This is a translation of the German Datenschutzerklärung. In case of doubt, the German version applies. In short: no tracking, no analytics, no advertising, no external fonts or embeds. Only the contact page uses Cloudflare Turnstile against spam.
1. Controller
The controller responsible for data processing on this website under the General Data Protection Regulation (GDPR) is:
E-mail: blog@selfhostjournal.eu
2. The essentials
This blog is a private, non-commercial website. I don’t use analytics or tracking tools, I don’t show advertising, and I don’t embed third-party content (no Google Fonts, no social media buttons, no embedded videos). The only exception is the Cloudflare Turnstile spam protection on the contact page (section 12). Fonts are loaded directly from this server. There are no comments. You can send me a message through the contact form (section 12).
3. Hosting
This website is hosted by lima-city, a service of TrafficPlex GmbH, Konsul-Smidt-Str. 90, 28217 Bremen, Germany. The servers are located in data centres in Germany. When you visit this website, the host processes the data technically required for this on my behalf.
The legal basis is my legitimate interest in providing the website securely and reliably (Art. 6 (1) (f) GDPR).
4. Server log files
Each time a page is requested, your browser automatically transmits information that the host’s server stores in log files:
- IP address of the requesting device
- date and time of the request
- page or file requested and amount of data transferred
- HTTP status code
- browser type, browser version and operating system
- referrer URL (the previously visited page), if transmitted
This data is only needed to deliver the website, find errors and fend off attacks. It is not combined with other data and not used to analyse visitors. The host deletes the log files automatically after a short period; I have no influence on how long they are kept. The legal basis is Art. 6 (1) (f) GDPR.
5. Encryption
The website is delivered exclusively over an encrypted HTTPS connection (TLS). Data you send to this website, such as search terms, therefore cannot be read by third parties.
6. Cookies
For ordinary visitors this website sets only technically necessary cookies: _lcp and _lcp3 are set by the host’s server infrastructure. They contain only the fixed value “a” and no information about you, and serve the technical operation of the hosting platform. The selected language is not stored in a cookie; it follows from the page address (/de/ for German). None of these cookies is used for tracking or advertising. The legal basis is § 25 (2) No. 2 TDDDG in conjunction with Art. 6 (1) (f) GDPR. No consent is required for it.
On the contact page, Cloudflare Turnstile may also store technically necessary data in your browser (section 12). Further cookies are only set when someone logs in to the editorial area (see sections 8 and 10): the WordPress session cookies and the Wordfence cookies wfwaf-authcookie-… (12 hours) and wf_loginalerted_… (1 year). You can delete or block cookies in your browser at any time.
7. Page cache
To make pages load faster, I store finished copies of the pages on the server (plugin “WP Fastest Cache”). These copies contain no personal data, and no cookies are set for them. The cache is not used for logged-in authors. Loading emoji images from WordPress.org servers is also switched off.
8. Security (Wordfence)
To protect against attacks, such as password guessing and known security vulnerabilities, I use the plugin “Wordfence Security” by Defiant, Inc., 1700 Westlake Ave N Ste 200, Seattle, WA 98109, USA. The firewall checks every request to this website. The following data is processed:
- IP address
- date and time
- address requested and browser identification (user agent)
- for login attempts, the username used
Wordfence stores suspicious and blocked requests and login attempts in this website’s database. To check against current threat information, IP addresses are also transmitted to Defiant’s servers in the USA. Security scans also transmit checksums of files. The legal basis is my legitimate interest in protecting the website (Art. 6 (1) (f) GDPR). To my knowledge, Defiant is not certified under the EU-US Data Privacy Framework. The transfer to the USA is based on the EU standard contractual clauses (Art. 46 (2) (c) GDPR) that Defiant provides in its terms. The logs are deleted automatically after 8 days.
9. Search
When you use the search, your search term is sent to the server to show matching articles. The search term is not stored permanently. It does, however, appear as part of the requested address in the server log files (section 4) and possibly in the Wordfence logs (section 8).
10. Login for authors
The editorial area is meant only for me as the author. When logging in, WordPress sets technically necessary session cookies. The login can use my self-hosted login service (Authentik, on my own server in Germany). The author’s username, name and e-mail address are transmitted in the process. This does not affect visitors: you never need to log in.
11. Backups
The content of the website (files and database) is backed up daily to my own backup server in Germany and kept there for 30 days. The host’s server log files are not included. The database backup does, however, contain the Wordfence logs (section 8); they are deleted with the respective backup after 30 days.
12. Contact form
If you write to me through the contact form, I process the details from the form (name, e-mail address and your message) to answer your request. The form runs on the plugin “WPForms Lite”. The message is delivered to me by e-mail. In the Lite version, WPForms does not store entries in the website’s database. The optional transfer to the plugin maker’s servers (“Lite Connect”) is switched off. To protect against spam, the form checks technically whether it was filled in by a human, for example with a hidden check field and a minimum time to fill it in.
Cloudflare Turnstile: On the contact page I also use the spam protection “Turnstile” by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open the contact page, your browser loads a script from Cloudflare. Turnstile uses technical characteristics of your browser and device (for example IP address, browser identification and the results of small calculations in the background) to check whether the request comes from a human. According to Cloudflare, this data is used only to detect bots, not for profiling and not for advertising. The legal basis is my legitimate interest in protecting the contact form against automated abuse (Art. 6 (1) (f) GDPR); access to information on your device is based on § 25 (2) No. 2 TDDDG, as it is strictly necessary for this protection. Cloudflare is certified under the EU-US Data Privacy Framework, on which the transfer to the USA is based (Art. 45 GDPR). A data processing agreement is in place with Cloudflare. More information: Turnstile Privacy Addendum. Turnstile is not loaded on any other page of this blog.
The legal basis is Art. 6 (1) (b) GDPR if your request relates to a contract, and otherwise my legitimate interest in answering requests (Art. 6 (1) (f) GDPR). I delete your message as soon as your request has been dealt with and no statutory retention obligations apply.
13. Sending e-mail and contact by e-mail
E-mails from this website, such as messages from the contact form, are sent with the plugin “Easy WP SMTP” through the mail server of my host lima-city (TrafficPlex GmbH, see section 3). The host processes the content of the e-mail and the sender and recipient addresses on my behalf.
If you send me an e-mail directly, I process your address and your message to answer your request (Art. 6 (1) (f) GDPR). I delete this e-mail as well as soon as it has been dealt with and no statutory retention obligations apply.
14. Links to other websites
Articles contain links to other websites, for example to documentation. Simply reading an article does not transmit any data to them. Only when you click a link does the privacy policy of the respective provider apply on the target page.
15. Your rights
You have the right at any time to:
- access to your stored data (Art. 15 GDPR)
- rectification of incorrect data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing based on legitimate interest (Art. 21 GDPR)
Just contact me by e-mail (section 1). You can object at any time to processing based on Art. 6 (1) (f) GDPR. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live.
16. Changes
I update this privacy policy when the website or the legal situation changes. The version published here applies.
Last updated: October 2026