Visitor Privacy Notice

Effective Date: August 5, 2026

You are probably reading this because a website you visited showed you a Bollwark check — a small box that asks your browser to do a piece of arithmetic to prove it is a browser and not a bot. This notice explains exactly what that check processes about you, and what it deliberately does not.

The short version: no cookies, no storage on your device, no fingerprint, no tracking across sites. The longer version follows.

Who We Are, and Whose Data This Is

Bollwark is a bot-protection service operated by Hauke Jung ("we," "us," or "our") from Hauptstr. 41, 79199 Kirchzarten, Germany.

When a Bollwark check runs on somebody else's website, we process your data on behalf of that website's operator (the "Customer"):

• The Customer — the site you were actually visiting — is the data controller. They decided to put a bot check on that page.
• Bollwark is the data processor. We run the check on their instructions and give them the result.

If the Customer self-hosts Bollwark, we receive nothing at all. Bollwark is MIT-licensed open-source software, and many operators run their own copy on their own servers. In that case the Customer is both controller and operator, this notice does not apply to them, and no data reaches us in any form. If you want to know which arrangement applies, ask the site operator.

What the Check Processes

Sent by your browser automatically

• IP address — used live, in memory, to score how likely the request is automated (for example: how many requests have come from this address in the last minute, and whether it belongs to a known abusive network). Before anything is written down, it is truncated — the last octet of an IPv4 address is dropped (203.0.113.42 → 203.0.113.0), and an IPv6 address is cut to its first 48 bits. The full address exists only for the duration of the request and is never stored or logged.
• Request headers — your User-Agent, Accept-Language and Accept-Encoding. Missing or implausible combinations are one of the strongest bot signals there is.
• Approximate country — derived from the already-truncated address using an offline database held on our own server. No lookup request leaves our infrastructure, and no third party learns you made the request.
• A TLS fingerprint, only if the Customer's setup places a reverse proxy in front of Bollwark that computes one. This is a coarse label describing how your TLS client negotiated the connection, not an identifier for you.

Measured on the page

While the check is on screen, the widget counts a small number of things and sends the counts — not a recording — when you submit:

• How many mouse movements, touches and interactions occurred
• How many milliseconds passed before your first interaction
• How long the page had been open when you submitted, calculated on our server from when the puzzle was issued, not taken from your browser
• Three yes/no answers about whether the browser reports itself as automated (navigator.webdriver, automation-driver markers, headless-browser indicators)

Every one of these is reduced to a number or a boolean before it leaves your device. There is no movement trace, no timing curve, no keystroke data — nothing with enough entropy to identify a device.

• Honeypot field — a form field invisible to you that only automated software fills in. If it is empty (as it will be for any person), nothing is processed.

What the Check Does Not Do

This list is not aspirational. It is enforced by the design of the software, and you can read the source at github.com/hauju/bollwark-api.

• ❌ No cookies. The service never sends a Set-Cookie header and never reads one.
• ❌ No local storage. The widget writes nothing to localStorage, sessionStorage, IndexedDB or any other browser storage.
• ❌ No device fingerprinting. No canvas, WebGL, audio, font or hardware enumeration. The automation probes are booleans by the time they leave your browser precisely so they cannot double as a fingerprint.
• ❌ No cross-site tracking. Nothing links your visit to one Customer's site with your visit to another's. There is no identifier that could.
• ❌ No advertising, no profiling, no automated decision-making with legal effect in the sense of Article 22 GDPR. The only decision made is "issue a puzzle, make it harder, or refuse this request".
• ❌ No form contents. Bollwark sits next to the form you are filling in and never sees what you typed into it.

Because nothing is stored on or read from your device, § 25 TDDDG (formerly TTDSG, the German implementation of the ePrivacy Directive) does not apply and no consent banner is required for the check.

Legal Basis

Processing rests on Article 6(1)(f) GDPR — legitimate interests. The interest is preventing automated abuse of the Customer's website: credential stuffing, spam, scraping and fraudulent submissions.

