Privacy Policy

Last updated: October 19, 2026

This page lists every server your browser contacts when you open fractal.garden, and what each one receives. The site has no accounts, no forms and no newsletter. It sets no cookies.

Controller

The controller under the EU General Data Protection Regulation (GDPR) is the service provider named in the imprint: Rico Trebeljahr, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany. Email for privacy questions: imprint+fractal.garden@trebeljahr.com.

Servers your browser contacts

fractal.garden: the site itself, served by Cloudflare. Pages, scripts, images and fonts all come from here.
static.cloudflareinsights.com: the script of Cloudflare Web Analytics. Visitors in the EU, the EEA, the United Kingdom and Switzerland do not get it.
plausible.trebeljahr.com: my own Plausible Analytics server.

No other server receives a request from your browser. A link to another site, such as GitHub, my blog or the donation page on ricos.site, contacts that site only when you click it.

Hosting by Cloudflare

The site is a set of static files. Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, serves them from its Worker fractal-garden. No code of mine runs when you load a page.

Cloudflare receives your IP address, the address of the page, the user agent and the referrer of each request. It uses them to deliver the site and to protect it against abuse. I do not export or keep logs of these requests.

The fonts (Merriweather, Montserrat and the KaTeX math fonts) are copies on fractal.garden. Your browser contacts no font service and no script host other than the ones listed above.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in delivering the site securely).

Cloudflare Web Analytics

Cloudflare adds the script of Cloudflare Web Analytics to each page. Your browser loads it from static.cloudflareinsights.com, and the script sends its report to fractal.garden/cdn-cgi/rum.

The report holds the page URL, the referrer and how long the page took to load. The timings include Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift. Cloudflare shows me totals by page, country, browser and device type.

The script sets no cookies and stores nothing on your device. It gives each page view a random ID and keeps no ID from one page view to the next. Cloudflare receives your IP address with the report, discards it at the nearest data center and does not store it.

Cloudflare does not add the script for visitors who connect through a Cloudflare data center in the EU, the EEA, the United Kingdom or Switzerland. For all other visitors the legal basis is Art. 6 (1) (f) GDPR (legitimate interest in knowing how fast the pages load). You can object at any time, or block static.cloudflareinsights.com with a content blocker.

Plausible Analytics

I count visits with Plausible Analytics. It runs on my own server at plausible.trebeljahr.com, rented from Hetzner Online GmbH in Nuremberg, Germany. Requests to it pass through Cloudflare as described under Hosting.

Your browser loads the Plausible script from plausible.trebeljahr.com and sends its events there. That server receives your IP address and user agent. I do not route these requests through fractal.garden, so a content blocker can stop them. The site works the same without them.

Plausible sets no cookies and stores nothing on your device. It combines your IP address and user agent with a salt that changes every day, and stores only the resulting hash. It deletes the salt after 24 hours, so nobody can trace the hash back to you. It never stores the IP address.

Plausible records the page address, the referrer, the browser, the operating system, the device type and the country. It also records clicks on links to other sites and on file downloads. It measures how far you scroll and how long the page has your attention. The script loads only on fractal.garden, not on local or test copies of the site.

The page address includes the part after the #. The L-system explorer keeps your rules there, so Plausible receives the rules you type into it. They are the only content you create that reaches a server.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in knowing which pages people read). No information is stored on or read from your device for this, so § 25 TDDDG requires no consent. You can object at any time.

Data in your browser

The site writes two things to your browser's local storage. Neither one leaves your device, and you can delete both by clearing the site data in your browser.

fractal-garden:iteration-budget:v2:…: how long your device took to draw each level of a fractal. The next visit uses it to pick a level that draws quickly.
donation-supported-at: the time you came back from the donation page on ricos.site. The site writes it only when the address has ?supported=1.

Legal basis: § 25 (2) No. 2 TDDDG (the first entry is needed to show the fractal you asked for at a speed your device can keep up with). The second entry records an action of yours, and nothing reads it yet.

Transfers outside the EU

Cloudflare, Inc. is established in the United States. It handles each request in a data center of its network, normally the one nearest to you. Access by U.S. authorities under U.S. law cannot be fully excluded. My Plausible server is in Germany.

Storage period

Plausible keeps its events with no time limit. Each event carries only the daily hash, which nobody can link to you once the salt is deleted after 24 hours.
Cloudflare Web Analytics keeps totals by page, country, browser and device type. Cloudflare does not store the IP address.
The two entries in your local storage stay there until you delete them.

Your rights

Under the GDPR you have the right to:

access the personal data held about you (Art. 15);
have inaccurate data corrected (Art. 16);
have your data deleted (Art. 17), unless a legal obligation requires me to keep it;
restrict processing (Art. 18);
receive your data in a portable format (Art. 20);
object to processing based on legitimate interest (Art. 21), which includes both kinds of analytics above.

To use any of these rights, email imprint+fractal.garden@trebeljahr.com. You can also complain to a supervisory authority (Art. 77 GDPR). The authority responsible for me is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

The site makes no automated decisions about you and builds no profile of you (Art. 22 GDPR).

Changes

I update this page when the site starts or stops using a server. The date at the top shows the last change.