Tokenwerk · The LLM textbook

Privacy policy

Last updated: 7 October 2026

1. Controller

The controller within the meaning of Art. 4 (7) GDPR for this website is:

Provider
Marvin Kicha
Address
Hueskenboerde 34
45136 Essen
Germany
Email
hello@deckle.io

No data protection officer has been appointed. There is no obligation to do so: fewer than twenty people are permanently involved in automated processing (§ 38 (1) BDSG), and there is neither extensive regular monitoring nor extensive processing of special categories of data (Art. 37 (1) GDPR).

2. In short

Tokenwerk has no accounts, sets no cookies and does no audience measurement. Your reading progress, your notes and your experiment settings are stored only in your browser and are not sent to us. Our server only delivers the pages and files of this textbook.

3. What stays in your browser

So that you can pick up where you left off, the website stores the following in your browser’s local storage:

  • which chapters you have marked as completed and where you last read
  • your notes on the exercises and your answers in the comprehension checks
  • settings and predictions in the experiments
  • whether you have expanded or collapsed the model blueprint

Legally, this is storing information on your device within the meaning of § 25 TDDDG. No consent is required for this, because the storage is strictly necessary to provide the function you have requested (§ 25 (2) no. 2 TDDDG). We do not process this data, as it never reaches us. You can remove it by deleting the site data for tokenwerk.deckle.io in your browser.

“Export” creates a file with your progress directly in your browser; “Import” reads such a file back in there. The file is not uploaded.

4. This website

The website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. When you visit it, the server processes the usual access data (IP address, time, page requested, amount of data transferred, referrer, user agent) in server logs. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in secure and trouble-free operation. The logs are kept only as long as necessary for this purpose and are then deleted automatically.

Hetzner Online GmbH acts as our processor under Art. 28 GDPR; a corresponding contract is in place. The servers are located in Germany, and no data is transferred to a third country.

  • This website sets no cookies.
  • There is no audience measurement and no analytics.
  • Fonts, images and program code are served from our own server. There is no connection to Google Fonts or any other third party.
  • All experiments, including training the small model, run in your browser. Text you enter does not leave your device.
  • No maps, videos, social media elements or other third-party content are embedded.

5. Downloads and the Python project

The Python project and the reading edition are loaded as files from our server; the information in section 4 applies. After that, the project runs on your own computer and sends nothing to us. Only the optional script fetch_tinystories.py, if you start it yourself, downloads a public dataset from Hugging Face (Hugging Face, Inc., USA); Hugging Face’s privacy policy applies to that connection.

6. Links to sources

The textbook refers to papers and other sources. If you follow such a link, the respective provider’s page opens; that provider is responsible for any processing there.

7. Contact by email

If you send us an email, for example to point out a mistake, we process your address and your message in order to reply and to check your note. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in answering enquiries and correcting content. We delete the correspondence as soon as the matter has been dealt with, at the latest after 12 months, unless a statutory retention obligation applies.

8. What does not happen

  • no advertising
  • no tracking, no analytics tools, no embedded third-party services
  • no account and no sign-up
  • no automated decision-making within the meaning of Art. 22 GDPR
  • no selling or sharing of data

9. Storage period

Data in your browser’s local storage stays there until you delete it. This website’s logs are deleted automatically as soon as they are no longer needed for secure operation (section 4). For emails, the period from section 7 applies.

10. Your rights

You have the following rights with respect to us:

  • access to the personal data processed about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)

Because we do not keep accounts and cannot identify you, we are generally unable to attribute any particular processing to you (Art. 11 GDPR). Regardless of this, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Authority
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Address
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Website
ldi.nrw.de

You can also contact the supervisory authority of your habitual residence or place of work.

11. Changes

We update this policy when the website or the legal situation changes. The version published here applies; the date at the top shows when it was last updated.