Privacy Policy
This is an English translation for convenience. The German version is legally authoritative.
1. Controller
Marcel Pauly
Ericusspitze 1
20457 Hamburg
Email: marcel.pauly@spiegel.de
2. This website does not use cookies
No cookies are set, neither strictly necessary nor tracking-related. The language switch
(German/English) works purely through the URL you visit (/de/ or /en/),
not through cookies or session data. No cookie-consent banner is required.
3. Hosting and server log files
This website is operated by an external hosting provider. TODO: add the hosting provider's name/address and, if applicable, a reference to a data-processing agreement. When you visit the site, the hosting provider automatically processes technical access data (including IP address, date and time, page requested, browser used) in server log files. This serves the technical provision and security of the website (attack detection, error analysis). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, functional operation of the website). Retention follows the hosting provider's standard policy.
4. Anonymized traffic measurement (self-hosted)
Page views are counted anonymously using a self-built counter that runs locally on this server – no cookies, no data shared with third parties, no database involved.
- Per page view, only a simple hit counter for the page is recorded.
- To estimate unique visits, a one-way hash is computed from the IP address, browser identifier (user agent), and a secret value that rotates daily (a "pepper"). The raw IP address is never stored – only this hash.
- Because the underlying daily value changes every day, the stored hashes cannot be linked across multiple days. Recognizing an individual person or device beyond a single day is not possible.
- Daily statistics files are automatically deleted after 14 months.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in anonymized traffic measurement to improve the site). No consent banner is required, since no cookies are set and no identifiers that would allow recognition across devices or over time are stored.
5. Contact by email
If you contact me by email, the data you provide (e.g. email address, message content) is processed solely to handle your request. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where the request relates to entering into a contract.
For confidential tips, you can also use the secure channels listed in the contact section (e.g. Signal, PGP encryption).
6. External links and profiles
This site links to articles on spiegel.de and to profiles on LinkedIn, Bluesky, and GitHub. Clicking such a link takes you to that provider's own site, where their privacy policy applies. No content or scripts from these platforms are embedded or loaded automatically.
7. Your rights
Under the GDPR, you have the right to:
- access the data processed about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing (Art. 21 GDPR)
- lodge a complaint with a supervisory authority (Art. 77 GDPR)
No data protection officer has been appointed, as none is legally required. TODO: review/adjust if circumstances change.
Last updated
This privacy policy was last updated on 2026-09-12.