The latest articles on Forem by James (@james12345000). https://forem.com/james12345000 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3922069%2Fe6e17221-d0b6-4f6d-98b9-cc53e335ed89.png https://forem.com/james12345000 en James Wed, 13 May 2026 23:05:43 +0000 https://forem.com/james12345000/minimum-viable-dsgvo-compliance-for-startups-34mh https://forem.com/james12345000/minimum-viable-dsgvo-compliance-for-startups-34mh <h1> The 5-Minute DSGVO Compliance Checklist for Web Projects </h1> <p>DSGVO compliance isn't a legal essay. It's a set of technical and procedural decisions. Here's the checklist we use before any project launch.</p> <h2> Data Collection </h2> <ul> <li>[ ] <strong>List all data you collect</strong> (name, email, IP, cookies, analytics)</li> <li>[ ] <strong>For each: why do you need it?</strong> (purpose limitation)</li> <li>[ ] <strong>For each: how long do you keep it?</strong> (storage limitation)</li> <li>[ ] <strong>Can you delete it on user request?</strong> (right to erasure)</li> </ul> <h2> Technical Measures </h2> <ul> <li>[ ] <strong>HTTPS everywhere</strong> (TLS 1.3)</li> <li>[ ] <strong>No third-party trackers</strong> (Google Analytics, Facebook Pixel) without consent</li> <li>[ ] <strong>Cookie banner</strong> for non-essential cookies (strict opt-in)</li> <li>[ ] <strong>Server location</strong> in EU (or SCCs for non-EU)</li> <li>[ ] <strong>Access logs</strong> stripped of PII or rotated after 30 days</li> <li>[ ] <strong>Database encryption</strong> at rest</li> </ul> <h2> Documentation </h2> <ul> <li>[ ] <strong>Privacy policy</strong> (German + English, plain language)</li> <li>[ ] <strong>Data processing agreement</strong> (if using third-party services)</li> <li>[ ] <strong>Incident response plan</strong> (72-hour notification requirement)</li> <li>[ ] <strong>User rights procedure</strong> (how to handle access/erasure requests)</li> </ul> <h2> Team </h2> <ul> <li>[ ] <strong>Data protection officer</strong> (required for &gt; 10 employees processing personal data)</li> <li>[ ] <strong>Employee training</strong> (annual, documented)</li> <li>[ ] <strong>Access controls</strong> (role-based, minimal privilege)</li> </ul> <h2> Quick Wins </h2> <p><strong>Replace Google Analytics</strong> with Plausible (€9/month, EU-hosted, no cookies).<br> <strong>Replace reCAPTCHA</strong> with hCaptcha or Friendly Captcha (better privacy posture).<br> <strong>Host in EU</strong> (Hetzner, OVH, Scaleway — all cheaper than AWS anyway).</p> <h2> The Honest Truth </h2> <p>Most DSGVO violations aren't malicious. They're careless:</p> <ul> <li>Forgetting to add a privacy policy</li> <li>Logging IPs indefinitely</li> <li>Using US-hosted analytics without SCCs</li> <li>Not documenting data flows</li> </ul> <p>This checklist fixes the careless mistakes. The hard stuff (legitimate interest assessments, DPIAs) comes later — but only after the basics are solid.</p> <p><em>Graham Miranda is the founder of Graham Miranda UG (Berlin, HRB 36794), building DSGVO-compliant automation and privacy tools.</em></p> infrastructure selfhosted vps hetzner James Wed, 13 May 2026 23:04:38 +0000 https://forem.com/james12345000/launching-in-germany-run-this-checklist-first-4k14 https://forem.com/james12345000/launching-in-germany-run-this-checklist-first-4k14 <h1> The 5-Minute DSGVO Compliance Checklist for Web Projects </h1> <p>DSGVO compliance isn't a legal essay. It's a set of technical and procedural decisions. Here's the checklist we use before any project launch.</p> <h2> Data Collection </h2> <ul> <li>[ ] <strong>List all data you collect</strong> (name, email, IP, cookies, analytics)</li> <li>[ ] <strong>For each: why do you need it?</strong> (purpose limitation)</li> <li>[ ] <strong>For each: how long do you keep it?