// PAGE

Privacy Policy

How jubaleth.wtf handles personal data, cookies, and optional external content.

Privacy Policy

Last updated: 15 August 2026

This policy explains what happens to personal data when you visit jubaleth.wtf , contact me, or choose to load content embedded from another service. This is a personal website and blog. It does not offer user accounts, a mailing list, purchases, public comments, or a contact form, and it does not use advertising or first-party analytics.

1. Controller

The controller responsible for personal data processed through this site is:

Justin Kaufman
c/o IP-Management #11484
Ludwig-Erhard-Straße 18
20459 Hamburg
Germany

Email: [email protected]

Further provider information is available in the Impressum.

2. Information processed when you visit

Like nearly every website, the hosting and security infrastructure must process technical request data in order to return pages to your browser. This may include:

The site is hosted and delivered through Cloudflare Pages. Cloudflare provides the static hosting, content delivery, and security infrastructure and may process IP addresses, traffic-routing data, system-configuration information, request details, and related operational or security data when delivering the site.

This processing is necessary to provide the site, keep it reliable, prevent abuse, and investigate faults or security incidents. Where the GDPR applies, the legal basis is my legitimate interest in operating and securing the site (Article 6(1)(f) GDPR).

Request logs are not used to build visitor profiles or for behavioural advertising. Logs under my control are kept only for as long as they are needed for delivery, security, troubleshooting, the establishment or defence of legal claims, or legal obligations, and are then deleted or anonymised. Cloudflare may retain data under its own applicable schedules. See the Cloudflare Privacy Policy and Cloudflare’s GDPR information for more information.

3. Contacting me

The site does not provide or submit a contact form. If you contact me by email, I process the information you send, your email address, and the associated message metadata in order to respond and handle your request.

Where the GDPR applies, the legal basis is Article 6(1)(b) GDPR when the message concerns steps before entering into a contract or an existing contractual relationship. For other messages, the legal basis is my legitimate interest in receiving and responding to relevant correspondence (Article 6(1)(f) GDPR).

Correspondence is retained until the request has been resolved and is no longer needed, then deleted unless a legal retention duty applies or continued storage is necessary to establish, exercise, or defend legal claims. Email infrastructure providers may process message and connection data as part of delivering the message.

The site may link to my GitHub profile or to third-party documentation hosted by GitHub. GitHub receives data only if you follow one of those links or otherwise use its service; its own Privacy Statement then applies.

External videos, streams, and chat are blocked by default. If you allow or decline external content, the site stores that choice in one first-party cookie, jbl_external_content, for 365 days. The cookie is used only to carry out and remember the preference you requested. It is not used to identify you, measure audiences, or track you between websites.

If you allow external content, embedded services may set or read their own cookies and use similar browser storage. Those services control their cookies, not jubaleth.wtf . The legal basis for activating those services and the resulting processing is your consent (Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG). You can change or withdraw consent at any time through External content settings in the site footer. Withdrawal unloads the embeds and applies to future loading, without affecting processing that already occurred. The Cookie Policy provides more detail.

5. Embedded content

Some pages offer content hosted by other companies. The site does not connect to those companies until you select Allow external content. If you allow it, the embeds on the page load and your browser connects directly to the relevant companies. They will receive at least your IP address, browser information, and the URL of the page containing the embed. They may also set or read cookies, associate the visit with an account if you are signed in, and process your interaction under their own privacy terms.

The site currently uses:

The stream template can alternatively display a Discord chat widget when that mode is configured. It is subject to the same consent gate and is not loaded in the site’s current Twitch configuration.

Google explains how it receives data from sites using its services and describes its practices in the Google Privacy Policy. Twitch describes its practices in the Twitch Privacy Notice. Discord describes its practices in the Discord Privacy Policy.

If you decline, the site displays a local placeholder instead and the rest of the page remains available. The privacy-enhanced YouTube domain reduces some storage, but it does not prevent your browser from contacting Google once you choose to load the player.

Ordinary links to external websites do not send you to those sites until you follow the link. Once you do, the other site’s privacy policy applies.

6. Recipients and international transfers

Personal data is disclosed only where needed to operate the site, comply with law, protect legal rights, respond to you, or provide external content you chose to load. Depending on how you use the site, recipients may include the hosting, security, and email providers described above, as well as Google, Twitch, and—only when the corresponding stream mode is active—Discord.

Some of these providers operate internationally and may process data outside the European Economic Area, including in the United States. Where European data-protection law applies, such transfers must rely on an applicable lawful transfer mechanism, such as an adequacy decision or appropriate safeguards. The providers’ notices linked above describe their locations and transfer safeguards.

Personal data is not sold or rented. It is not used for automated decision-making or profiling.

7. Your rights

Where the GDPR applies, and subject to its conditions and limitations, you may have the right to:

To exercise these rights, email [email protected].

You also have the right to complain to a competent data-protection supervisory authority. The authority responsible for Hamburg is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22
20459 Hamburg
Germany

The authority provides an official complaint and information form.

8. Obligation to provide data

You are not legally or contractually required to provide personal data in order to read the site. Technical request data is required to deliver a requested page. If you contact me, I need enough information to understand and respond to your message. External content remains optional.

9. Children

This general-interest site is not directed specifically at children and does not knowingly request personal data from them.

10. Security

Reasonable technical and organisational measures are used to protect the site and information processed through it. No internet transmission or storage system can be guaranteed completely secure.

11. Changes to this policy

This policy may be updated when the site, its providers, or applicable requirements change. The date at the top identifies the current version. Material changes will be described here rather than applied retroactively in a way that reduces your rights.