Privacy Policy

Last updated: April 2026

Who we are

Bubbles (bubbles.town) is operated by Benjamin Behnke from Germany. The operator is the controller (Verantwortlicher) responsible for the processing described below, within the meaning of Art. 4(7) GDPR. Contact: legal@bubbles.town

The short version

We store your Fediverse handle, your votes, and which blogs you follow. We use Plausible for cookieless, privacy-friendly analytics, self-hosted on a server in Germany. No personal data is collected. If you never log in, we store nothing about you.

What data we collect and why

If you browse without logging in

We use Plausible for cookieless website analytics. Plausible is self-hosted on a server in Germany. It does not use cookies and does not collect any personal data. Your IP address is processed briefly for geolocation but never stored. No individual visitor profiles are created.

The site owner uses Google Search Console to see which queries lead to bubbles.town. Search Console doesn't run any tracker on your browser — it only surfaces aggregate data Google already collects about its own search results.

If you log in via Fediverse (Mastodon OAuth)

When you log in, we receive your Fediverse handle (e.g. @you@mastodon.social) from your Fediverse instance via the OAuth protocol. We store:

• Your Fediverse handle — to associate your votes with your identity and prevent duplicate voting.
• Your votes — which entries you voted for and when.
• Your follows — which blogs you chose to follow, to populate your personal feed.
• A session cookie — to keep you logged in. This cookie is httpOnly, secure, set to SameSite=Lax, and expires when you close your browser.

That is the complete list.

What we do NOT collect

• Email addresses
• Passwords
• IP addresses
• Browser fingerprints
• Location data
• Usage analytics that identify individuals
• Any form of tracking across sessions or sites

Comments

Comments displayed on bubbles.town are fetched in real-time from Fediverse instances via the ActivityPub protocol. They are temporarily cached in memory for a few minutes to reduce server load, but they are never written to our database. We have no permanent record of any comment displayed on this site.

Blog entries

Blog titles, excerpts, and metadata displayed on this site are fetched from the public RSS or Atom feeds the blogs themselves publish. We only work with what the author has published. If a feed carries only titles, we see only titles. Posts are categorized locally by a small statistical text classifier; no external service is involved.

A blog owner who wants their blog removed from Bubbles can email hello@bubbles.town. For new blogs, we respect robots.txt during the admin review.

Legal basis for processing

• Fediverse handle, votes, and follows: Legitimate interest (Art. 6 Abs. 1 lit. f GDPR). The service requires identity to function (one vote per person per entry, personalized feed via follows).
• Session cookie: Technically necessary for maintaining your login session. No consent required.

Data storage and security

All data is stored in an SQLite database on a Hetzner Cloud server located in Germany. The server is accessed exclusively via SSH with key-based authentication. The database file is not publicly accessible.

We use HTTPS for all connections, enforced via Caddy with automatic Let's Encrypt certificates.

Third parties

Hetzner Online GmbH (Hosting)

Our server runs on Hetzner Cloud infrastructure in Germany. Hetzner may process connection data (IP addresses) as part of their infrastructure services. See their privacy policy: hetzner.com/legal/privacy-policy

We have configured our application to not log IP addresses. However, the web server (Caddy) and the operating system may temporarily process IP addresses for the purpose of establishing connections. We do not store or analyze these.

Porkbun LLC (Domain Registrar)

Our domain bubbles.town is registered with Porkbun. They process WHOIS data as required by domain registration regulations. See their privacy policy: porkbun.com/legal/privacy_policy

Fediverse Instances (Authentication and Comments)

When you log in, your Fediverse instance processes the OAuth authentication. When you comment, your comment is stored on your Fediverse instance, not on ours. Each Fediverse instance has its own privacy policy.

GoToSocial (social.bubbles.town)

We operate a GoToSocial instance at social.bubbles.town for publishing blog entry posts and receiving comments. GoToSocial is self-hosted on the same Hetzner server. Posts published by our instance are federated to other Fediverse instances according to the ActivityPub protocol.

Analytics and tracking

We use Plausible for website analytics. Plausible is self-hosted on a server in Germany and is cookieless and GDPR-compliant. It does not collect personal data, does not use cookies, and does not track visitors across sites. Your IP address is processed temporarily but never stored. No individual visitor profiles are created.

We do not use Google Analytics, Facebook Pixel, or any other tracking service. The only external requests your browser makes when visiting bubbles.town are to Fediverse instances when loading comments and to the Plausible server for the analytics script.

Data retention

• Fediverse handle, votes, and follows: Stored until you request deletion.
• Session cookie: Expires when you close your browser.
• Cached comments: Held in memory for 2–5 minutes, then discarded. Never written to disk.

Your rights

Under the GDPR, you have the right to:

• Access — request what data we store about you.
• Deletion — request that we delete all your data (Fediverse handle, votes, and follows).
• Rectification — request correction of inaccurate data.
• Portability — request your data in a machine-readable format.
• Complaint — file a complaint with a supervisory authority.

To exercise any of these rights, email us at legal@bubbles.town. We will respond within 30 days.

The competent supervisory authority for the operator is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

Data deletion

If you want all your data removed, email us at legal@bubbles.town. We will delete your Fediverse handle, all associated votes, and follows from our database. Since we don't store comments, there is nothing else to delete.

Changes to this policy

If we change this privacy policy, we will update the "last updated" date at the top. For significant changes, we will post a notice on the site.

Contact

Benjamin Behnke
Email: legal@bubbles.town
Fediverse: @bubbles@social.bubbles.town