BollwarkCookie Policy
Effective Date: August 5, 2026
Applies to: https://bollwark.eu and the Bollwark CAPTCHA service
1. The Short Version
The CAPTCHA sets no cookies. Not on your website, not on ours. That is not a configuration option we happened to leave off — the service never emits a Set-Cookie header and never reads an incoming one, and the widget writes nothing to localStorage, sessionStorage or IndexedDB. You can verify this in the source at github.com/hauju/bollwark-api, or in your browser's developer tools in about ten seconds.
One cookie exists on this site, and only after you sign in: a session cookie that keeps you logged in to the dashboard.
That is the entire policy. The rest is detail.
2. Why This Matters for You
If you embed a third-party CAPTCHA that sets cookies, those cookies land on your domain's visitors and become your consent problem — a banner entry, a line in your privacy notice, and a legal basis you have to defend. Bollwark deliberately does not create that obligation.
Because nothing is stored on or read from a visitor's device, § 25 TDDDG — the German implementation of the ePrivacy Directive, formerly TTDSG — simply does not apply to the check. No consent banner is required for it.
You still need to tell your visitors that a bot check runs and what it processes. Our Visitor Privacy Notice is written to be linked directly from your own privacy page for exactly that purpose.
3. What Cookies Are
Cookies are small text files placed on your device when you visit a website. They may be:
- Session cookies — deleted when you close your browser
- Persistent cookies — stored until they expire or you delete them
- First-party cookies — set by the site you are visiting
- Third-party cookies — set by an external service embedded in it
4. What We Actually Set
| Cookie | Type | Purpose | Consent required | Expiry |
|---|---|---|---|---|
id |
Strictly necessary, first-party | Keeps you signed in to the dashboard. Cryptographically signed, so its contents cannot be altered by anyone holding it. | ❌ No — Art. 6(1)(b) GDPR, § 25(2) TDDDG | 7 days of inactivity |
There is no second row, and that includes analytics. We do measure page views, using Umami self-hosted on our own servers — but it is cookieless, counting a visit via a hash of IP address, user agent and a daily-rotating salt rather than by storing anything on your device. Nothing is written, so there is nothing to list here and nothing to consent to.
Specifically, there are no analytics cookies, no marketing cookies, no advertising pixels, no tag manager and no session recording on this site.
If you never sign in, you leave bollwark.eu with an empty cookie jar.
5. Third-Party Services
We integrate a small number of providers. Which of them can set a cookie, and when:
| Service | Purpose | Sets a cookie on bollwark.eu? | Policy |
|---|---|---|---|
| FerrisKey (self-hosted) | Authentication and login | Only during the sign-in redirect, on its own domain | ferriskey.rs |
| Polar | Billing and subscription payments | Only on Polar's own checkout pages, when you go there to pay | polar.sh/legal/privacy |
| Umami (self-hosted) | Page-view and referrer statistics | No — it is cookieless by design | umami.is |
| Scaleway | Transactional email delivery | No — email delivery involves no browser | scaleway.com |
| Hetzner / Contabo | Server hosting | No | Hetzner · Contabo |
None of these can set a cookie on your visitors through the CAPTCHA widget. The widget loads one script and one stylesheet from api.bollwark.eu and talks to nothing else.
6. Legal Basis
Under the GDPR and § 25 TDDDG, information may be stored on or read from your device only where it is strictly necessary to provide the service you asked for, or where you have given prior consent.
- The session cookie is strictly necessary to keep you signed in — § 25(2)(2) TDDDG, Article 6(1)(b) GDPR. No consent needed, and none would be meaningful: without it, signing in does not work.
- Everything else would require consent under Article 6(1)(a) GDPR, which is why we do not do it.
7. Managing Cookies
You can manage or delete cookies in your browser at any time. Blocking the session cookie means you cannot stay signed in to the dashboard; nothing else on this site is affected.
8. Updates to This Policy
We will update this policy if our cookie usage ever changes. Given that "no cookies" is a feature we sell rather than an accident, any change here would be announced prominently rather than slipped in under a new effective date.
9. Contact
Data Controller:
Hauke Jung
Hauptstr. 41
79199 Kirchzarten, Germany
Email: info@bollwark.eu
Website: https://bollwark.eu
See also the Privacy Policy and the Visitor Privacy Notice.
© 2026 Hauke Jung. All rights reserved.