Scope
This notice applies to the Mishmash Universe at https://mishmash.work, including its games and additional rooms. It describes the website and hosting configuration checked on 30 October 2026. Browser and operating-system services are also subject to their providers’ information.
The public website is delivered as static files through Cloudflare Workers. Local development previews are separate and do not send their page requests to Cloudflare.
Controller and contact
Mario V.W.B.R. Obst is the controller for the processing described here.
Mario V.W.B.R. Obstc/o JL Consulting Group GmbH
Zürcherstrasse 84 #1623
8852 Altendorf
Switzerland
Permanent residence: Erfurt, state capital of the Free State of Thuringia, Germany.
This rented Swiss address is a public postal reception address. It is not Mario V.W.B.R. Obst’s residence or business establishment in Switzerland.
Email: trash@mishmash.work
Telephone: +49 175 7116303
Public delivery and hosting
This public website is delivered as static files through Cloudflare Workers. Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA operates a distributed delivery and security network.
Public file requests necessarily disclose technical connection information to the delivery service, such as IP address, requested URL, time, HTTP method, status and browser request headers. The purpose is to deliver the website, maintain availability and prevent abuse. The legal basis for necessary technical operation is Article 6(1)(f) GDPR, based on the interest in a functional, secure website.
The website code contains no analytics beacon, visitor database or application-level access-log writer. Workers Logs and Traces are disabled for the mishmash Worker. Cloudflare Web Analytics with Real User Monitoring has been disabled for mishmash.work; its automatic JavaScript injection is off for all visitors. Speed Brain is also disabled. Cloudflare may still process platform operational and security information as part of providing its services.
Cloudflare may process operational and security data under its contractual and legal requirements. No zero-day retention promise is made. Processing by Cloudflare on behalf of the operator is governed by its data processing agreement under Article 28 GDPR. Depending on the activity, the provider may also act under its own responsibility. Processing outside the EU/EEA, including in the USA, is possible. Cloudflare’s data processing agreement describes standard contractual clauses, supplementary safeguards and subprocessors for relevant international transfers. Information about relevant safeguards can be requested from the controller.
Cloudflare privacy policy ↗ · Cloudflare data processing agreement ↗
Browsers can cache public images, scripts and audio files and make ordinary update requests. These files are not given personal visitor identifiers by the website code.
Always Online and the Internet Archive
Always Online is enabled for mishmash.work. Through this existing integration, Cloudflare may share the hostname and frequently requested public page paths with the Internet Archive so that public pages can be archived and made available during outages. Relevant URL and technical request information may be involved. This is distinct from the local game state and from ordinary file delivery.
Cookies and interface state
The website code sets no cookies. It uses no localStorage, sessionStorage, IndexedDB or service worker. Sound and motion choices, shuffled cards, counters, selected channels, laboratory settings and other activity state exist only in the current page’s working memory. Reloading or navigating to another page starts a new activity state. A browser may temporarily retain a complete page in its own back/forward cache.
There are no accounts, saved visitor profiles, leaderboards, audience-measurement scripts or advertising trackers. Pointer coordinates used by Scrätch’s chase and the slime trail are handled locally to animate the page; the website does not send them to a server or retain a pointer history.
Public hosting may use necessary security cookies or challenges, for example Cloudflare’s cf_clearance. Their presence and lifetime depend on the real deployment. A security label alone does not determine whether consent is unnecessary; the applicable requirements, including Section 25 TDDDG, must be assessed. The website itself still sets no cookies.
Games, joke forms and downloads
Game scores, memory cards, invented forecasts, fictional programmes, generated names and laboratory experiments are calculated in your browser. There is no server-side game service. Pseudorandom choices produce entertainment, not personal identifiers.
The “Ministry of Absolutely Nothing” is a joke activity, not a contact form or public authority. Its optional alias, selected request and checkbox are read only by the current page to create an on-screen joke certificate. The submit action is intercepted locally. No form data is sent to the operator or another service, and no form submission is stored by the website. Please use a fictional name and do not enter sensitive information.
