Short version: this site is hosted on my own server in Germany, sets no tracking cookies, shows no ads, loads no fonts or scripts from Google, and only processes personal data you give it yourself — when you comment or write to me. The details, as the GDPR requires them:
1. Controller
Tena Stipan
Hauptstr. 21
86420 Diedorf
E-mail: hallo@dancingspoon.net
2. Hosting and server logs
The site runs on a server rented from Hetzner Online GmbH (Gunzenhausen, Germany) in their Nuremberg data centre and is operated by me. When you open a page, the web server records a log entry with your IP address, the time, the page requested, the referring page and your browser identification. These logs are needed to run the site securely and to diagnose faults (legal basis: Art. 6 (1) (f) GDPR, legitimate interest). They are kept for 30 days and then deleted. Hetzner processes the data on my behalf under a data processing agreement.
3. Cookies
The site itself sets no cookies. Two exceptions you trigger yourself: if you tick "Save my name, email, and website in this browser" under a comment form, WordPress stores those values in a cookie for one year so you need not retype them; and if you log in, WordPress sets session cookies. Neither is used for tracking, and no consent banner is therefore needed.
4. Visitor statistics
To see which recipes are read, I use Rybbit, an open-source analytics tool that I host myself on the same infrastructure in Germany. It works without cookies and without a persistent identifier: your IP address and browser identification are hashed with a salt that changes every day, so visits cannot be linked across days or to a person, and no IP address is stored. What I see are aggregate numbers — page views, referrers, countries, device types (legal basis: Art. 6 (1) (f) GDPR). No data leaves my server.
5. Comments and recipe ratings
When you comment or rate a recipe, the name and e-mail address you enter, the optional website, the comment text, your rating, the time and your IP address are stored with the comment. The IP address is kept to defend against spam and abuse (Art. 6 (1) (f) GDPR); everything else is published as you entered it, except the e-mail address, which stays private (Art. 6 (1) (a) GDPR, your consent, which you can withdraw by asking me to delete the comment). Spam filtering happens on my server; comments are not sent to third parties. Profile pictures from Gravatar are switched off, so your e-mail address is never transmitted to Automattic.
6. Writing to me
If you e-mail me, I process your address and what you wrote in order to answer (Art. 6 (1) (b) and (f) GDPR). Messages are deleted once the matter is settled unless I have to keep them for legal reasons. Messages on Instagram, TikTok or Pinterest are processed by those platforms under their own privacy policies.
7. Fonts, images, links to social networks
Fonts and images are delivered from my own server; nothing is loaded from Google Fonts or other content delivery networks. The Instagram, TikTok and Pinterest icons are plain links — the networks learn nothing about you until you click them. The "Pin" button on a recipe opens Pinterest in a new tab the same way. Should a post embed a video from a third-party platform, that platform receives your IP address when the page loads; I mention it in the post when that is the case.
8. Your rights
Under the GDPR you may ask me at any time which personal data of yours I hold, have it corrected, deleted or restricted, receive it in a portable format, and object to processing based on legitimate interest. One e-mail to the address above is enough. You also have the right to complain to a data protection supervisory authority.
9. Changes
This policy describes the site as it is built today. If I add a newsletter, a shop or embedded content that changes what is processed, this page changes first. Last updated: October 2026.