hohl.dev
EN
See the apps

Privacy policy

This privacy policy covers the website hohl.dev and every site under hohl.dev except beasties.hohl.dev. The apps have their own privacy policies; Beasties has one joint privacy policy for the app and its website beasties.hohl.dev (section 7).

1. Controller

The controller for data processing on these websites within the meaning of the General Data Protection Regulation (GDPR) is:

Barnabas Hohl
Fehrenbachstr. 32
51067 Köln
Germany
Email: [email protected]

2. Overview

The websites are deliberately lean. Personal data is only processed where it is needed to run them or where you write to us yourself. In detail:

  • When you open the websites, technical access data is processed (sections 3 and 4).
  • No cookies are set for visitors. There is no visitor counting, no tracking and no advertising (sections 5 and 6).
  • The apps store your data on your device. They have their own privacy policies (section 7).
  • If you send us an email, we process it to reply to you (section 8).
  • Messages sent through the contact form stay on the hohl.dev server and are deleted after twelve months at the latest (section 9).

3. Hosting and Cloudflare

The websites run on the operator’s own server in Germany (self-hosting). No external hosting provider is involved.

The connection from the internet to the server runs through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”). Cloudflare provides the encrypted connection (https), caches content of the websites and protects against attacks. All requests pass through Cloudflare’s servers. Cloudflare processes your IP address and the data of each request. If a request looks suspicious, Cloudflare may set a technically necessary cookie to protect against automated access (such as __cf_bm or cf_clearance).

Cloudflare also asks your browser, through Network Error Logging (NEL), to report failed connections to Cloudflare (a.nel.cloudflare.com). Such a report contains your IP address, the requested address and the type of error. It is used to detect connection problems.

Cloudflare acts as a processor; a data processing agreement is in place. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is reliable and secure delivery of the websites without exposing the server directly to the internet.

Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision for this framework. In addition, the Commission’s standard contractual clauses have been agreed.

4. Server log files

When you open a page, access data is stored automatically in an access log on the operator’s server:

  • IP address
  • date and time of the request
  • requested address (URL)
  • referrer (the previously visited page, if sent)
  • browser and operating system (user agent)
  • HTTP status code and amount of data transferred

If an error occurs while a request is processed, the server software may also log an error message, which can contain your IP address. The data is processed to ensure security and technical operation, for example to find errors and detect attacks. It is not combined with other data sources. The legal basis is Art. 6(1)(f) GDPR.

The log files are limited to 15 MB in total. Once that size is reached, the oldest entries are deleted continuously. In addition, they are deleted completely whenever the server environment is recreated, for example for an update of the web server. How long an entry is kept therefore depends on the number of requests.

5. Cookies and browser storage

The websites set no cookies for visitors. Only logging in to the WordPress admin area sets technically necessary login cookies, which concerns the operator alone. For Cloudflare cookies, see section 3.

If you choose between light and dark mode, your browser keeps that choice in its local storage (localStorage, entry “hohl.theme”) so it stays for your next visit. The entry never leaves your device and is removed as soon as you choose “System” again. This storage is strictly necessary to provide the function you asked for (§ 25(2) no. 2 TDDDG).

6. No tracking, no third-party content

The websites use no visitor counting and no tracking services, and show no advertising. There is no comment function, no newsletter, no social media plugins and no embedded videos. The contact form (section 9) runs entirely on the operator’s own server.

Fonts, images and everything else load from the operator’s own server. No content from Google Fonts, content delivery networks or other third parties is embedded. The SEO plugin in use (Rank Math) sends no visitor data to third parties. Connections to third parties only arise as described in section 3 or when you click a link, for example to the App Store. The privacy terms of that provider then apply.

The site search runs in your browser: your browser loads a search index from the server, and results appear as you type, without your search terms being sent. Only if you press Enter without choosing a result, or open the link to all results, is your search term sent to the server as part of the address (URL) and stored in the access log like any address (section 4). If nothing is found, the search offers a link that opens an email to us in your email program with your search term as the subject.

7. The apps

This privacy policy only covers the websites. What an app does with your data is explained in that app’s own privacy policy, which is linked on the app’s website and in the App Store. Purchases in the apps go through Apple’s App Store.

The app Beasties and its website beasties.hohl.dev are covered together by the Beasties privacy policy, which is available in every language of that website. This privacy policy does not apply to beasties.hohl.dev.

8. Contact by email

If you email us, for example at [email protected] or another address at hohl.dev, we process your email address, your name if given and the content of your message including attachments to handle your request. Emails to addresses at hohl.dev are forwarded through Cloudflare’s Email Routing service (section 3) to a mailbox of the operator at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Gmail), and stored there. Google may also transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is answering your request. Where a contract is concerned, the legal basis is Art. 6(1)(b) GDPR. We delete your emails once the request is settled and no statutory retention duties apply.

9. Contact form

You can send us a message through the contact form. We store your email address, your name if you give it, the topic you chose, your message, the language of the page and the time. The message is not sent by email; it is saved in the website’s database on the hohl.dev server and read there by the operator. Like every page request, the transfer runs through Cloudflare (section 3); beyond that, no third party receives the message. The form sets no cookie.

To keep spam out, the form contains a field that only automated programs fill in, and it checks how quickly it is sent. To stop the form from being used in bulk, a one-way check value (hash) of your IP address is kept for one hour. The IP address itself is not stored with the message.

We process this data to answer your request and to contact you about it by email. You confirm this with a tick before sending; the time of your consent is stored as well. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, for example by email to [email protected]; we then delete your message. For protecting the form from abuse, the legal basis is Art. 6(1)(f) GDPR. Where a contract or steps towards one are concerned, the legal basis is Art. 6(1)(b) GDPR. Without an email address we cannot reply. We delete the message once your request is settled, and after twelve months at the latest; the website deletes older messages automatically. If we reply by email, section 8 applies to that email.

10. SSL/TLS encryption

For security reasons the websites use SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

11. Recipients and transfers to third countries

Recipients of personal data are:

  • Cloudflare, Inc. as processor for the connection to the server and for forwarding emails (sections 3 and 8)
  • Google Ireland Limited (Gmail) as the operator’s email provider for emails you send us (section 8)

Transfers to the USA are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework. There is no automated decision-making, including profiling. Providing data is neither a legal nor a contractual requirement.

12. Your rights

You have the following rights towards the controller regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object

Where processing is based on Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. The data will then no longer be processed unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection authority. The authority responsible for the operator is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

An informal message to the email address in section 1 is enough to exercise your rights.

13. Updates

This privacy policy is dated 19 October 2026. It will be updated when the websites, the apps or the legal requirements change.