Orthonormal Studio

Privacy policy

This is an English translation of the German privacy policy (Datenschutzerklärung). In case of doubt, the German version prevails.

1. Controller

Responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR):

Christian Mathieu Schmidt – Orthonormal Studio
c/o Block Services, Stuttgarterweg Str. 1906, 707036 Fell-bach, Germany
Contact: see imprint

2. General

This website is a purely static site. It sets no cookies, uses no tracking and no analytics tools, and does not load any content such as fonts or scripts from third parties. The only exception is the spam protection Cloudflare Turnstile on the contact page (see section 5). There are no user accounts. The only form is the contact form (see section 5).

3. Hosting via Cloudflare Pages

The website is provided via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; its contact in the EU is Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany. Cloudflare operates a worldwide content delivery network (CDN) that delivers the pages from servers close to the visitors and fends off attacks on the website.

For this purpose, Cloudflare automatically processes data transmitted by your browser when the pages are accessed, in particular in server log files:

The processing is necessary to deliver the website reliably and securely. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in providing the website in a stable manner that is protected against attacks. A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare. I myself do not evaluate any access data and do not use Cloudflare Web Analytics.

Personal data may be transferred to the USA in the process. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). How long Cloudflare stores the data is set out in Cloudflare’s privacy policy: cloudflare.com/privacypolicy.

4. Contact by email

If you contact me by email, your details (email address, name, content of the message) are processed in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR insofar as the enquiry is aimed at a contract, and otherwise Art. 6(1)(f) GDPR. The data are deleted as soon as the enquiry has been dealt with and no statutory retention obligations prevent this.

5. Contact form

If you use the contact form, your details (name, email address, message) are transmitted to a Cloudflare Worker, a small program service of Cloudflare, Inc. (for the address and the transfer to a third country, see section 3). The worker forwards the message to me by email. The details are not stored on the server in the process. For technical reasons, Cloudflare also processes your IP address when the form is submitted. To protect against misuse, I limit the number of messages per minute; for this purpose, the IP address is counted briefly only in hashed (cryptographically transformed) form and is not stored. A field that is invisible to humans additionally helps to detect automated spam.

If you open the form from the Cosmosono app (“Send feedback or report a bug”), a few technical details are already filled in below the message: app version, device model, system version and app language. They come with the page address and are sent only if you submit the form; you can delete them beforehand. They contain no personal data.

Messages that contain such technical details of one of my apps or games are additionally stored without name and email address as an entry in a non-public project on GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, as a processor under Art. 28 GDPR; transfer to the USA on the basis of the EU-US Data Privacy Framework). This lets me sort many messages and fix bugs. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is improving my products. The entry is deleted once the message has been dealt with, at the latest after two years. Please do not put personal details into the message that I do not need.

On the contact page I also use Cloudflare Turnstile, a service of Cloudflare, Inc., to fend off spam and automated requests (bots). For this, the page loads a script from challenges.cloudflare.com that evaluates technical characteristics of your browser and device (e.g. browser type, language settings, screen size and interaction signals) and transmits them to Cloudflare; your IP address is also processed in the process. Turnstile sets no tracking cookies and does not serve advertising. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in protecting the contact form against misuse. Access to information on your device is permitted under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) because it is strictly necessary for submitting the form, which you have requested. Cloudflare acts as a processor on the basis of a contract pursuant to Art. 28 GDPR; for the transfer to the USA, see section 3 (EU-US Data Privacy Framework).

The purpose is to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR insofar as the enquiry is aimed at a contract, and otherwise Art. 6(1)(f) GDPR; my legitimate interest lies in answering enquiries. The details are necessary so that I can reply. I delete the message as soon as your enquiry has been dealt with and no statutory retention obligations prevent this.

6. Your rights

At any time, you have the right to:

An informal message via the contact form or to the email address given in the imprint is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

As of: November 2026