Legal
Privacy Policy
What this website stores about you, why, and what you can do about it. The short version: server logs, and a reach count that cannot identify you.
Last updated 21 September 2026
Good-faith document, not legal advice. This text was written by the operator and describes exactly what the site does today. It will be reviewed by counsel before Reflexmark serves the public at scale.
Who is responsible
Thorsten Meyer, Blombergstrasse 11 C, 82393 Iffeldorf, Germany. Email: contact@reflexmark.com. Full details on the Impressum.
This website
reflexmark.com is a static website. It sets no cookies and shows no consent banner. Stylesheets, fonts, images and video clips are all served from this domain — nothing is fetched from a font service, an image host or a video platform. Exactly one request goes to another origin: the operator’s own analytics script, described in the next section. There is no third-party tracker, no tag manager and no advertising pixel anywhere on this site.
Fonts are self-hosted files delivered from reflexmark.com. Your browser never contacts a font provider, so no font service receives your IP address.
Hosting and server logs
The site is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Like every web server, it writes standard access logs: your IP address, the page requested, the date and time, the referring page if your browser sends one, and your browser’s user agent string. These logs exist to operate the server securely and to diagnose faults. They are kept for a short period and then deleted, and they are not combined with any other data or used to profile visitors.
Legal basis: Art. 6(1)(f) GDPR — the legitimate interest in delivering and securing the website. A data processing agreement under Art. 28 GDPR is in place with the hosting provider.
Web analytics (Grynlume)
This site measures its reach with Grynlume, an analytics tool the operator wrote himself and runs on his own server at grynlume.grimfaste.com. It is not a third-party analytics service: no analytics company is involved, nothing is sold or shared, and nothing feeds advertising. The purpose is aggregate reach measurement — which pages are read, and where readers arrive from.
Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in measuring reach in a privacy-preserving way. There is no consent banner because nothing is stored on or read from your device for tracking purposes (§ 25 TDDDG): the script writes nothing to your browser, and the only thing it reads is the optional opt-out flag described at the end of this section.
What is recorded
Per page view and per event: the page address including any campaign (UTM) parameters it carries, the referring address, the width of your browser window, the time, engagement signals (how far down the page you scrolled and how long it was in view), and clicks on outbound links and file downloads. Your browser and operating system are derived from the user-agent string your browser sends anyway. No names, no e-mail addresses, no advertising identifiers, and no cross-site or cross-device profiles.
Your IP address
Your IP address is processed only in passing, to compute a visitor hash, and is never stored. The hash is a SHA-256 of a random salt, your IP address, your user-agent string and this site’s domain. The salt changes every day, and salts older than the previous day are deleted — after which the hash can no longer be traced back to an IP address, and the same visitor cannot be recognised from one day to the next. No geolocation lookup is active, so the country is recorded as “Unknown”.
How long it is kept
The aggregated statistics currently have no fixed deletion period. They contain no identifier beyond the daily-rotating hash above, which stops being resolvable as soon as its salt is deleted.
Cloudflare
Requests to grynlume.grimfaste.com pass through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which acts as a reverse proxy and content delivery network in front of the operator’s server. In transit Cloudflare necessarily processes your IP address and the metadata of the request. Cloudflare is certified under the EU-U.S. Data Privacy Framework, and standard contractual clauses under Art. 46(2)(c) GDPR are additionally in place as the transfer mechanism.
Automated classification (a trial)
To work out what an unfamiliar referrer is — a search engine, a social network, a link aggregator — and to recognise automated clients, Grynlume currently sends two things to the System One API of TypeSafe, the provider of the Jev API: referrer host names, and user-agent strings that its own bot filter did not recognise. These go out in background batches. No IP address, no visitor hash and no page addresses are included, and what is sent contains no direct identifiers. This is a time-limited trial; the operator intends to replace it with a decision service run locally on his own hardware.
Excluding your browser
You can keep this browser out of the statistics entirely. The switch below sets a flag in this browser’s local storage (pa_ignore) which the analytics script checks before it does anything; with the flag set, it sends nothing at all. The script reads that flag once per page, so a change takes effect from your next page view. The flag lives in this browser only, and clearing your site data removes it.
With JavaScript enabled, a switch appears here. Otherwise open your browser’s console on reflexmark.com and run localStorage.pa_ignore = "true", or block requests to grynlume.grimfaste.com.
If you write to contact@reflexmark.com, your message, your address and anything you choose to include are stored for as long as needed to answer you and to document the exchange, and then deleted. Legal basis: Art. 6(1)(b) and 6(1)(f) GDPR. You are not added to any mailing list, and your address is not passed to anyone.
The Reflexmark software
Reflexmark is designed to run on your own hardware, and the states and questions you send it are processed locally on that hardware. The software is not publicly released, so there is nothing running today that could transmit your data to the operator. Should any component ever send data off your machines, that will be stated here before it ships — it is not the plan.
What does not happen
- No cookies. Nothing is written to your device — the analytics opt-out flag is the single exception, and only if you set it yourself.
- No heatmaps, no session recording, no mouse-movement or keystroke capture.
- No advertising, no retargeting, no data sales, no profiles that follow you to another site.
- No third-party fonts, iframes, maps, embedded video platforms or social widgets. The only script from another origin is the operator’s own Grynlume analytics.
Your rights
Under the GDPR you have the right to access, rectify, erase and port your data, to restrict processing, and to withdraw consent where processing rests on it. You also have the right to object under Art. 21 GDPR to any processing based on legitimate interest, which covers both the server logs and the reach analytics; for the analytics you can act on that yourself, immediately, with the switch above. Write to contact@reflexmark.com to exercise any of these rights.
In practice the data held about you is whatever is in an email you sent, the short-lived server log of your visit, and a row in the aggregated statistics that carries no identifier able to outlive the day it was recorded — so a request to access or erase analytics data cannot usually be matched to a person, by design.
You also have the right to lodge a complaint with a supervisory authority. For this operator that is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany.
Changes
If this site starts doing something new, this page changes first and carries a new date at the top.