</strong> (storage limitation)</li> <li>[ ] <strong>Can you delete it on user request?</strong> (right to erasure)</li> </ul> <h2> Technical Measures </h2> <ul> <li>[ ] <strong>HTTPS everywhere</strong> (TLS 1.3)</li> <li>[ ] <strong>No third-party trackers</strong> (Google Analytics, Facebook Pixel) without consent</li> <li>[ ] <strong>Cookie banner</strong> for non-essential cookies (strict opt-in)</li> <li>[ ] <strong>Server location</strong> in EU (or SCCs for non-EU)</li> <li>[ ] <strong>Access logs</strong> stripped of PII or rotated after 30 days</li> <li>[ ] <strong>Database encryption</strong> at rest</li> </ul> <h2> Documentation </h2> <ul> <li>[ ] <strong>Privacy policy</strong> (German + English, plain language)</li> <li>[ ] <strong>Data processing agreement</strong> (if using third-party services)</li> <li>[ ] <strong>Incident response plan</strong> (72-hour notification requirement)</li> <li>[ ] <strong>User rights procedure</strong> (how to handle access/erasure requests)</li> </ul> <h2> Team </h2> <ul> <li>[ ] <strong>Data protection officer</strong> (required for &gt; 10 employees processing personal data)</li> <li>[ ] <strong>Employee training</strong> (annual, documented)</li> <li>[ ] <strong>Access controls</strong> (role-based, minimal privilege)</li> </ul> <h2> Quick Wins </h2> <p><strong>Replace Google Analytics</strong> with Plausible (€9/month, EU-hosted, no cookies).<br> <strong>Replace reCAPTCHA</strong> with hCaptcha or Friendly Captcha (better privacy posture).<br> <strong>Host in EU</strong> (Hetzner, OVH, Scaleway — all cheaper than AWS anyway).</p> <h2> The Honest Truth </h2> <p>Most DSGVO violations aren't malicious. They're careless:</p> <ul> <li>Forgetting to add a privacy policy</li> <li>Logging IPs indefinitely</li> <li>Using US-hosted analytics without SCCs</li> <li>Not documenting data flows</li> </ul> <p>This checklist fixes the careless mistakes. The hard stuff (legitimate interest assessments, DPIAs) comes later — but only after the basics are solid.</p> <p><em>Graham Miranda is the founder of Graham Miranda UG (Berlin, HRB 36794), building DSGVO-compliant automation and privacy tools.</em></p> ethics webscraping privacy business James Wed, 13 May 2026 23:03:32 +0000 https://forem.com/james12345000/dsgvo-compliance-in-5-minutes-a-practical-checklist-2l1p https://forem.com/james12345000/dsgvo-compliance-in-5-minutes-a-practical-checklist-2l1p <h1> The 5-Minute DSGVO Compliance Checklist for Web Projects </h1> <p>DSGVO compliance isn't a legal essay. It's a set of technical and procedural decisions. Here's the checklist we use before any project launch.</p> <h2> Data Collection </h2> <ul> <li>[ ] <strong>List all data you collect</strong> (name, email, IP, cookies, analytics)</li> <li>[ ] <strong>For each: why do you need it?</strong> (purpose limitation)</li> <li>[ ] <strong>For each: how long do you keep it?</strong> (storage limitation)</li> <li>[ ] <strong>Can you delete it on user request?</strong> (right to erasure)</li> </ul> <h2> Technical Measures </h2> <ul> <li>[ ] <strong>HTTPS everywhere</strong> (TLS 1.3)</li> <li>[ ] <strong>No third-party trackers</strong> (Google Analytics, Facebook Pixel) without consent</li> <li>[ ] <strong>Cookie banner</strong> for non-essential cookies (strict opt-in)</li> <li>[ ] <strong>Server location</strong> in EU (or SCCs for non-EU)</li> <li>[ ] <strong>Access logs</strong> stripped of PII or rotated after 30 days</li> <li>[ ] <strong>Database encryption</strong> at rest</li> </ul> <h2> Documentation </h2> <ul> <li>[ ] <strong>Privacy policy</strong> (German + English, plain language)</li> <li>[ ] <strong>Data processing agreement</strong> (if using third-party services)</li> <li>[ ] <strong>Incident response plan</strong> (72-hour notification requirement)</li> <li>[ ] <strong>User rights procedure</strong> (how to handle access/erasure requests)</li> </ul> <h2> Team </h2> <ul> <li>[ ] <strong>Data protection officer</strong> (required for &gt; 10 employees processing personal data)</li> <li>[ ] <strong>Employee training</strong> (annual, documented)</li> <li>[ ] <strong>Access controls</strong> (role-based, minimal privilege)</li> </ul> <h2> Quick Wins </h2> <p><strong>Replace Google Analytics</strong> with Plausible (€9/month, EU-hosted, no cookies).