cli·coach

Privacy Policy

Applies to cli.coach and all its subdomains (*.cli.coach), including the trainers at tmux.cli.coach, vim.cli.coach, mutt.cli.coach and gpg.cli.coach.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Marvin Winkler
Softwareentwicklung
Dachauer Str. 15
85256 Vierkirchen
Germany
Phone: +49 157 51982847
Email: privacy@winkler.software

2. Hosting and email

This website is hosted on servers of netcup GmbH, Emmy-Noether-Str. 10, 76131 Karlsruhe, Germany. The servers are located in Germany. We have concluded a data processing agreement with netcup in accordance with Art. 28 GDPR, which ensures that our visitors' data is processed only on our instructions and in compliance with the GDPR.

cli.coach has no mail service of its own; please use the addresses at @winkler.software given in this policy. The mail servers for emails to addresses at @winkler.software are hosted by OVH S.A.S., 2 rue Kellermann, 59100 Roubaix, France. The servers are located within the European Union. We have concluded a data processing agreement with OVH in accordance with Art. 28 GDPR. No data is transferred to third countries.

3. Visiting the website, server log files and security

cli.coach itself — the home page and these legal pages — consists of static HTML and CSS only and contains no JavaScript. Each trainer subdomain serves a JavaScript application that runs entirely in your browser; section 4 describes it in detail. On all of our pages we use no cookies, no analytics or tracking services and no content from third parties such as external fonts or CDNs. Every file is loaded from the same host you are visiting.

Each time our website is accessed, the server automatically records the following data in a log file:

No other information, such as other headers of your request, is logged. Technical messages and error messages of the web server (e.g. during connection set-up or for requests to host names that are not configured), which may contain an IP address, are stored in the server's system log. All of these logs are deleted automatically after 7 days at the latest. The data is not combined with other data sources.

Use of Fail2ban to prevent attacks

To protect our servers against attacks (e.g. brute-force attacks, unauthorised access attempts or automated scans), we analyse these log files and the logs of login attempts to the server (SSH: IP address, time and user name used) locally with the software “Fail2ban”. If the system detects abusive behaviour, the IP address concerned is temporarily blocked for the affected service, for no longer than 48 hours. The block list is cleaned up after 5 days at the latest. The logs and the block list remain on our server; they are neither passed on to third parties nor transferred to third countries.

The legal basis for the temporary storage in log files and their analysis is our legitimate interest in providing the website and in the integrity, confidentiality and availability of our IT systems (Art. 6(1)(f) GDPR). Providing the IP address is technically necessary to access the website; there is no legal or contractual obligation to do so. The connection is encrypted with TLS; unencrypted requests via http:// are redirected to the encrypted address and are logged as described above.

4. The trainers and your learning progress

The four trainers at tmux.cli.coach, vim.cli.coach, mutt.cli.coach and gpg.cli.coach are JavaScript applications that run entirely in your browser. There is no backend and no user account. Once the page has loaded, the trainer makes no further requests, to us or to anyone else.

So that you can pick up where you left off, each trainer saves your progress — which keys you have practised and how well, where you are in the course, and the settings you chose in the simulator — in your browser's local storage (localStorage). It stays on your device and is never sent to us: our server is a plain file server and has no facility to receive it. It holds no name, no email address, no account and no identifier that could be used to recognise you. We use no cookies and no other browser storage.

Legal basis for this storage

Storing information on your terminal equipment — which includes a browser's local storage, not only cookies — is governed by § 25 TDDDG. We save this entry without asking for your consent because it is strictly necessary in order to provide a service you have explicitly requested (§ 25(2) no. 2 TDDDG): a trainer whose purpose is to track your learning progress and resurface the keys you are shakiest on cannot work without remembering it. For that reason we show no consent banner. Insofar as this entry constitutes personal data at all, the legal basis is our legitimate interest in providing a learning application that works (Art. 6(1)(f) GDPR).

Deleting your progress

You can erase it from inside the app at any time: open the settings menu at the top right and choose “Erase all saved progress…”. After a confirmation it clears everything that trainer has stored — your progress, your trainer settings and the configuration file you built in the simulator — and the trainer starts again from the beginning. Each trainer stores its own data separately, so do this in each one you have used. You can also delete the site data for the subdomain in your browser's settings.

5. Contacting us by email

If you contact us by email, we store the information you provide (e.g. email address, name, content of the message) in order to handle your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or is necessary for pre-contractual measures, and otherwise our legitimate interest in handling enquiries addressed to us (Art. 6(1)(f) GDPR).

We delete this data as soon as it is no longer needed for handling your enquiry, at the latest 12 months after the correspondence has ended, unless statutory retention obligations (in particular § 147 AO and § 257 HGB for business letters and invoices, 6 or 8 years) prevent this.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). To exercise your rights, an email to privacy@winkler.software is sufficient.

Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint (Art. 77 GDPR)

You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de

7. Automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place. The temporary blocking of individual IP addresses by Fail2ban (section 3) is a purely technical protective measure without legal or similarly significant effect. The strength scores and review dates that a trainer calculates in your browser (section 4) serve only to select your next exercise; they are not transmitted to us and have no effect outside the trainer.

Last updated: 28 October 2026