Privacy policy

This is a translation for your convenience. The German version is the legally binding one.

This page explains which data this website processes, what for, and which rights you have. In short: as little as possible. There are no ads, no tracking and no analytics tools.

1. Controller

Tiberio Rüchel
Kastanienstr. 33
15345 Altlandsberg
Germany
Email: diemilchgebendekuh@outlook.com

2. Hosting and server logs

The site is hosted by Hostinger International Ltd. (Cyprus, EU). Whenever a page is requested, the server stores technically necessary data: IP address, date and time, the address requested, browser identifier and referring page. This serves secure operation and troubleshooting (Art. 6 (1) (f) GDPR). The host deletes the logs after a short time. A data processing agreement with Hostinger is in place.

Protection against attacks: The site is protected by the programs Wordfence (Defiant Inc., USA) and Limit Login Attempts Reloaded. They check requests for attack patterns and block addresses after too many failed login attempts. For this, IP address, time and requested address are stored briefly on this server; IP addresses may be transmitted to Wordfence to be checked against known attackers (Art. 6 (1) (f) GDPR).

Emails: Confirmations, order summaries and the newsletter are sent by the site itself via the host’s mail server (sender wordpress@diemilchgebendekuh.de). Replies and questions arrive in my Outlook mailbox (Microsoft Ireland Operations Ltd., Ireland).

3. Cookies and browser storage

The site only sets cookies when you log in (WordPress login cookies), when you explicitly agree to have your name remembered while commenting, or when you switch the language at the top (cookie “dmk_sprache”, one year, contains only “de” or “en”). Your browser remembers a few settings in local storage: light or dark, how lists are displayed, where you left off in a video, where you have already pressed “Moo”, and your best time in the game on the error page. This stays on your device and is not transmitted to me. All of it is necessary for the site to work the way you have set it up (Section 25 (2) no. 2 TDDDG). That is why there is no cookie banner here: there is nothing you would have to consent to.

4. Comments

When you comment, I store your name, your email address (not public), the comment, the time, IP address and browser identifier. The IP address helps against spam and abuse (Art. 6 (1) (f) GDPR). I will delete your comments on request.

5. Account and Plus

For an account I need a username, an email address and a password (stored only as an encrypted hash), plus the language in which you receive emails. A profile picture is optional. For Plus and for single purchases I store, for each order, the order number, the plan or item purchased, amount, payment method, status and timestamps (Art. 6 (1) (b) GDPR). Tax law requires me to keep invoice-related data for up to ten years (Art. 6 (1) (c) GDPR, Section 147 AO).

PayPal: If you choose PayPal, the site forwards you to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal receives the amount, the order number and a neutral description of the order. PayPal tells me whether the payment went through, and the payment ID. I do not see your account or card details. PayPal’s privacy policy applies in addition.

Bank transfer: If you pay by bank transfer, I see your name, your IBAN and the payment reference on my bank statement. I use this only to match the payment to your order.

Twitch sub as Plus: When you connect your Twitch account, the site briefly sends you to Twitch (Twitch Interactive, Inc., USA). From there I only learn your Twitch ID and your Twitch name; I store both with your account. The site gets no rights over your Twitch account. Twice a day the site asks Twitch whether this ID is subscribed to my channel (Art. 6(1)(b) GDPR). If you disconnect in your account, these details are deleted.

Discord role: When you connect your Discord account, this site briefly sends you to Discord (Discord Inc., USA). From there I only learn your Discord ID and your Discord name; both are stored with your account. If your subscription entitles you to a role on my Discord server, the site adds you to the server in the same step – Discord explicitly asks you beforehand. The access Discord grants the site for this is handed back immediately and is not stored. After that, the site tells Discord whether this ID should be given the role or have it removed (whenever your subscription changes, otherwise hourly and once a day). As a result, Discord learns that you have a matching subscription here, and others on the server can see the role. If you disconnect in your account or delete your account, the site removes the role and deletes the ID and name (Art. 6(1)(a) GDPR, by connecting; you can withdraw at any time via “Disconnect Discord account”). If you tick “Discord” on a bell, the site sends you a direct message through Discord when there is something new on exactly that post; for this it passes the title, link and text of the message to Discord. If you type a command such as /help on my Discord server, Discord calls this site for it; the site answers with a fixed text and stores nothing about it.

