Privacy policy
In short
When you open the site, Cloudflare and GitHub process technical access data, and simple visitor statistics run without cookies. Google Analytics and Instagram posts load only if you agree in the consent banner. You can change or withdraw your choice at any time under Privacy settings. No external fonts are loaded.
Controller
Orthogonal Otter UG (haftungsbeschränkt)
Marheinekeplatz 4
10961 Berlin
Germany
Represented by Dr. Johannes Otterbach
Email: legal [at] johannesotterbach [dot] com
1. Hosting on GitHub Pages
The site is served by GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). Because the site is delivered through Cloudflare (section 2), it is usually Cloudflare that fetches the files from GitHub, so GitHub mainly processes technical access data from Cloudflare. If you open the site directly at GitHub, GitHub processes technically necessary access data such as your IP address, date and time, the requested file, and your browser type, to deliver the site and protect it from abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing the site securely and reliably). Data may be transferred to the USA; GitHub is certified under the EU-US Data Privacy Framework. Details: GitHub's privacy statement.
2. Delivery, protection, and statistics via Cloudflare
The site is delivered through Cloudflare's network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Every request passes through Cloudflare's servers, which process technical access data such as IP address, requested page, browser type, and time, to deliver the site quickly and protect it against attacks and abuse. To defend against automated attacks, Cloudflare may set a short-lived cookie (__cf_bm, 30 minutes). It serves security only and is strictly necessary for that purpose (§ 25(2) no. 2 TDDDG).
For simple visitor statistics, we use Cloudflare Web Analytics. The site loads a small script from Cloudflare that works without cookies and without storing anything on your device, and does not build profiles across pages or visits. It records aggregated values such as pages viewed, referring page, country, device type, and load time.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, fast site and in privacy-friendly audience measurement). Cloudflare processes the data as a processor; data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework. Details: Cloudflare's privacy policy.
3. Contact by email
If you email us, we process your address and the content of your message to answer your request. The legal basis is Art. 6(1)(b) GDPR where it concerns a possible engagement, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering inquiries). Emails to addresses at this domain are forwarded to our mailbox through Cloudflare Email Routing. We delete messages once they are no longer needed, unless statutory retention periods apply.
4. Consent and cookies
On your first visit, a banner asks whether you allow statistics (section 5) and external media (section 6). Without your consent, these services are not loaded. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We store your choice in your browser's local storage (entry consent) so the banner does not reappear on every visit; this is strictly necessary for that purpose (§ 25(2) no. 2 TDDDG). You can withdraw your consent at any time with effect for the future under Privacy settings at the bottom of every page; we then delete those services' cookies as far as the browser allows. The Inter and Inter Tight fonts are served from this site; there are no requests to Google Fonts.
5. Google Analytics
With your consent, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics sets cookies (for example _ga, _ga_*, up to 2 years) and records which pages you view, where you came from, and your approximate location, device, and browser, to give us aggregated reports on how the site is used. Google Analytics 4 does not store IP addresses. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. We have a data processing agreement with Google. Details: Google's privacy policy.
6. Instagram posts
The About page can embed posts from Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). They load only once you allow external media or click “Load Instagram posts.” Your browser then fetches content and scripts from Instagram; Meta receives, among other things, your IP address, browser data, and the page you are on. Meta may set cookies and can link the visit to your Instagram or Facebook account if you are logged in. We are joint controllers with Meta for the embedding (Art. 26 GDPR). Data may be transferred to the USA; Meta is certified under the EU-US Data Privacy Framework. Details: Instagram's privacy policy.
7. Links to other sites
Links to LinkedIn, podcasts, or publications lead to other providers' sites. Only when you click such a link does that provider process data about you, under its own privacy policy.
8. Retention
Technical logs at GitHub and Cloudflare are deleted according to those providers' schedules, usually within days to weeks. Cloudflare's statistics contain only aggregated values with no link to individual people. Google Analytics keeps data for 14 months; cookies expire after the periods in section 5 unless you delete them earlier.
9. Your rights
You have the right of access, rectification, erasure, and restriction of processing; to data portability; and to object to processing based on legitimate interests (Art. 15–21 GDPR). You can withdraw consent at any time (Art. 7(3) GDPR). Write to the address above. You can also complain to a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.
Last updated: October 2026