Privacy
Updated: 21 October 2026. The controller is Mario V.W.B.R. Obst, resident in Erfurt, Thuringia, Germany. The EU General Data Protection Regulation (GDPR) and applicable German data protection rules apply, including the TDDDG for access to devices. The Swiss service address is not a Swiss residence. Contact details and address are in the legal notice.
Personal nature journal
Journal entries are stored in local browser storage (wanderlust-journal-v1) only when you choose to save. Dates, optional places, titles and notes are not uploaded to us or automatically synchronised. Access to the browser profile may expose unencrypted entries. Export files contain plain-text notes; downloads and any device cloud backups depend on your device and storage settings. Delete entries individually or clear the journal. Exported files must be deleted separately.
JSON imports read and validate the selected file entirely in your browser. New entries are added locally only after preview and confirmation; duplicates and different versions of existing IDs are skipped. The file is not uploaded. Nature missions open a local template using a fixed identifier in the URL fragment; personal notes are not transmitted or automatically saved.
Privacy by Design
Our page code creates no visitor profiles and uses no audience measurement, advertising, fingerprinting or cross-site tracking. Technical hosting connection and security data are described separately below. We do not set cookies ourselves. The necessary functions described here do not require consent through a cookie banner. No analytics or advertising services requiring consent are used. Images, scripts and styles are hosted on our domain; fonts come from your device. There are no external embeds.
Visiting the website
Cloudflare, Inc. (USA) hosts this website as a technical service provider. Delivering and securing it requires technical connection data, including IP address, requested URL, time and browser information. Processing may take place outside the European Economic Area. The Data Processing Addendum (DPA) is incorporated through section 6.1 of the Self-Serve Subscription Agreement. It governs processing on our behalf. For international transfers it provides the EU–US Data Privacy Framework and, where required, EU standard contractual clauses with additional safeguards. Processing exclusively in Germany or the EU is not guaranteed. See Cloudflare’s privacy policy for provider details.
We do not add analytics or advertising trackers. Images, fonts, scripts and styles are served through the website itself. During a security check, Cloudflare may set technically necessary cookies: cf_clearance records a successful check for the configured validity period; cf_chl_rc_i, cf_chl_rc_ni and cf_chl_rc_m support the operation and troubleshooting of a challenge. These are not analytics or advertising cookies and are not set by our page code. Which cookies are needed and their lifetime depend on the security check triggered. The enabled “Always Online” availability feature may also use cf_ob_info and cf_use_ob to serve an available page copy during an outage. These expire after 30 seconds. See Cloudflare’s cookie documentation.
Technical hosting data and retention
Configuration reviewed on 21 October 2026: Cloudflare Free, hosted through Workers Static Assets without a custom server program, database bindings, Worker Logpush or Tail Workers. Journal entries, bookmarks and packing lists are not stored in Cloudflare databases. Our page code sends no analytics beacons.
- Security events: Cloudflare documents up to 31 days of history on the Free plan. Events can include IP address, browser user agent, requested path, time and security action. Source: Security Events.
- Technical domain statistics: Since 2 October 2026, Cloudflare states at least 31 days of retention for adaptive HTTP, DNS and security datasets. This does not guarantee that all personal hosting data is deleted within 31 days. Source: Analytics retention update.
- Other network data: Cloudflare also processes certain operational and security data as a controller in its own right. Its privacy policy, sections 6 and 11, gives purpose-based criteria rather than one fixed period: necessity, data type, risks and legal obligations.
We use hosting data for delivery, troubleshooting and attack detection, not personal hiking or interest profiles. We create no additional visitor log archives. For data processed on our behalf, the DPA specifies retention until the earlier of contract expiry or the end of necessity, followed by deletion or return, subject to legal obligations. Locally stored journal entries and exports have the separate deletion options described above.
Your local lists
Saving an article or discovery card stores that choice in your browser’s local storage. The packing list is stored persistently only if you select “Remember this list on this device”. Otherwise it lasts only while the page remains open. Custom items and checkmarks are not sent to us. The compass processes your choices in the browser without requesting your location.
The storage key is wanderlust-v1. It contains only saved article and card IDs and, if requested, your packing list, without a visitor identifier. Simply visiting, searching or using the compass creates no persistent entry. Saved data remains until deleted from the browser. It is limited to this device and browser. Other users of a shared device may be able to see it.
External links & contact
External links open in a new tab without sending a referrer (the referring page address). When you open an external link, for example to Pexels or the Alpine Club, the destination’s privacy policy applies. If you contact us by email, we process your message and contact details to respond to your enquiry.
Legal bases and retention
Website delivery and security rely on Article 6(1)(f) GDPR: our legitimate interest in a secure, reliably accessible website. Responding to general enquiries also relies on this interest. Providing contact details is voluntary; we cannot reply without a reply address. Messages are deleted once the enquiry is resolved and no retention obligation or necessary legal claim requires keeping them.
Local storage is necessary for features you explicitly request: bookmarks, a saved packing list and the journal. Section 25(2)(2) of the German TDDDG applies. The website does not transmit these data from your device. They remain until you delete them or clear browser data. Security cookies are used only as necessary; their duration is described above. Hosting data is subject to the periods and criteria explained above. We do not maintain our own visitor database.
Your rights and complaints
Subject to the legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). You may object to processing based on legitimate interests on grounds relating to your particular situation (Article 21). There is no profiling or automated decision-making with legal or similarly significant effects.
Contact Mario at legal@marioobst.com or the address in the legal notice. Under Article 77 GDPR you may complain to a supervisory authority, particularly where you habitually live, work or where the alleged infringement occurred. For Mario’s place of residence, one contact is the Thuringian Commissioner for Data Protection and Freedom of Information (TLfDI).
