Privacy policy for https://simonjanssen.dev, including its subdomains, in particular api.simonjanssen.dev.
This website is operated purely privately and non-commercially. It carries no advertising, and I use no analytics, audience measurement, advertising or profiling technologies. There are no user accounts, no registration, and no forms. The security-related processing carried out by Cloudflare is described in section 2.
This is a translation provided for convenience. The German version at /datenschutz is authoritative; in case of any conflict, the German text prevails.
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Simon Janssen
Romanstr. 98
80639 München
Email: mail@simonjanssen.dev
This website runs entirely on Cloudflare’s infrastructure (Cloudflare Workers and Workers Assets). There is no additional origin server of my own: every request to this website is received and answered directly by Cloudflare. Internally the website is split across several Workers in my Cloudflare account that communicate with one another solely within Cloudflare’s infrastructure; no data is passed to third parties and no further data is collected in the process.
Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA
Data processed: Retrieving this website may involve the processing of the following data in particular: IP address, date and time of the request, requested URL, HTTP method and status code, volume of data transferred, and — where transmitted by your browser or determined by Cloudflare — referrer URL, browser type and version, operating system, and approximate region of origin. Security-relevant events and technical log data are processed in addition.
Purpose: Delivering the content, ensuring availability and operational security, and defending against attacks (for example DDoS attacks) and abusive use.
Legal basis: Art. 6(1)(f) GDPR. My legitimate interest lies in providing this website securely, quickly and reliably. The log data available to me are stored only briefly in accordance with section 4, and are neither combined into visitor profiles nor used for advertising purposes or passed on by me. Cloudflare’s processing in its own right is addressed below.
Processing on my behalf: A data processing agreement under Art. 28 GDPR is in place with Cloudflare (see https://www.cloudflare.com/cloudflare-customer-dpa/). Recipients may also include the subprocessors engaged by Cloudflare; the current list is available at https://www.cloudflare.com/gdpr/subprocessors/
Cloudflare acting as its own controller: Cloudflare does not process data solely on my behalf. Certain data derived from network traffic (“Network Data”, for example threat indicators, error rates and aggregated traffic statistics) are processed by Cloudflare as a controller in its own right, for security and operational purposes. Details are set out in Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/
Cloudflare, Inc. is based in the United States, so personal data are transferred to a third country.
Cloudflare is certified under the EU-U.S. Data Privacy Framework, and transfers take place on that basis (European Commission adequacy decision of 10 July 2023). In addition, Cloudflare has undertaken to fall back on the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR should that certification lapse or be invalidated.
The Data Privacy Framework gives you additional redress mechanisms against Cloudflare; details are set out in Cloudflare’s privacy policy.
Cloudflare’s logging feature (“Workers Logs”) is enabled for debugging and operational security. Technical metadata are stored per request in my Cloudflare account, in particular the timestamp, HTTP method, requested URL, status code, and request metadata provided by Cloudflare.
Retention: Workers Logs are available for three days on the Workers Free plan and are then deleted in accordance with Cloudflare’s retention rules.
Legal basis: Art. 6(1)(f) GDPR. The logs are not evaluated for any purpose other than debugging and operational security; in particular, there is no audience measurement and no profiling.
Beyond the log data described in section 4, I store no personal data in connection with the mere retrieval of this website. No database is operated. Section 8 applies to email. How long Cloudflare retains data for its own security purposes as described in section 2 is governed by Cloudflare’s privacy policy.
As currently configured, this website sets no cookies and uses no other storage or access technologies requiring consent. A consent banner is therefore not required.
Should Cloudflare in an individual case set a cookie that is strictly necessary to fend off automated attacks, it serves exclusively the security of the website. No consent is required for this under § 25(2) no. 2 TDDDG.
This website is served exclusively over a TLS-encrypted connection (HTTPS), as indicated in your browser’s address bar. Unencrypted requests are redirected to HTTPS automatically.
If you send me an email, I process your sender address and the content of your message in order to deal with your request. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in handling and answering your message.
Forwarding via Cloudflare: The address mail@simonjanssen.dev is not a mailbox of its own but a forwarding rule using the “Cloudflare Email Routing” service. The domain’s MX records point to Cloudflare servers. Incoming messages are received there, checked for sender authentication (SPF, DKIM, DMARC) and then forwarded to my mailbox. In doing so, Cloudflare processes the message including sender address, subject and content. Sections 2 and 3 on Cloudflare’s role and on transfers to the United States apply accordingly.
Mailbox at Posteo: Forwarded messages are stored in a mailbox at Posteo e.K., Methfesselstraße 38, 10965 Berlin, Germany. Posteo operates its servers exclusively in Germany, so no transfer to a third country takes place at that stage. Posteo does not provide the email service on my instructions; it determines the purposes and means of the processing independently and is subject to its own telecommunications law obligations. Posteo is therefore not a processor within the meaning of Art. 28 GDPR but a controller in its own right, and it does not offer such agreements; no data processing agreement is in place. Details of Posteo’s processing: https://posteo.de/site/datenschutzerklaerung
Retention: I delete messages as soon as they are no longer needed and no statutory retention obligations apply.
Please note that data transmission over the internet, in particular unencrypted email communication, can have security vulnerabilities. Complete protection against access by third parties is not possible.
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.
You are under no statutory or contractual obligation to provide personal data. However, your IP address and the other connection data listed in section 2 arise technically whenever any website is retrieved; without processing them, this website cannot be delivered to you.
You have the following rights:
You can assert these rights against me only for the processing for which I am the controller. For the processing carried out by Cloudflare (section 2) and Posteo (section 8) in their own right, please contact the respective company directly.
An informal message to mail@simonjanssen.dev is enough to exercise these rights.
Note on identification (Art. 11 GDPR): I do not combine log data with other data in order to identify visitors. Where I can demonstrate that I am not in a position to identify a data subject, the limitations of Art. 11(2) GDPR apply. Within the retention period under section 4, attribution may be possible if you provide additional details, such as the time of access and the IP address used.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on legitimate interests under Art. 6(1)(f) GDPR. This concerns the processing for which I am the controller as described in sections 2, 4 and 8 of this policy. It also applies to any profiling based on that provision.
If you object, I will no longer process the personal data concerned unless I can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
No processing for direct marketing purposes takes place.
Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. This right exists without prejudice to any other administrative or judicial remedy.
The authority competent for me is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Germany https://www.lda.bayern.de
I update this privacy policy when the technical implementation of this website or the legal situation changes. The version published here at any given time applies.
Last updated: 3 October 2026 · Home · Deutsche Fassung