Privacy
As of: 18.10.2026. This notice tells you which personal data we process on this website, why, and on what legal basis. The German version is binding; this text is a translation.
1. Controller
Gerald Houché, Washingtonallee 33/1, 89231 Neu-Ulm, Germany
Email: [email protected]
We have not appointed a data protection officer.
2. In short
- The site sets no cookies and uses no analytics or advertising services.
- Fonts and all content come from our own address, not from third parties.
- Only when you use a form, an anti-spam check from Cloudflare is loaded (section 7).
- For contact, wishes and the newsletter we process what you enter yourself and the technical data of the spam protection (section 7).
- Newsletter emails, including the confirmation email, currently contain open and click measurement by the sending service Brevo (section 6).
- Donations run on PayPal's page, not on this site. PayPal passes on to us the details of your payment (section 9).
3. Hosting and server logs
The site is hosted by Cloudflare (Cloudflare Pages, DNS and delivery network). The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary data: your IP address, date and time, the page requested, and browser and device information. This serves to deliver the site, to run it securely and reliably, and to fend off abuse.
We ourselves keep no server logs and do not evaluate this data, except to fend off attacks. How long Cloudflare stores it is decided by Cloudflare according to the purposes above. Cloudflare names no fixed period. The forms also run through a small program part at Cloudflare (Cloudflare Pages Functions). It checks your input and passes it on to Brevo (sections 4 to 6) but does not store it.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and working website). Cloudflare acts as a processor under its data processing addendum. Transfer to the USA relies on the EU-US Data Privacy Framework, to which Cloudflare belongs, and alternatively on standard contractual clauses.
4. Contact form and email
If you use the contact form, we process your topic, your message, your email address and the language of the page. We use this only to answer your request. We cannot reply without an email address, so it is a required field.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to answer enquiries about Yggdrasil OS. If your enquiry aims at cooperation or a contract, for example a partnership, the legal basis is Art. 6(1)(b) GDPR.
The form passes your details through our server at Cloudflare (section 3) to the service Brevo (Brevo SAS, 17 rue Salneuve, 75017 Paris, France). Brevo delivers them as an email to our mailbox [email protected] and acts as a processor. The mailbox is hosted by Proton (Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland), also as a processor. The EU Commission has issued an adequacy decision for Switzerland.
We delete enquiries and our replies at the latest twelve months after the last message, unless a legal retention duty applies. For each delivered message Brevo stores delivery data (time, subject, recipient, delivery status) and deletes it according to the periods set in our Brevo account. If you write to us directly by email, the same applies, only without Brevo.
5. Submitting a wish
In the wish form we process your wish, your permissions for publication and naming, the language of the page and, if you give them, your email address and your name. Gerald Houché reads every wish personally. A reply, publication or implementation is not promised. Without an email address we cannot ask you follow-up questions.
The legal basis for reading, collecting and evaluating your wish is Art. 6(1)(f) GDPR. Our legitimate interest is to develop Yggdrasil OS according to the community's wishes. Partners only see wishes in summary, without names and contact details.
Without your permission a wish stays internal. Only if you allow publication may it appear on yggdrasil-os.org and in the newsletter, also shortened. It appears with your name only if you also give the second permission. The legal basis for this is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example by email to [email protected]. We then remove the wish or your name without delay.
We keep wishes as long as we develop Yggdrasil OS, or until you object (section 10). We delete email address and name at the latest twelve months after the last message. If your wish is published with your name, the name stays stored as long as the wish is published. Sending works as in section 4.
6. Newsletter
For the newsletter we process your email address and the language of the page. As proof of your consent we also store when you signed up, when the confirmation email was sent and when you confirmed it. We use the double opt-in procedure: after signing up you receive an email with a confirmation link. You are only subscribed after that. If you do not confirm, you receive no newsletter.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time: with the unsubscribe link in every newsletter email or by email to [email protected]. We keep your data until you withdraw. After that we delete it. Only the proof of sign-up and unsubscription we keep for up to three years after unsubscription.
