Privacy Policy

Last updated: August 2026

Who is responsible

Iftah Gabbai
Buttmannstraße 15, 13357 Berlin, Germany
Email: hello@if-tah.com
VAT ID: DE255383463

I am the controller for the processing described here, within the meaning of Article 4(7) GDPR.

What this site does and does not do

This is a static website. It has no user accounts, no login, no analytics, no tracking pixels and no advertising. It sets no cookies of its own, and there is nothing on it that follows you around the web.

Two things on the site come from other companies and do set cookies: the YouTube video embeds on device pages, and FastSpring's checkout on pages that sell software. Both load with the page, and a notice on your first visit tells you so. The notice does not switch anything on or off: accepting it stops it reappearing, and closing it does the same for the current visit. The Cookies link in the footer brings it back at any time.

Neither cookie is used for advertising or to build a profile of you. If you would rather not receive them, every browser can block third-party cookies, and the videos and the shop are the only places they come from. Google's handling is described in Google's privacy policy, FastSpring's in theirs.

Separately, the host may set one strictly necessary security cookie if a request looks automated. That one needs no consent and is described under Hosting below.

Fonts are served from this site rather than from a third party, so visiting a page sends no request to Google or anyone else.

Three things do involve other companies: hosting, the video embeds, and the shop. Each is described below.

Hosting and server logs

The site is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, on Cloudflare Pages. Like any web server, it records a log entry for each request. That entry can include:

  • your IP address
  • the date and time of the request
  • the page or file requested
  • the referring page, if any
  • your browser and operating system version

This happens automatically and is technically necessary to deliver the site and to keep it secure and available. The legal basis is Article 6(1)(f) GDPR — my legitimate interest in operating a functioning, secure website. Log data is not combined with anything else and is not used to identify you. It is retained by Cloudflare for a short period and then deleted.

Cloudflare acts as a processor on my behalf under Article 28 GDPR. It serves the site from a network of servers worldwide and answers each request from a nearby one, so a request from Europe is usually handled inside the EU, though it may be handled outside it. Where data is processed outside the EU, that transfer relies on the EU Commission's adequacy decision for the EU-US Data Privacy Framework or on Standard Contractual Clauses.

Cloudflare also filters traffic to keep the site available. For that it may set a strictly necessary cookie named __cf_bm or cf_clearance if a request looks automated. Those carry no advertising or tracking function, are not used to recognise you across sites, and in ordinary browsing you will not receive one.

Downloads and the reference PDFs are served the same way and produce the same kind of log entry as any other request.

Newsletter

The newsletter is run with EmailOctopus, a service of Octopus Technologies Ltd, 3 Sutton Lane, London EC1M 5PU, United Kingdom. If you subscribe, your email address and the time of your request are stored there so the newsletter can be sent to you.

Signing up uses double opt-in: you receive one email asking you to confirm, and you are only added once you click the link in it. Nothing else is sent before that. This also records your consent, which is the legal basis for the newsletter under Article 6(1)(a) GDPR.

Every newsletter carries an unsubscribe link. Unsubscribing withdraws your consent for the future and takes effect immediately; your address is removed from the list. EmailOctopus records whether an email was opened and whether a link in it was clicked. I use that only to see whether an issue was worth sending, and it is not used to build a profile of you.

EmailOctopus acts as a processor on my behalf under Article 28 GDPR. Data is stored in the United Kingdom, which the EU Commission has recognised as providing an adequate level of data protection.

Subscribing is entirely separate from browsing this site. If you never sign up, none of the above applies to you.

Video

Device pages include videos hosted on YouTube, embedded through youtube-nocookie.com, Google's privacy-enhanced mode. The embed loads as you scroll to it, and at that point Google receives your IP address and information about your browser. Pressing play sends further information, and Google may associate the view with your Google account if you are signed in. That processing is Google's, under Google's privacy policy.

Buying software

Purchases are handled by FastSpring (FastSpring / Bright Market LLC, Santa Barbara, California). FastSpring is the merchant of record: they are the seller, they take the payment, and they are the controller for the data you enter at checkout, including your name, email address, billing address and payment details. I never see or store your payment details.

Pages that offer software for sale load FastSpring's checkout script when the page opens, and it sets cookies for the cart. Their handling of your data is described in FastSpring's privacy policy. I receive order records — what was bought, when, and the buyer's email — which I keep for as long as tax and commercial law require, generally ten years under German law.

Contacting me

If you email me, your message and address are processed to answer you. The legal basis is Article 6(1)(f) GDPR, or Article 6(1)(b) where your message concerns a contract. Correspondence is kept as long as needed to deal with the matter and to meet retention obligations.

Your rights

Under the GDPR you have the right to:

  • access the personal data I hold about you (Article 15)
  • have inaccurate data corrected (Article 16)
  • have data erased (Article 17)
  • restrict processing (Article 18)
  • receive your data in a portable format (Article 20)
  • object to processing based on legitimate interests (Article 21)
  • withdraw consent at any time, without affecting processing already carried out

To exercise any of these, email hello@if-tah.com. There is no charge, and I will respond within one month.

You also have the right to complain to a supervisory authority. Mine is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin. You may also complain to the authority where you live.

What does not happen

There is no automated decision-making and no profiling within the meaning of Article 22 GDPR. Your data is not sold, and it is not shared with anyone beyond the providers named above.

California residents

I do not sell or share personal information as those terms are defined by the CCPA and CPRA. If you are a California resident, you may request to know, delete or correct the personal information I hold, and you will not be treated differently for asking. Use the same address above.

Changes

If this policy changes, the updated version appears on this page with a new date at the top. Material changes affecting people already on the newsletter will also be announced by email.