JimmyBones.de

Privacy Policy (Datenschutzerklärung)

Last updated: September 2026

English version for convenience. The German version (Deutsche Fassung) below is legally binding.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Randy Carter
Untere Str. 28
76187 Karlsruhe
Germany
Contact: via the contact form

No data protection officer has been appointed (there is no legal obligation for this private website).

2. Overview

This website is a private homepage. Personal data is only processed to the extent necessary for operating the website, for its security and for the features you use, or if you have given your consent. Fonts and JavaScript libraries are loaded from my own server; without your consent, no content from Google or other third parties is loaded.

The legal bases are in particular:

  • Art. 6 (1) (a) GDPR and § 25 (1) TDDDG – your consent,
  • Art. 6 (1) (b) GDPR – handling your request,
  • Art. 6 (1) (f) GDPR – legitimate interest in the secure and stable operation of the website,
  • § 25 (2) no. 2 TDDDG – storage on your device that is strictly necessary for technical reasons.

3. Server (no access logs)

The website is provided on a server operated by the controller. To deliver a page, the server necessarily processes technical connection data (e.g. the requested page and the IP address transmitted via Cloudflare) for the duration of the request (Art. 6 (1) (f) GDPR – technical provision of the website).

The web server does not store access logs: IP addresses, requested pages, referrers and browser identifications are not written to log files. Only technical error messages of the application (without visitor data) are logged. The processing by Cloudflare is described in the following section.

4. Cloudflare (content delivery network and protection)

The website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). All requests pass through Cloudflare servers, which deliver the site faster and protect it against attacks (e.g. DDoS, bots). In doing so, Cloudflare processes in particular your IP address, browser information and the requested URLs. To protect against bots, Cloudflare may set a technically necessary cookie (e.g. __cf_bm, lifetime 30 minutes).

The legal basis is Art. 6 (1) (f) GDPR (secure and fast operation). A data processing agreement has been concluded with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); standard contractual clauses have also been agreed. More information: Cloudflare privacy policy.

5. Display of your IP address and visitor counter

The footer shows your own IP address and – if transmitted by Cloudflare – a country flag. Both are generated directly on the server, are not stored and are not passed on to any third party.

For the visitor counter, a cryptographic hash is created from your IP address (HMAC-SHA-256 with a random key that is regenerated daily). The IP address itself is not stored. The hash is deleted after three hours and only serves to avoid counting repeated page views more than once. The legal basis is Art. 6 (1) (f) GDPR (interest in simple visitor statistics without third parties).

6. Contact form

To prevent spam, the server allows up to five validly completed submission attempts per IP address in a rolling hour, including failed CAPTCHA checks. Only a keyed cryptographic IP hash and attempt timestamps are stored locally, not the IP address itself. Expired attempts are removed on the next rate-limit check. This limit applies across browser sessions; users sharing an internet connection share the limit.

If you use the contact form, your details (name, email address, message and, optionally, postal address and phone number) are processed to handle your request and sent by email to the controller’s mailbox. The legal basis is Art. 6 (1) (b) GDPR or Art. 6 (1) (f) GDPR (answering enquiries). The data is deleted as soon as your request has been dealt with and no statutory retention obligations apply.

A technically necessary session cookie (JBSESSID) is set on the contact page only. It protects the form against misuse (protection against cross-site request forgery, limiting the number of messages) and is deleted when you close your browser (§ 25 (2) no. 2 TDDDG, Art. 6 (1) (f) GDPR).

7. Google reCAPTCHA (only with consent)

Google reCAPTCHA may be used to protect the contact form against spam. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is only loaded when you click “Load reCAPTCHA” on the contact page or consent to the “External media” category in the consent banner.

reCAPTCHA analyses your behaviour on the page to distinguish humans from bots. For this purpose, your IP address, browser and device information, mouse movements, time spent on the page and cookies, among other things, are transmitted to Google, including to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time. Without reCAPTCHA you can reach me via GitHub (see the contact page). More information: Google privacy policy.

8. Statistics: Google Analytics 4 and Cloudflare Web Analytics (only with consent)

If you consent to the “Statistics” category, Google Analytics 4 is loaded (Google Ireland Limited, address see above). Google Analytics sets cookies (_ga, _ga_*, lifetime up to 2 years) and creates pseudonymous usage statistics, e.g. pages viewed, time spent, approximate location (country/city), device and browser. According to Google, Google Analytics 4 does not store IP addresses. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework.

If enabled, Cloudflare Web Analytics is also loaded after your consent (provider see section 4). This service does not set cookies and records page views and load times without recognising individual visitors.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). If you withdraw your consent, the Google Analytics cookies are deleted.

10. Other content

The weather and solar data on the “Weather” and “Solar” pages come from the controller’s own devices and are retrieved on the server; no visitor data is passed on to third parties in the process. Links to external websites (e.g. GitHub, Weathercloud) are simple links: data is only transferred when you click a link. The privacy policy of the respective provider then applies.

11. Your rights

Under the GDPR, you have the right to

  • access to your stored data (Art. 15),
  • rectification (Art. 16) and erasure (Art. 17),
  • restriction of processing (Art. 18) and data portability (Art. 20),
  • object to processing based on legitimate interests (Art. 21),
  • withdraw consent given, with effect for the future (Art. 7 (3)).

To exercise these rights, simply contact me via the contact form or by post at the address given above. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.