Privacy Policy
In this story
Updated: 15 October 2026. This notice describes the static public Karl.Fail website, a private, noncommercial publication.
Who is responsible?
Karl Machleidt is responsible for this website. For privacy questions or to exercise your rights, email privacy@karlcloud.de.
When you read this website
The public website delivers static pages and files through Cloudflare Pages. Your browser necessarily transmits your IP address and request information, such as the requested URL, time, browser information and any referrer sent by your browser. This information can identify or relate to you; it is not automatically anonymous.
Processing serves delivery, availability and protection against abuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in providing a secure, reliable website. Request information is necessary to deliver pages; you can choose not to visit the website.
Hosting and security provider
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, provides hosting, content delivery and security. It receives connection and request data when you visit. Processing may take place outside the European Economic Area, including in the United States. Cloudflare describes its processing and international transfer safeguards in its Privacy Policy and Data Processing Addendum. You can contact us for information about the safeguards applicable to this website.
Cloudflare also supplies Network Error Logging headers. A supporting browser may send connection-failure reports to Cloudflare for delivery diagnostics; these reports are operational telemetry, not audience analytics.
Cloudflare may use security cookies when a protection feature requires them. See our cookie and browser-storage notice.
Security monitoring and attack prevention
We collect Cloudflare security and firewall events into private security monitoring to detect attacks, investigate incidents and prevent repeated abuse. These records may include IP addresses, requested paths, event times and security decisions or actions. Cookie and authentication values are not included in this security-event collection. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in protecting this website and the systems supporting it.
Security monitoring may lead to an IP address being temporarily blocked. Automated blocks ordinarily escalate from 7 to 14 to 30 days when abuse repeats. New attack waves may extend a block; older manually managed blocks are reviewed separately. Contact us if you believe a block affects you incorrectly.
Browser preferences and tracking
We do not include audience analytics, advertising trackers, external fonts or automatically loaded third-party embeds in the static pages. Article images are delivered with the website. Syntax highlighting runs when the site is built and does not send code or reading activity to a highlighting service.
The initial colour scheme follows your device settings. If you choose a light or dark appearance, your browser stores that preference locally so it can be applied on future visits. It is not sent to an analytics service. The dismissed storage notice is remembered in sessionStorage for the current tab. See the storage notice for deletion and reset options.
Public readers do not sign in, submit comments or upload media here. WordPress is the editorial backend; public static pages do not call its API.
If you contact us
If you send email, we process your email address, message and associated correspondence to answer you. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in responding to correspondence; Article 6(1)(b) applies where the correspondence concerns a contract or steps you request before entering one. Our email service providers process the message in delivering and storing correspondence.
Retention
We retain correspondence only while necessary to handle your request and any resulting follow-up, establish or defend legal claims, or comply with applicable retention duties. Our private monitoring logs are deleted 30 days after their index rolls over; rollover occurs daily or earlier at the size threshold, so individual events normally remain for approximately 30–31 days. Daily local snapshots expire after 7 days, with at most 7 snapshots retained; a deleted event may therefore persist in a backup until that backup expires. Incident evidence and security blocklists may be retained longer while needed to investigate an incident, protect against continuing or repeated abuse, or establish or defend legal claims. Cloudflare’s own processing and retention are governed separately by the services used; details are available on request and in Cloudflare’s privacy information. Browser preferences remain until you reset them or clear this website’s browser storage.
Your rights
Under the conditions set out in the GDPR, you may request access, correction, deletion, restriction of processing and data portability. Portability applies where processing is automated and based on consent or a contract. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. If any processing relies on your consent, you may withdraw that consent for the future.
Contact privacy@karlcloud.de to exercise these rights. You can complain to a data protection supervisory authority, particularly in the EU country where you habitually live or work, or where you consider an infringement occurred. See the European Data Protection Board’s authority directory.
External links and updates
Following an external link sends a request to that destination, which has its own privacy practices. This notice is updated when the website’s processing changes.