally you may give an email address for a reply and a name or pseudonym for a thank-you; both are stored separately from the report and never published. The email address is deleted once we have replied.
To prevent abuse your IP address is not stored. The server derives a short value from it and a key that changes daily; that value lives only in memory, allows at most five reports a day per sender and expires after 24 hours. A sum set by the server itself replaces third-party services; no cookies are set. Reports are pre-sorted automatically at night; only the sentence, the category and the note are processed, never name or email. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in accurate content and in preventing abuse), and Art. 6(1)(a) GDPR for the optional details. A report is deleted once it has been dealt with, and after twelve months at the latest.
You have the rights under Art. 15–21 GDPR and the right to lodge a complaint with a supervisory authority. Last updated: September 2026 (error reports added).