Last updated: August 23, 2026

This Privacy Policy explains what information is collected when you visit mbacher.me, how it is used, and what rights you have as a visitor. The short version: this site itself sets no tracking cookies, runs no analytics software, and displays no advertisements. Some pages embed third-party YouTube videos, Vimeo videos, or SoundCloud players, which can set their own cookies — see the Third-Party Services section below for details.

This policy is written in accordance with the Swiss Federal Act on Data Protection (revDSG, in force since 1 September 2023) and, where applicable to visitors from the European Economic Area, with the General Data Protection Regulation (GDPR, Regulation EU 2016/679).

Who operates this site

mbacher.me is a personal website and blog covering aerospace, motorsport, digital privacy, and related topics. It is operated as a private, non-commercial project based in Switzerland. It is not a registered business and does not collect or process personal data for commercial gain. For enquiries regarding this policy, use the Contact page.

What data is collected and why

This site does not use analytics software, advertising networks, social media pixels, or any third-party tracking tools of its own. Visitor behaviour is not monitored, profiled, or recorded at the application level by this site. No personal data is collected through forms, comment fields, or subscriptions — these features are not active on this site.

The only data processing that occurs at the first-party level is at the infrastructure level, as is standard for any server connected to the internet:

  • Server access logs — the web server automatically records each request in a standard access log. This includes the requesting IP address, the URL requested, the HTTP status code, the referring URL if present, and a timestamp. These logs exist solely for operational and security purposes — diagnosing server errors and identifying malicious or abusive traffic. They are retained for a maximum of 7 days and are then automatically deleted, unless retention beyond that period is required for the investigation of a specific incident. They are not used to analyse visitor behaviour and are not shared with any third party.
  • WordPress session cookie — WordPress sets a temporary wordpress_test_cookie during the login process only, to verify that cookies function correctly in the browser. This cookie is not stored persistently and contains no personal data.
  • WordPress authentication cookies — when a user logs in to this site, WordPress sets standard authentication cookies (wordpress_[hash] and wordpress_logged_in_[hash]) to maintain the session. These are strictly functional cookies required for the authenticated session to operate. They are only set for users who actively log in and are not set for any visitor who does not have an account or does not log in.

Fonts and locally hosted assets

This site uses the typefaces Rubik and Karla. These fonts are served directly from this server — they are not loaded from Google Fonts or any other external font service. No font request is made to any third-party server when you visit this site, and no IP address or browser data is transmitted to Google or any font provider as a result.

Hosting and infrastructure

This site is hosted on the infrastructure of CCC Rheintal (Meierenaustrasse 32, 9443 Widnau SG, Switzerland). The server is located in Switzerland. The hosting provider processes IP addresses in server access logs as part of routine server operation, in accordance with their own privacy policy. As confirmed by the hosting provider’s policy, server log data is deleted after a maximum of 7 days. No application-level data from this site is shared with the hosting provider beyond what is inherent to the server infrastructure.

Third-party services

This site embeds content from three third-party platforms: YouTube and Vimeo (for video embeds in blog posts) and SoundCloud (for the music player on the Music page and in music-related posts). When a page containing one of these embeds loads, your browser makes a direct request to that platform’s servers — this happens independently of this site and is not something this site controls.

  • YouTube — embedded videos load via the privacy-enhanced youtube-nocookie.com/embed domain, which reduces tracking but does not eliminate it: it still sends your IP address to Google the moment the page loads and stores a device identifier in your browser’s local storage, and standard tracking cookies (including VISITOR_INFO1_LIVE, YSC, and PREF) are set as soon as you press play. Google’s data processing is governed by its own Privacy Policy.
  • Vimeo — embedded videos load with the dnt=1 (Do Not Track) parameter set, which instructs Vimeo not to set its vuid tracking cookie for that viewing session. This reduces tracking but does not fully eliminate it: your IP address is still sent to Vimeo the moment the page loads, and if your browser already holds cookies from a previous, direct visit to vimeo.com, those are sent along automatically regardless of this setting. Vimeo’s data processing is governed by its own Privacy Policy and Cookie Policy.
  • SoundCloud — the embedded audio player loads via w.soundcloud.com. This sets a sc_anonymous_id cookie used to distinguish anonymous listeners, and sends your IP address to SoundCloud. SoundCloud’s data processing is governed by its own Cookie Policy and Privacy Policy.

None of these platforms are contracted or paid by this site to process visitor data. Under the CJEU’s Fashion ID ruling, embedding third-party content can make the embedding site a joint controller for the data collection triggered by that embed — this disclosure exists in recognition of that. Images used on this site are either self-hosted or sourced from Pexels under a free licence and served locally, and do not trigger third-party requests.

If you’d prefer these third-party cookies not be set at all, we recommend using a browser that blocks third-party cookies and trackers by default — such as Brave, or Firefox with strict tracking protection enabled. Either will prevent most of this tracking automatically, without needing to avoid the embeds themselves.

Cookies

This site itself sets no cookies for visitors who are not logged in, and the WordPress authentication cookies described above only apply to logged-in accounts. However, pages containing a YouTube, Vimeo, or SoundCloud embed (see Third-Party Services above) will cause those platforms to set their own cookies in your browser as soon as the page loads or plays, independent of any action on this site. No cookie consent banner is currently displayed on this site. If you want to avoid these third-party cookies without changing your browsing habits, a browser with default third-party cookie blocking — such as Brave — or a tracker-blocking extension will handle this automatically.

Legal basis for processing (revDSG / GDPR)

The only personal data processed by this site directly — IP addresses in server access logs — is processed on the basis of legitimate interest (Art. 6(1)(f) GDPR; Art. 31 revDSG): specifically, the operational necessity of running a web server and the security interest in being able to identify and respond to malicious traffic. This processing is proportionate, limited in duration (7-day retention), and does not override the interests or rights of visitors given the minimal nature of the data and its non-commercial use. Data processing triggered by third-party embeds (see above) is governed by the respective third party’s own legal basis and policies.

Your rights

Under the Swiss revDSG and, where applicable, the GDPR, you have the right to request access to any personal data held about you, to request its correction or deletion, and to object to its processing. In practice, the only data collected by this site directly is a server log entry containing your IP address, which is deleted automatically within 7 days. Data collected by embedded third-party platforms (YouTube, Vimeo, SoundCloud) is subject to those platforms’ own rights procedures, linked above. You may submit a request regarding this site’s own data via the contact@mbacher.me email address. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch, or, if you are located in the EU, with your national data protection authority.

Changes to this policy

This policy will be updated if the data processing practices of this site change materially — for example, if analytics, a contact form, a newsletter subscription, or additional third-party embeds are introduced. The date at the top of this page always reflects when the policy was last revised. Continued use of the site after a change constitutes acceptance of the revised policy.

Summary

  • No first-party tracking cookies — this site itself sets no cookies for visitors who are not logged in
  • Pages with embedded YouTube (privacy-enhanced mode), Vimeo (Do Not Track mode), or SoundCloud players cause those platforms to set their own third-party cookies and receive your IP address
  • Recommended: use a browser like Brave, or Firefox with strict tracking protection, to block these third-party cookies automatically
  • No analytics, no ad networks, no social pixels run by this site directly
  • Fonts served locally — no requests to Google Fonts or any font CDN
  • Hosted in Switzerland by CCC Rheintal, Widnau SG
  • Server access logs retained for 7 days maximum
  • Governed by Swiss revDSG; aligned with EU GDPR for EEA visitors
Scroll to Top