<br> <strong>Replace reCAPTCHA</strong> with hCaptcha or Friendly Captcha (better privacy posture).<br> <strong>Host in EU</strong> (Hetzner, OVH, Scaleway — all cheaper than AWS anyway).</p> <h2> The Honest Truth </h2> <p>Most DSGVO violations aren't malicious. They're careless:</p> <ul> <li>Forgetting to add a privacy policy</li> <li>Logging IPs indefinitely</li> <li>Using US-hosted analytics without SCCs</li> <li>Not documenting data flows</li> </ul> <p>This checklist fixes the careless mistakes. The hard stuff (legitimate interest assessments, DPIAs) comes later — but only after the basics are solid.</p> <p><em>Graham Miranda is the founder of Graham Miranda UG (Berlin, HRB 36794), building DSGVO-compliant automation and privacy tools.</em></p> osint intelligence security tools James Wed, 13 May 2026 23:02:26 +0000 https://forem.com/james12345000/search-index-architecture-for-privacy-first-engines-hmd https://forem.com/james12345000/search-index-architecture-for-privacy-first-engines-hmd <h1> Elasticsearch vs. PostgreSQL Full-Text: Search Engine Indexing Deep Dive </h1> <p>Every search engine needs an index. The question is: which technology builds it?</p> <h2> PostgreSQL Full-Text Search </h2> <p>Built-in since PostgreSQL 8.3. Surprisingly capable.</p> <p><strong>Pros:</strong></p> <ul> <li>Zero additional infrastructure</li> <li>ACID compliance (index stays consistent with data)</li> <li>Good for &lt; 1M documents</li> <li>Supports German stemming, compound word handling</li> <li>tsvector/tsquery is fast for simple needs</li> </ul> <p><strong>Cons:</strong></p> <ul> <li>No distributed search</li> <li>Limited faceting and aggregation</li> <li>Relevance scoring is basic</li> <li>No built-in synonym support</li> </ul> <h2> Elasticsearch </h2> <p>The industry standard for search.</p> <p><strong>Pros:</strong></p> <ul> <li>Distributed by design (shards, replicas)</li> <li>Advanced relevance scoring (BM25, custom functions)</li> <li>Real-time indexing</li> <li>Faceting, aggregation, geospatial</li> <li>Plugin ecosystem (synonyms, analyzers)</li> </ul> <p><strong>Cons:</strong></p> <ul> <li>Additional infrastructure (cluster management)</li> <li>Memory hungry (heap size tuning required)</li> <li>Eventually consistent (not ACID)</li> <li>Complex query DSL learning curve</li> </ul> <h2> What We Chose (and Why) </h2> <p>We use <strong>both</strong>:</p> <ul> <li> <strong>PostgreSQL</strong>: Primary data store, user accounts, query logs (minimal), metadata</li> <li> <strong>Elasticsearch</strong>: Search index only, rebuilt from PostgreSQL nightly</li> </ul> <p>This hybrid gives us ACID for critical data and search performance for queries. If Elasticsearch fails, we can rebuild from PostgreSQL. If PostgreSQL is slow for search, Elasticsearch handles it.</p> <h2> German Language Challenges </h2> <p>German search is harder than English:</p> <ul> <li>Compound words ("Datenschutzgrundverordnung")</li> <li>Umlaut normalization (ä → ae or a?)</li> <li>Case inflection</li> <li>Dialect variations</li> </ul> <p>Our solution: Custom Elasticsearch analyzer chain:</p> <ol> <li>ICU tokenizer (handles compound words)</li> <li>German stemmer (Snowball)</li> <li>Umlaut normalizer (ä → a, ö → o, ü → u)</li> <li>Synonym filter (DSGVO → Datenschutzgrundverordnung)</li> </ol> <p><em>Graham Miranda builds search infrastructure at Graham Miranda UG (Berlin, HRB 36794).