Plus 18+: You only get to see adult content once I have verified that you are of legal age. For this you show me your ID in a short video call. I do not record the call and I store nothing from your ID. On your account I only note the request, the result and the time of the check (Art. 6 (1) (c) GDPR in conjunction with the German Interstate Treaty on the Protection of Minors in the Media). You can delete your account yourself at any time (Account → Settings). Order data I am required to keep then remains, without access, until the retention period ends.

Bell and mailbox: When you turn on the bell for a post, the site stores with your account which post you want to hear about, by which route (mailbox in your account, browser notification, email), and since when. When there is news there, the site puts a message in your mailbox and – only if you ticked that – sends an email to your account address. If you choose browser notifications, your browser registers this device with its delivery service (Google, Mozilla, Apple or Microsoft, depending on the browser) and stores a small background script from this site; the site only stores the device’s delivery address with your account. Only a content-free signal passes through the delivery service – it learns that and when your device receives a notification from this site. Your browser then fetches the text directly from this site. The mailbox records when you have seen a message; read messages are deleted after 180 days. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time: on the post itself, in your account under “Mailbox”, or via the opt-out link in every email. If you turn the bell off or delete your account, the related data is deleted.

Messages about your account and private messages: Everything that concerns your account (order, payment, age check, extension, reminder before a subscription ends) is placed as a letter in your mailbox on the site and additionally sent through the channels you choose in your account under “Bells”; receipts always come by email as well. The site stores the headline, text, time and whether you have read the letter. Members can send messages to me and to each other. For these the site stores sender, recipient, subject, text and time; the log only records who wrote to whom, not the content. Messages are not encrypted: if you report a message, I get to see it. You can switch off messages from other members, block individual senders and delete any letter; read mail is deleted automatically after 180 days. If you delete your account, your mailbox disappears – messages you sent to others stay with them until they delete them. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR) and my legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

For the newsletter I store your email address and, as proof of sign-up (double opt-in), the time of sign-up and confirmation as well as a shortened, irreversible hash of your IP address (Art. 6 (1) (a) GDPR). You can unsubscribe at any time via the link in every email or in your account; I then delete your address from the list.

7. Moo button

So that nobody inflates the Moo counter below posts, the site remembers an irreversible hash of your IP address together with the post for 30 seconds. After that it is gone (Art. 6 (1) (f) GDPR).

8. Videos and embedded content

YouTube: Videos only load when you click play. Before that, no request goes to YouTube; the preview image comes from this server. After the click your browser connects to YouTube (Google Ireland Limited, Ireland), and their privacy policy applies (Art. 6 (1) (a) GDPR, by clicking).

Twitch: During a livestream the home page shows a notice. The stream itself only loads when you click “Watch here”; then your browser connects to Twitch (Twitch Interactive, Inc., USA, an Amazon company) and their privacy notice applies (Art. 6(1)(a) GDPR, through the click).

MEGA: Some videos in the 18+ area are embedded from MEGA (Mega Limited, New Zealand) and load when the post is opened. According to the EU Commission, New Zealand provides an adequate level of data protection.

Fonts: All fonts are hosted on this server. There are no requests to Google Fonts or other font services.

9. Links to other services

Links to Twitch, YouTube, Discord, X, Patreon, PayPal or Buy Me a Coffee are plain links. The respective provider’s rules only apply once you click them.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), as well as the right to withdraw consent at any time. Just send me an email. You can also lodge a complaint with a data protection supervisory authority, for example the Brandenburg State Commissioner for Data Protection and Access to Information.

Last updated: October 2026

English version written by hand, not machine-translated. · Deutsch