Privacy policy

Last updated: 18 September 2026. This policy explains how personal data is processed in connection with the Mishmash website.

1. Controller

Mario V.W.B.R. Obst
Permanent place of residence: Erfurt, Free State of Thuringia, Germany

Address for service

The Swiss address is used as a rented public address for service. It does not establish a Swiss place of residence or registered business address for the controller.

Email: mix@mishmash.work
Telephone: +49 175 7116303

2. Hosting and content delivery

This website is hosted as static files on Cloudflare Workers. Cloudflare provides delivery and network security services. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

Delivering a page requires Cloudflare to process technical request data, including your IP address, requested address, request time, browser information and connection data. Depending on the request, browser settings and security features, additional request headers, such as a referrer, may be received. This website sets a no-referrer policy for outgoing requests.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to provide a secure, stable and efficient website. I have not enabled Workers request logs or traces for this site. Cloudflare may nevertheless process service and security logs. I delete any technical data under my control once its purpose has been completed, unless statutory retention obligations require further storage. Cloudflare’s own service and security data is subject to its applicable contractual and legal retention rules; my deletion policy does not override the provider’s independent obligations. This website does not maintain a separate visitor database.

Processing may take place in the United States and other countries in which Cloudflare or its service providers operate. Cloudflare describes its participation in the EU–U.S. and Swiss–U.S. Data Privacy Frameworks and the use of standard contractual clauses where applicable in its transfer documentation.

Further information: Cloudflare Privacy Policy and Cloudflare Data Processing Addendum. These documents describe recipients, safeguards and ways to obtain further information about transfers.

3. Contact by email, telephone or post

Email and telephone

If you contact me, I process the information you provide, such as your name, contact details and message, to deal with your enquiry. Email and telecommunications providers involved in delivering your message or call also process the data necessary to provide their services.

The legal basis is Article 6(1)(b) GDPR where the contact concerns a contract with you or steps taken at your request before entering into a contract. Otherwise, it is Article 6(1)(f) GDPR, based on my legitimate interest in responding to enquiries. Where retention is required by law, Article 6(1)(c) GDPR applies.

Personal data under my control is deleted promptly once the enquiry or other processing purpose has been fully dealt with. Where a statutory retention obligation applies, the necessary records are retained only for the legally required period, restricted to that purpose and deleted after the period expires. Providing contact information is voluntary, but without sufficient information I may be unable to answer your enquiry.

Postal contact

Mail sent to the address for service is received by JL Consulting Group GmbH. On my instructions, it is forwarded physically or digitised. Sender, recipient and shipment information are processed; shipment contents are scanned only when I have commissioned scanning.

The legal bases and retention criteria are the same as for other enquiries, depending on their purpose. Processing in Switzerland is covered by the European Commission’s adequacy decision for Switzerland where applicable. Further information: JL Consulting’s privacy policy for adresse-mieten.ch.

4. Cookies and temporary shuffling

The website’s own code sets no cookies and includes no advertising or analytics trackers.

“Shuffle Mishmash” rearranges cards only in the working memory of the currently open page. The order is not written to localStorage, sessionStorage, cookies or a server. Reloading or leaving the page resets the order, including when returning through the browser’s back button. Opening an external project in another tab leaves the existing page open, so its current order remains until that page is left, reloaded or closed.

A previous version stored a shuffle preference under mishmash.order.v1. The current start page removes that old entry without reading its contents. If you do not revisit the start page, you can remove it through your browser’s site-data settings. No replacement preference is saved.

Depending on the security functions used, Cloudflare may set security cookies or use comparable device information, for example when checking potentially abusive requests. A security purpose alone does not exempt every use from consent: the requirements of Section 25 TDDDG must be met. Related personal-data processing for necessary security measures is based on Article 6(1)(f) GDPR. Details about individual Cloudflare cookies and their lifetimes are available in Cloudflare’s cookie documentation.

5. Analytics and profiling

I do not use client-side audience measurement, marketing tools or visitor profiles on this website. Cloudflare may process technical usage and security information as part of operating its services. This should not be confused with an analytics tool embedded in these pages.

Where personal data is processed for technical operation and security, the legal basis is Article 6(1)(f) GDPR. I do not use this website to make automated decisions that produce legal or similarly significant effects on visitors.

6. Fonts, external links and the archive

The main website uses the Inter and JetBrains Mono webfonts, hosted with the website and delivered from the same Cloudflare-hosted address. Font loading makes no request to Google Fonts or another font provider and does not use local font lookup. The browser renders the downloaded fonts on your device and may cache them normally. Logos and other website assets are also served with the site. The unchanged historical archive pages retain their original font declarations.

Project, social-profile and video cards are links. YouTube players and social-media widgets are not embedded. Clicking an external link opens the respective provider’s site in another tab, where its own privacy policy applies. Visiting this website alone does not load those linked platforms.

Historical websites are hosted with this site and open in a sandboxed frame. Security policies restrict external resources and connections from those archives. Their original text may contain outdated addresses or legal notices; this policy describes the current Mishmash website.

7. Your rights

Subject to the applicable conditions, you have the rights of access, rectification, erasure, restriction of processing and data portability under Articles 15–20 GDPR. Where processing is based on consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of earlier processing.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. I will then cease processing unless I demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is needed for legal claims. You may object to direct marketing at any time; this website does not carry out direct marketing.

You can exercise your rights using the controller’s contact details above. You may also complain to a supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. Where Swiss data protection law applies, the rights available under that law also remain unaffected.

8. Supervisory authority

Thuringian Commissioner for Data Protection and Freedom of Information (TLfDI)

Postal address:
Postfach 900455
99107 Erfurt
Germany

Visitor address:
Häßlerstraße 8
99096 Erfurt
Germany

Telephone: +49 361 57 3112900
Email: poststelle@datenschutz.thueringen.de
Contact the TLfDI

9. Changes to this policy

This policy is dated 18 September 2026. It may be updated when the website, its processing activities or applicable legal requirements change.