The certificate download is generated on your device as an SVG image. It includes the alias and choices you entered; the file remains wherever you choose to save it. Sharing that file is your own action. The website does not upload it, request a payment or send an order.
Images, fonts, audio and external links
Program files, portraits, other illustrations and WAV audio files are served with the website. No remote image preview, externally embedded player, external font service, map or social feed is needed to view these pages. System fonts and the platform’s rendering of standard symbols are used.
Sound is initially off and can be enabled or tested deliberately. Local audio files provide cartoon noises and pre-rendered speech. Playback uses the browser’s audio engine; it does not need a live speech-synthesis, microphone, recording or AI service. Sound testing requests the relevant audio file from the same website origin. Automatic effects follow the page’s sound setting.
The website does not request camera, microphone or geolocation access. Motion preferences can follow the operating system and be changed for the current page. These settings are not stored persistently by the website.
External web links, including Mario & Aik Lab and OBST.CASA, open in a new tab with referrer transmission disabled by the link attributes and page policy. Their providers are contacted only when you choose to follow those links, and their own privacy information then applies. Email and telephone links open your chosen app.
AI helps build the site, not track its visitors
Mario uses AI assistance for ideas, text, images, design and code. That creation process is separate from a visit to the finished website. The supplied website code has no AI chat, AI API or automatic connection to an AI provider. Your game choices, joke-form entries and browsing actions are not forwarded to AI services by the website.
AI-assisted illustrations and pre-rendered speech are static local assets. Looking at a picture or playing a complaint does not generate new content remotely. Our Mario & Aik page explains the collaboration.
Email, telephone and post
Contacting Mario by email, telephone or post is separate from the joke activities. He processes the information you provide to answer the enquiry, which may include your name, address, other contact details and message.
Article 6(1)(f) GDPR applies to the legitimate interest in handling ordinary enquiries. Article 6(1)(b) may apply to a contractual or pre-contractual request, and Article 6(1)(c) to legally required retention. Communications providers may receive the information required to deliver the message or call. Website code does not automatically forward enquiries to an AI service.
Contact is voluntary. Insufficient reply details may prevent a useful response. Information is retained only as needed for the enquiry, applicable legal duties or legal defence, and is then deleted.
Postal reception in Switzerland
JL Consulting Group GmbH receives post at the published Swiss address. Forwarding and any commissioned digitisation follow the agreed service; scanning can include message contents. This reception address does not relocate the controller’s residence to Switzerland. Switzerland is covered by a European Commission adequacy decision where applicable under Article 45 GDPR.
Postal-service privacy notice ↗ · European Commission adequacy decisions ↗
Your data protection rights
Where the legal requirements are met, you can request access, correction, deletion, restriction of processing and portability of your data. You may object to processing based on legitimate interests for reasons arising from your particular situation. Consent, if relied on for a processing activity, may be withdrawn for the future without affecting earlier lawful processing.
Please contact Mario using the details above. You can also complain to a supervisory authority, particularly where you normally live, work or consider an infringement to have occurred. The website does not make automated decisions with legal or similarly significant consequences.
Updates, search engines and optional hosting features
Last updated: 30 October 2026. The notice is updated when functions, hosting or data flows change.
A sitemap lists the public pages. Cloudflare Crawler Hints is already enabled for mishmash.work and is retained. It may notify participating search engines about public page URLs for recrawling. This concerns public website information, not game answers, joke-form aliases or pointer coordinates. An enabled switch does not prove that a particular URL has been crawled or indexed. No direct IndexNow submission is performed by a visitor’s browser.
Mario has asked for IndexNow to be checked for the finished website. The existing Crawler Hints connection is documented above. No additional direct IndexNow submission forms part of this release. Any later direct notification would be a publishing task using public URLs and a verification key, not a visitor-tracking feature. Search-engine discovery or archiving of public content is separate from a visitor’s local game state.
Last updated: 30 October 2026