Recital 49 GDPR names exactly this: processing strictly necessary and proportionate to ensure network and information security, including preventing unauthorised access and stopping attacks, constitutes a legitimate interest.

The balancing test lands where it does because of the data minimisation described above — an address that is truncated before storage, counters instead of traces, and no persistent identifier of any kind. The Customer is separately responsible for having a lawful basis for the form or page the check protects.

Retention

On our hosted service:

• The live scoring state (rate counters, the pending puzzle) exists in memory only and is discarded within minutes. Puzzles are single-use and deleted the moment they are solved.
• The decision log — one row per check, holding the truncated address, the score, the outcome and the derived country — is kept for as long as the Customer's plan provides dashboard history (7, 30 or 365 days), then deleted automatically by a scheduled sweeper. The default in the open-source software is 72 hours.
• No row in that log contains a full IP address, so it cannot be used to reconstruct one person's browsing.

If the Customer self-hosts, retention is entirely theirs to configure and no copy exists on our systems.

Who Else Sees It

That is the whole list for the check itself. Country lookup uses a database file stored on those same servers, so no geolocation provider is contacted. All processing happens inside the European Union, and we transfer none of it outside the EU. Should a future sub-processor require it, we would put Standard Contractual Clauses or an adequacy decision under Article 45 GDPR in place first.

The Customer sees aggregate statistics for their own site and the individual decision rows for it. They do not see any other Customer's traffic.

Security

• In transit: HTTPS (TLS 1.2+) for every request, with the public certificate chain monitored externally.
• At rest: encrypted storage, with the address already truncated before it is written.
• Access: only the operator, over authenticated administrative endpoints that are unreachable from any browser.
• Minimisation as a control, not a policy: the truncation happens in the code path that writes the log, so there is no configuration under which a full address reaches disk.

No system is perfectly secure, and we do not claim otherwise.

Your Rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and — because we rely on legitimate interests — the right to object (Art. 21).

Exercise them with the website operator first. They are the controller, they know which site you were on, and it is their instruction we are acting under. Practically, a truncated address shared by up to 256 households is rarely sufficient for us to identify a specific record as yours, and under Article 11 GDPR we are not required to acquire additional data purely in order to do so.

If the operator does not respond, or your concern is about our practices rather than theirs, contact us directly:

Bollwark Data Protection
Hauke Jung
Hauptstr. 41
79199 Kirchzarten, Germany
Email: info@bollwark.eu

You may also lodge a complaint with your local supervisory authority. Ours is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI): baden-wuerttemberg.datenschutz.de.

Accessibility

If the check is not solvable for you — a screen reader, an assistive technology, an older device, or simply a very slow one — that is a defect on our side, not a reason to lock you out. Contact the website operator, and tell us at info@bollwark.eu so we can fix it.

California Residents (CCPA/CPRA)

We act as a service provider to the Customer. We do not sell or share personal information, and we do not use what the check processes for any purpose other than performing the check. Requests to know, delete or correct should go to the website operator where you saw the check.

Children

Bollwark is infrastructure, not a service directed at anyone in particular. It processes whatever traffic reaches the Customer's page, and it collects no profile, no account and no contact detail from anybody, of any age.

Changes

We may update this notice as the service changes or the law does. Material changes are posted here with a new effective date, and Customers are notified so they can inform their visitors.

Summary

When a Bollwark check runs on a page you visit:

✓ Your IP address is truncated before anything is stored
✓ No cookies, no storage on your device, no fingerprint
✓ No tracking between sites — there is no identifier that could do it
✓ Everything stays in the EU, on servers in Germany
✓ The website operator controls the data; we process it for them
✓ Records are deleted automatically, within 72 hours to 12 months depending on their plan
✓ You can object under Article 21 GDPR — start with the website operator

© 2026 Hauke Jung. All rights reserved.