</em></p> nextjs react frontend privacy James Wed, 13 May 2026 23:01:21 +0000 https://forem.com/james12345000/full-text-search-at-scale-our-indexing-choice-33ai https://forem.com/james12345000/full-text-search-at-scale-our-indexing-choice-33ai <h1> Elasticsearch vs. PostgreSQL Full-Text: Search Engine Indexing Deep Dive </h1> <p>Every search engine needs an index. The question is: which technology builds it?</p> <h2> PostgreSQL Full-Text Search </h2> <p>Built-in since PostgreSQL 8.3. Surprisingly capable.</p> <p><strong>Pros:</strong></p> <ul> <li>Zero additional infrastructure</li> <li>ACID compliance (index stays consistent with data)</li> <li>Good for &lt; 1M documents</li> <li>Supports German stemming, compound word handling</li> <li>tsvector/tsquery is fast for simple needs</li> </ul> <p><strong>Cons:</strong></p> <ul> <li>No distributed search</li> <li>Limited faceting and aggregation</li> <li>Relevance scoring is basic</li> <li>No built-in synonym support</li> </ul> <h2> Elasticsearch </h2> <p>The industry standard for search.</p> <p><strong>Pros:</strong></p> <ul> <li>Distributed by design (shards, replicas)</li> <li>Advanced relevance scoring (BM25, custom functions)</li> <li>Real-time indexing</li> <li>Faceting, aggregation, geospatial</li> <li>Plugin ecosystem (synonyms, analyzers)</li> </ul> <p><strong>Cons:</strong></p> <ul> <li>Additional infrastructure (cluster management)</li> <li>Memory hungry (heap size tuning required)</li> <li>Eventually consistent (not ACID)</li> <li>Complex query DSL learning curve</li> </ul> <h2> What We Chose (and Why) </h2> <p>We use <strong>both</strong>:</p> <ul> <li> <strong>PostgreSQL</strong>: Primary data store, user accounts, query logs (minimal), metadata</li> <li> <strong>Elasticsearch</strong>: Search index only, rebuilt from PostgreSQL nightly</li> </ul> <p>This hybrid gives us ACID for critical data and search performance for queries. If Elasticsearch fails, we can rebuild from PostgreSQL. If PostgreSQL is slow for search, Elasticsearch handles it.</p> <h2> German Language Challenges </h2> <p>German search is harder than English:</p> <ul> <li>Compound words ("Datenschutzgrundverordnung")</li> <li>Umlaut normalization (ä → ae or a?)</li> <li>Case inflection</li> <li>Dialect variations</li> </ul> <p>Our solution: Custom Elasticsearch analyzer chain:</p> <ol> <li>ICU tokenizer (handles compound words)</li> <li>German stemmer (Snowball)</li> <li>Umlaut normalizer (ä → a, ö → o, ü → u)</li> <li>Synonym filter (DSGVO → Datenschutzgrundverordnung)</li> </ol> <p><em>Graham Miranda builds search infrastructure at Graham Miranda UG (Berlin, HRB 36794).</em></p> elasticsearch postgres search database James Wed, 13 May 2026 23:00:15 +0000 https://forem.com/james12345000/building-a-search-index-elasticsearch-vs-postgresql-4ag5 https://forem.com/james12345000/building-a-search-index-elasticsearch-vs-postgresql-4ag5 <h1> Elasticsearch vs. PostgreSQL Full-Text: Search Engine Indexing Deep Dive </h1> <p>Every search engine needs an index. The question is: which technology builds it?</p> <h2> PostgreSQL Full-Text Search </h2> <p>Built-in since PostgreSQL 8.3. Surprisingly capable.</p> <p><strong>Pros:</strong></p> <ul> <li>Zero additional infrastructure</li> <li>ACID compliance (index stays consistent with data)</li> <li>Good for &lt; 1M documents</li> <li>Supports German stemming, compound word handling</li> <li>tsvector/tsquery is fast for simple needs</li> </ul> <p><strong>Cons:</strong></p> <ul> <li>No distributed search</li> <li>Limited faceting and aggregation</li> <li>Relevance scoring is basic</li> <li>No built-in synonym support</li> </ul> <h2> Elasticsearch </h2> <p>The industry standard for search.