Brevo (Brevo SAS, 17 rue Salneuve, 75017 Paris, France) sends the emails and manages recipients as our processor under its data processing agreement. Brevo records whether an email was delivered. In addition, Brevo's emails, including the confirmation email, contain an invisible image and redirected links. With these Brevo can tell whether and when an email was opened and a link clicked. We do not use this data to build profiles about you. We use your address only for this newsletter.
7. Spam protection with Cloudflare Turnstile
To keep bots from abusing the forms we use Cloudflare Turnstile. The service is only loaded when you use a form, that is, click into it or reach it with the keyboard. Your browser then connects to Cloudflare (challenges.cloudflare.com). Turnstile reads technical characteristics of your browser and device and processes your IP address to tell humans from automated access. When you submit, our server asks Cloudflare whether the check was passed and also transmits your IP address for that.
According to our measurement, Turnstile sets no cookies. It does, however, store a technical value (cf.turnstile.u) in your browser's local storage under Cloudflare's address. Reading and storing serve only bot detection for the form you want to use and are strictly necessary for that (§ 25(2) no. 2 TDDDG). You can delete the value at any time in your browser settings.
The legal basis for the processing is Art. 6(1)(f) GDPR (legitimate interest in protecting the forms from abuse). For the bot check Cloudflare acts as our processor. Cloudflare also uses the signals collected, on its own responsibility, to improve its bot detection. For this Cloudflare is itself the controller, details at www.cloudflare.com/turnstile-privacy-policy. For the transfer to the USA see section 3.
If the check wrongly blocks you, write to us directly at [email protected].
8. Cookies, statistics and third-party content
This website sets no cookies, uses no statistics or advertising services and embeds no third-party content, apart from the spam protection in section 7. The fonts (Tektur, IBM Plex Mono) are on our own server. The video (trailer) comes from our own address. It loads only when you scroll to it or start it.
9. Donations through PayPal
You can support Yggdrasil OS with a voluntary donation through a link to PayPal (PayPal.me). Visiting this page loads no script from PayPal. Only when you click the link or scan the QR code with your phone does PayPal's page open and your browser connect to PayPal. From then on PayPal's terms and privacy notice apply. PayPal processes your data for the payment on its own responsibility. The controller is the PayPal company of your country of residence; in the European Economic Area this is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Whether and how PayPal transfers data to countries outside the EU is described in PayPal's privacy notice.
When you donate, PayPal passes on to us the details of your payment: your name, your email address, the amount, date and time, the transaction number and your message, if you write one. Depending on the payment method and your PayPal settings, your address and phone number may be added. Without name and email address PayPal does not carry out a payment. The donation itself is voluntary.
We use these details to book the payment and, where tax law obliges us to, to keep records. The legal basis is Art. 6(1)(b) GDPR (handling your donation) and, where a retention duty exists, Art. 6(1)(c) GDPR. We keep tax-relevant records as long as tax law requires, usually eight or ten years from the end of the calendar year of the payment (§ 147 German Fiscal Code). They can be received by a tax adviser we appoint and, where legally required, by the tax authorities.
We also thank you by email and keep donors in an internal list with name, email address and date of the donation. We do not publish the list. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to record and acknowledge support. We keep the list as long as we develop Yggdrasil OS and delete it afterwards. You can object at any time (section 10). We then remove you from the list; the records remain unaffected. We do not use your email address for the newsletter. You only get it if you order it yourself (section 6).
10. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to [email protected].
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR, sections 3, 4, 5, 7 and 9), you can object to this processing at any time on grounds relating to your particular situation. We then no longer process the data. Exceptions apply only if we demonstrate compelling legitimate grounds that override your interests, or if the processing serves the establishment, exercise or defence of legal claims.
No automated decision within the meaning of Art. 22 GDPR takes place. The spam check (section 7) only decides whether a form is technically accepted. You can always reach us by email.
You can also complain to a supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
11. Changes
If the site changes, for example through statistics, a payment provider or new forms, we adjust this notice before the change goes live. The current version applies. The German version is binding; the English and Spanish versions are translations.