Privacy policy

Last updated: 19 October 2026

1. Controller

Andreas Behr
Egersfelder Allee 28
12555 Berlin
Germany
Email: [email protected]

2. In short

This website sets no cookies and shows no advertising. For anonymous reach measurement we evaluate the server log files and use our own measuring script that stores nothing in your browser (section 4). We store no IP addresses, no full browser identifiers and no identifier by which you could be recognised later; no data goes to any analytics or advertising service. Fonts and images are served from our own server. Apart from that, we only process the data technically needed to deliver the pages to you, and the data you send us by email.

3. Hosting and server log files

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you open a page, the server automatically processes: IP address, date and time, requested page, amount of data transferred, referrer URL, browser and operating system, your browser's preferred language, the country determined by Cloudflare and the server's processing time. This is necessary to deliver the site and keep it secure (Art. 6(1)(f) GDPR). In addition, a program on our server evaluates the log files for reach measurement; IP addresses and full browser identifiers are not taken over (section 4). Log files are deleted after 14 days at the latest unless they are needed longer to investigate a specific security incident. A data processing agreement with Hetzner is in place (Art. 28 GDPR).

4. Reach measurement

To understand which content is read and where the site has problems, we use our own reach measurement. It runs entirely on our server at Hetzner in Germany; no data is passed on to third parties.

What is recorded: A small script on every page reports to our server the page view with section and loading time, how long the page was visible and how far you scrolled, clicks on links to other websites (only their domain), starting embedded videos or music, switching the language, and technical errors while displaying the page (error message and the script file concerned). In addition: the device class (smartphone, tablet or desktop; the script derives it from the screen size and the kind of input – touch or mouse – and only sends the class, not the resolution) and the country that Cloudflare determines from your IP address.

How visits are counted without identifying you: No cookies are set and nothing is stored in your browser. To group several page views of the same visit, our server forms a hash value from IP address and browser identifier with a random key. This key only exists in memory and is created anew every day; the IP address itself is not stored. Recognising you beyond that day is therefore not possible. Only aggregated per-minute counts are stored permanently, for example "12 views of the festival pages from Germany".

Evaluation of the server log files: For every log line concerning a page view we store a record without IP address: time, requested page (without parameters), status code, whether you came from outside the website, the name of the referring website or search engine, browser and its major version, operating system and device class (derived from the browser identifier, which itself is not stored), country, preferred language, the server's processing time and whether the request came from a bot. We use this to analyse how the website is used and how fast it responds, for example for which browsers or countries responses are particularly slow. These records are deleted automatically after 90 days. In addition, we keep aggregated per-minute counts from the log files (views by section and language, referrers, addresses not found, bots).

Telling people from automated traffic: Many requests come from programs posing as browsers. To remove them from the visitor numbers, the script additionally reports with the page view whether your browser marks itself as remote-controlled (the browser property "webdriver"), and once whether there was any real input on the page (scrolling, typing, clicking or moving the mouse). Both are sent only as yes/no, without positions, keys, movement patterns or the timing of individual inputs. Our server matches these reports with the page view in the log files; for this it uses, for at most 30 minutes, a hash value of IP address and browser identifier with a random key that is replaced every day. Signals from the log files themselves are also taken into account, such as a badly outdated browser version, a missing language setting or very many requests per minute. Only the result is stored in the page view record (see above): whether the script ran, whether there was an input, whether the browser was marked as remote-controlled and the classification derived from it (for example "browser with input", "automated" or "unconfirmed"). In the same way the server adds the device class, the loading time (rounded to a tenth of a second), how long the page was visible (in seconds, at most one hour) and whether the page was read to the end to the record, so that we can analyse these values together – for example how long visitors on smartphones stay or how fast the pages load on tablets.

Legal basis and how to prevent the measurement: The legal basis is our legitimate interest in improving the website, detecting errors and telling real visits from automated traffic (Art. 6(1)(f) GDPR). If your browser sends the "Global Privacy Control" or "Do Not Track" signal, or JavaScript is blocked, the script sends nothing. Your right to object under Art. 21 GDPR remains unaffected (section 9). The aggregated counts contain no personal data and are kept without a fixed deadline. Blocking JavaScript or the browser signals mentioned only affect the measuring script; page views still appear in the server log files.

5. Cloudflare

To protect against attacks and to speed up loading, traffic passes through the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes in particular your IP address and technical connection data. The legal basis is our legitimate interest in secure and fast operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; the EU Commission's standard contractual clauses also apply. To fend off automated traffic, Cloudflare may set a strictly necessary cookie (__cf_bm, valid for 30 minutes). More: cloudflare.com/privacypolicy.

6. Storage in your browser

If you close the language suggestion, your browser remembers this in local storage so the suggestion does not appear again. The entry contains no personal data, is never sent to us and can be deleted at any time in your browser settings.

7. Embedded videos and music

Some articles contain YouTube videos or SoundCloud tracks. They are only loaded when you click on them. Only then is a connection made to the provider (Google Ireland Limited or SoundCloud Global Limited & Co. KG) and your IP address transmitted. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR).

8. Contact by email

When you write to us, we process your message and contact details to reply (Art. 6(1)(b) or (f) GDPR). Emails are stored on our own mail server at Hetzner and deleted when no longer needed, unless retention obligations apply.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time. Just write to [email protected].

You can also lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.