</p> <p><strong>Pros:</strong></p> <ul> <li>Distributed by design (shards, replicas)</li> <li>Advanced relevance scoring (BM25, custom functions)</li> <li>Real-time indexing</li> <li>Faceting, aggregation, geospatial</li> <li>Plugin ecosystem (synonyms, analyzers)</li> </ul> <p><strong>Cons:</strong></p> <ul> <li>Additional infrastructure (cluster management)</li> <li>Memory hungry (heap size tuning required)</li> <li>Eventually consistent (not ACID)</li> <li>Complex query DSL learning curve</li> </ul> <h2> What We Chose (and Why) </h2> <p>We use <strong>both</strong>:</p> <ul> <li> <strong>PostgreSQL</strong>: Primary data store, user accounts, query logs (minimal), metadata</li> <li> <strong>Elasticsearch</strong>: Search index only, rebuilt from PostgreSQL nightly</li> </ul> <p>This hybrid gives us ACID for critical data and search performance for queries. If Elasticsearch fails, we can rebuild from PostgreSQL. If PostgreSQL is slow for search, Elasticsearch handles it.</p> <h2> German Language Challenges </h2> <p>German search is harder than English:</p> <ul> <li>Compound words ("Datenschutzgrundverordnung")</li> <li>Umlaut normalization (ä → ae or a?)</li> <li>Case inflection</li> <li>Dialect variations</li> </ul> <p>Our solution: Custom Elasticsearch analyzer chain:</p> <ol> <li>ICU tokenizer (handles compound words)</li> <li>German stemmer (Snowball)</li> <li>Umlaut normalizer (ä → a, ö → o, ü → u)</li> <li>Synonym filter (DSGVO → Datenschutzgrundverordnung)</li> </ol> <p><em>Graham Miranda builds search infrastructure at Graham Miranda UG (Berlin, HRB 36794).</em></p> dsgvo gdpr compliance legal James Wed, 13 May 2026 22:59:10 +0000 https://forem.com/james12345000/the-berlin-tech-ecosystem-a-founders-guide-2ip8 https://forem.com/james12345000/the-berlin-tech-ecosystem-a-founders-guide-2ip8 <h1> Running a Tech Business in Berlin: Costs, Compliance, and Community </h1> <p>Berlin isn't the cheapest European city for startups. But it offers something rare: a combination of technical talent, regulatory clarity, and startup density that creates genuine competitive advantage.</p> <h2> Real Costs (2026) </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Expense</th> <th>Monthly Cost</th> </tr> </thead> <tbody> <tr> <td>Office (WeWork / similar)</td> <td>€400-800/person</td> </tr> <tr> <td>Developer salary (mid-level)</td> <td>€4,500-6,500</td> </tr> <tr> <td>Hetzner VPS (production)</td> <td>€15-45</td> </tr> <tr> <td>Legal/accounting (UG)</td> <td>€300-500</td> </tr> <tr> <td>Health insurance (public)</td> <td>€350-450/person</td> </tr> <tr> <td>Rent (1BR apartment)</td> <td>€1,000-1,500</td> </tr> </tbody> </table></div> <p>Total burn for 3-person team: ~€18,000-25,000/month.</p> <h2> Why a UG (Not GmbH) </h2> <p>The Unternehmergesellschaft (UG) is Germany's "mini-GmbH":</p> <ul> <li>€1 minimum capital (vs. €25,000 for GmbH)</li> <li>Same liability protection</li> <li>Same legal standing</li> <li>Must retain 25% of profits until €25,000 reached (then convert to GmbH)</li> </ul> <p>For bootstrapped founders, the UG structure removes the capital barrier entirely.</p> <h2> Compliance Advantage </h2> <p>Berlin-based means:</p> <ul> <li>DSGVO compliance by default (German data protection authority)</li> <li>EU AI Act jurisdiction clear</li> <li>German contract law (predictable, well-tested)</li> <li>Tax treaties across EU and globally</li> </ul> <p>For B2B clients, "Berlin-based" signals regulatory maturity that "Delaware-based" does not.</p> <h2> The Community </h2> <p>Berlin's tech scene is dense and collaborative:</p> <ul> <li>Weekly meetups for every technology stack</li> <li>Strong open-source culture</li> <li>EU-funded research partnerships</li> <li>Talent pool from TU Berlin, HU Berlin, and international graduates</li> </ul> <p>The competition for talent is real. But so is the quality.</p> <p><em>Graham Miranda is the founder of Graham Miranda UG (Berlin, HRB 36794).</em></p> startup berlin privacy founder James Wed, 13 May 2026 22:58:04 +0000 https://forem.com/james12345000/why-we-incorporated-in-berlin-not-delaware-1ml3 https://forem.com/james12345000/why-we-incorporated-in-berlin-not-delaware-1ml3 <h1> Running a Tech Business in Berlin: Costs, Compliance, and Community </h1> <p>Berlin isn't the cheapest European city for startups. But it offers something rare: a combination of technical talent, regulatory clarity, and startup density that creates genuine competitive advantage.</p> <h2> Real Costs (2026) </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Expense</th> <th>Monthly Cost</th> </tr> </thead> <tbody> <tr> <td>Office (WeWork / similar)</td> <td>€400-800/person</td> </tr> <tr> <td>Developer salary (mid-level)</td> <td>€4,500-6,500</td> </tr> <tr> <td>Hetzner VPS (production)</td> <td>€15-45</td> </tr> <tr> <td>Legal/accounting (UG)</td> <td>€300-500</td> </tr> <tr> <td>Health insurance (public)</td> <td>€350-450/person</td> </tr> <tr> <td>Rent (1BR apartment)</td> <td>€1,000-1,500</td> </tr> </tbody> </table></div> <p>Total burn for 3-person team: ~€18,000-25,000/month.</p> <h2> Why a UG (Not GmbH) </h2> <p>The Unternehmergesellschaft (UG) is Germany's "mini-GmbH":</p> <ul> <li>€1 minimum capital (vs. €25,000 for GmbH)</li> <li>Same liability protection</li> <li>Same legal standing</li> <li>Must retain 25% of profits until €25,000 reached (then convert to GmbH)</li> </ul> <p>For bootstrapped founders, the UG structure removes the capital barrier entirely.</p> <h2> Compliance Advantage </h2> <p>Berlin-based means:</p> <ul> <li>DSGVO compliance by default (German data protection authority)</li> <li>EU AI Act jurisdiction clear</li> <li>German contract law (predictable, well-tested)</li> <li>Tax treaties across EU and globally</li> </ul> <p>For B2B clients, "Berlin-based" signals regulatory maturity that "Delaware-based" does not.</p> <h2> The Community </h2> <p>Berlin's tech scene is dense and collaborative:</p> <ul> <li>Weekly meetups for every technology stack</li> <li>Strong open-source culture</li> <li>EU-funded research partnerships</li> <li>Talent pool from TU Berlin, HU Berlin, and international graduates</li> </ul> <p>The competition for talent is real. But so is the quality.</p> <p><em>Graham Miranda is the founder of Graham Miranda UG (Berlin, HRB 36794).</em></p> python webscraping tutorial automation James Wed, 13 May 2026 22:56:59 +0000 https://forem.com/james12345000/berlin-startup-costs-2026-real-numbers-5hk1 https://forem.com/james12345000/berlin-startup-costs-2026-real-numbers-5hk1 <h1> Running a Tech Business in Berlin: Costs, Compliance, and Community </h1> <p>Berlin isn't the cheapest European city for startups. But it offers something rare: a combination of technical talent, regulatory clarity, and startup density that creates genuine competitive advantage.</p> <h2> Real Costs (2026) </h2> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Expense</th> <th>Monthly Cost</th> </tr> </thead> <tbody> <tr> <td>Office (WeWork / similar)</td> <td>€400-800/person</td> </tr> <tr> <td>Developer salary (mid-level)</td> <td>€4,500-6,500</td> </tr> <tr> <td>Hetzner VPS (production)</td> <td>€15-45</td> </tr> <tr> <td>Legal/accounting (UG)</td> <td>€300-500</td> </tr> <tr> <td>Health insurance (public)</td> <td>€350-450/person</td> </tr> <tr> <td>Rent (1BR apartment)</td> <td>€1,000-1,500</td> </tr> </tbody> </table></div> <p>Total burn for 3-person team: ~€18,000-25,000/month.</p> <h2> Why a UG (Not GmbH) </h2> <p>The Unternehmergesellschaft (UG) is Germany's "mini-GmbH":</p> <ul> <li>€1 minimum capital (vs. €25,000 for GmbH)</li> <li>Same liability protection</li> <li>Same legal standing</li> <li>Must retain 25% of profits until €25,000 reached (then convert to GmbH)</li> </ul> <p>For bootstrapped founders, the UG structure removes the capital barrier entirely.</p> <h2> Compliance Advantage </h2> <p>Berlin-based means:</p> <ul> <li>DSGVO compliance by default (German data protection authority)</li> <li>EU AI Act jurisdiction clear</li> <li>German contract law (predictable, well-tested)</li> <li>Tax treaties across EU and globally</li> </ul> <p>For B2B clients, "Berlin-based" signals regulatory maturity that "Delaware-based" does not.</p> <h2> The Community </h2> <p>Berlin's tech scene is dense and collaborative:</p> <ul> <li>Weekly meetups for every technology stack</li> <li>Strong open-source culture</li> <li>EU-funded research partnerships</li> <li>Talent pool from TU Berlin, HU Berlin, and international graduates</li> </ul> <p>The competition for talent is real. But so is the quality.</p> <p><em>Graham Miranda is the founder of Graham Miranda UG (Berlin, HRB 36794).</em></p> ai automation germany business James Wed, 13 May 2026 22:55:53 +0000 https://forem.com/james12345000/building-a-privacy-frontend-with-nextjs-4cb5 https://forem.com/james12345000/building-a-privacy-frontend-with-nextjs-4cb5 <h1> Why We Chose Next.js Over React for Our Privacy Search Engine </h1> <p>Frontend frameworks seem interchangeable. For a privacy-focused product, the choice matters more than you'd think.</p> <h2> The Privacy Problem with SPAs </h2> <p>Traditional React SPAs:</p> <ul> <li>Execute all logic in the browser</li> <li>Make API calls directly to third parties</li> <li>Expose the user's IP to every service</li> <li>Require JavaScript (fingerprinting surface)</li> </ul> <p>For asearchz.online, this was unacceptable. Every API call a user made would expose their IP to Bing, Brave, or other search sources.</p> <h2> Why Next.js (Server-Side Rendering) </h2> <p>With Next.js SSR:</p> <ul> <li>The <strong>server</strong> makes API calls to search sources</li> <li>User IP stays between user and our server only</li> <li>Results are rendered server-side, sent as HTML</li> <li>JavaScript is optional (works without it)</li> </ul> <h2> Performance Benefits </h2> <p>SSR is actually faster for search:</p> <ul> <li>First contentful paint: 200-300ms</li> <li>No hydration delay (content is already HTML)</li> <li>No client-side state management complexity</li> <li>CDN caching of rendered pages</li> </ul> <h2> Trade-offs </h2> <p>Next.js SSR has costs:</p> <ul> <li>Server compute per request (higher than static)</li> <li>Less interactive without client JS</li> <li>Harder to implement real-time features</li> </ul> <p>For a search engine, these trade-offs are minimal. Users want fast results, not real-time collaboration.</p> <h2> The Architecture </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>User → Cloudflare CDN → Next.js Server → FastAPI Backend → Search APIs </code></pre> </div> <p>The user's browser never talks to Bing, Brave, or any search source. Our server does. The user's IP is known only to us — and we don't log it.</p> <p><em>Graham Miranda builds privacy-first infrastructure at Graham Miranda UG (Berlin, HRB 36794).</em></p> privacy search python dsgvo James Wed, 13 May 2026 22:54:48 +0000 https://forem.com/james12345000/nextjs-vs-react-privacy-implications-2m3o https://forem.com/james12345000/nextjs-vs-react-privacy-implications-2m3o <h1> Why We Chose Next.js Over React for Our Privacy Search Engine </h1> <p>Frontend frameworks seem interchangeable. For a privacy-focused product, the choice matters more than you'd think.</p> <h2> The Privacy Problem with SPAs </h2> <p>Traditional React SPAs:</p> <ul> <li>Execute all logic in the browser</li> <li>Make API calls directly to third parties</li> <li>Expose the user's IP to every service</li> <li>Require JavaScript (fingerprinting surface)</li> </ul> <p>For asearchz.online, this was unacceptable. Every API call a user made would expose their IP to Bing, Brave, or other search sources.</p> <h2> Why Next.js (Server-Side Rendering) </h2> <p>With Next.js SSR:</p> <ul> <li>The <strong>server</strong> makes API calls to search sources</li> <li>User IP stays between user and our server only</li> <li>Results are rendered server-side, sent as HTML</li> <li>JavaScript is optional (works without it)</li> </ul> <h2> Performance Benefits </h2> <p>SSR is actually faster for search:</p> <ul> <li>First contentful paint: 200-300ms</li> <li>No hydration delay (content is already HTML)</li> <li>No client-side state management complexity</li> <li>CDN caching of rendered pages</li> </ul> <h2> Trade-offs </h2> <p>Next.js SSR has costs:</p> <ul> <li>Server compute per request (higher than static)</li> <li>Less interactive without client JS</li> <li>Harder to implement real-time features</li> </ul> <p>For a search engine, these trade-offs are minimal. Users want fast results, not real-time collaboration.</p> <h2> The Architecture </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>User → Cloudflare CDN → Next.js Server → FastAPI Backend → Search APIs </code></pre> </div> <p>The user's browser never talks to Bing, Brave, or any search source. Our server does. The user's IP is known only to us — and we don't log it.</p> <p><em>Graham Miranda builds privacy-first infrastructure at Graham Miranda UG (Berlin, HRB 36794).</em></p> infrastructure selfhosted vps hetzner James Wed, 13 May 2026 22:53:42 +0000 https://forem.com/james12345000/server-side-rendering-for-privacy-our-frontend-choice-nal https://forem.com/james12345000/server-side-rendering-for-privacy-our-frontend-choice-nal <h1> Why We Chose Next.js Over React for Our Privacy Search Engine </h1> <p>Frontend frameworks seem interchangeable. For a privacy-focused product, the choice matters more than you'd think.</p> <h2> The Privacy Problem with SPAs </h2> <p>Traditional React SPAs:</p> <ul> <li>Execute all logic in the browser</li> <li>Make API calls directly to third parties</li> <li>Expose the user's IP to every service</li> <li>Require JavaScript (fingerprinting surface)</li> </ul> <p>For asearchz.online, this was unacceptable. Every API call a user made would expose their IP to Bing, Brave, or other search sources.</p> <h2> Why Next.js (Server-Side Rendering) </h2> <p>With Next.js SSR:</p> <ul> <li>The <strong>server</strong> makes API calls to search sources</li> <li>User IP stays between user and our server only</li> <li>Results are rendered server-side, sent as HTML</li> <li>JavaScript is optional (works without it)</li> </ul> <h2> Performance Benefits </h2> <p>SSR is actually faster for search:</p> <ul> <li>First contentful paint: 200-300ms</li> <li>No hydration delay (content is already HTML)</li> <li>No client-side state management complexity</li> <li>CDN caching of rendered pages</li> </ul> <h2> Trade-offs </h2> <p>Next.js SSR has costs:</p> <ul> <li>Server compute per request (higher than static)</li> <li>Less interactive without client JS</li> <li>Harder to implement real-time features</li> </ul> <p>For a search engine, these trade-offs are minimal. Users want fast results, not real-time collaboration.</p> <h2> The Architecture </h2> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>User → Cloudflare CDN → Next.js Server → FastAPI Backend → Search APIs </code></pre> </div> <p>The user's browser never talks to Bing, Brave, or any search source. Our server does. The user's IP is known only to us — and we don't log it.</p> <p><em>Graham Miranda builds privacy-first infrastructure at Graham Miranda UG (Berlin, HRB 36794).</em></p> ethics webscraping privacy business