Privacy

This policy explains, in line with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR; UK GDPR for visitors from the United Kingdom), which personal data I process when you visit this website or contact me, and what rights you have. In short: this website uses no cookies, no analytics or tracking tools, no advertising, and no content or fonts from other servers.

1. Controller

Alexander Rufert, Bahnhofstraße 127, 25358 Horst, Schleswig-Holstein, Germany
E-mail: [email protected]
Author name (pen name): Nova Kingsley

No data protection officer has been appointed. Please send privacy requests to the address above.

2. Overview

• Visiting the website: technical access data (server logs) at the host, Cloudflare; see section 3.
• Cookies and local storage: none; see section 4.
• Contact: contact form or e-mail and mailbox at Google; see section 5.
• External links (Instagram, TikTok, Pinterest, Amazon, Goodreads): plain links only; data is transferred to those services only after you click; see section 6.
• Not present: user accounts, newsletter, comments, online shop, analytics or advertising services, embedded videos or maps, social-media plug-ins.

3. Hosting and server logs (Cloudflare)

This website is a static site hosted on Cloudflare Pages and delivered through Cloudflare's network. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”). Cloudflare receives your personal data as my processor under a data processing agreement (Cloudflare Data Processing Addendum, DPA).

When you open the site, your browser automatically sends data that Cloudflare processes to deliver and secure the site, in particular: IP address, date and time of the request, the page or file requested, HTTP status code, amount of data transferred, referrer (previous page), and browser and operating-system information. This is necessary to display the website and to keep it stable and secure (for example to fend off attacks).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in running a secure, stable website without my own server).

Retention: Cloudflare keeps log data only as long as needed for delivery, troubleshooting and security; Cloudflare determines the exact period. I do not keep access logs myself, I cannot see individual log entries, and I may at most see aggregated statistics (for example number of requests) with no personal reference. I do not use Cloudflare Web Analytics or any other analytics, and I do not combine this data with other data.

International transfers: Cloudflare is a US company; your data may be processed in the United States and other countries outside the EU/EEA/UK. The transfer relies on the EU-US Data Privacy Framework adequacy decision (Cloudflare is certified) and, as a fallback, on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and the UK Addendum contained in Cloudflare's DPA. More information: Cloudflare DPA, Cloudflare privacy policy.

Providing this data is not required by law or contract, but the website cannot be delivered without it. You may object to this processing on grounds relating to your particular situation (Art. 21 GDPR; see section 9).

4. Cookies and local storage

This website sets no cookies and stores nothing in your browser (no localStorage, sessionStorage or similar), so no cookie banner is needed. The release countdown runs entirely in your browser using your device clock and sends no data anywhere.

5. Contacting me (contact form and e-mail)

Contact form. The Contact page has a form. It processes the following data: your name (or any name or pseudonym you choose), your e-mail address, the subject you select, your message, and the date and time of submission. Name, e-mail address and message are required; without them I cannot reply. I do not add your IP address to the message and I do not store it.

How it works. Your input is sent over an encrypted connection (TLS) to a function on this website (Cloudflare Pages Functions). It checks the input and passes it to a small sending service (a Cloudflare Worker) in the same Cloudflare account, which sends it as an e-mail, through Cloudflare's e-mail service, to my mailbox [email protected]. The message is not stored in a database on this website. Cloudflare (Cloudflare, Inc., see section 3) acts as my processor and may keep technical delivery and error logs (such as time, sender/recipient address and delivery status) for a limited period. No other third-party form service, CAPTCHA or tracking is used. To protect against automated abuse the form contains a field that is invisible to humans (a honeypot), which works without cookies and without profiling.

E-mail. If you e-mail me directly, I process your e-mail address, the content of your message and anything else you tell me.

Purpose: answering your inquiry and communicating with you (for example questions about the book, the review team or press matters).

Legal basis: Art. 6(1)(b) GDPR where your inquiry concerns a contract or steps prior to entering into one (for example taking part in the advance-reader/ARC team); otherwise Art. 6(1)(f) GDPR (my legitimate interest in answering inquiries). Consent is not required. Please do not send me special categories of personal data (Art. 9 GDPR, e.g. health data).

Recipients: My mailbox is operated by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). Incoming messages are stored there. Data may be transferred to the United States; Google LLC is certified under the EU-US Data Privacy Framework; Google additionally relies on standard contractual clauses for transfers. More information: Google privacy policy. I do not pass your data on to anyone else unless the law requires me to.

Retention: I delete your message and the related correspondence once your inquiry is resolved, at the latest six months after the last message. Where statutory retention duties apply (for example commercially or tax-relevant correspondence), processing is restricted and the data is deleted when the period ends.

Necessity: Giving me your data is not required by law or contract, but without it I cannot reply.

6. External links (social media, Amazon, Goodreads)

This website contains plain links to external services, among them Instagram (Meta Platforms Ireland Limited, Dublin, Ireland), TikTok (TikTok Technology Limited, Dublin, Ireland), Pinterest (Pinterest Europe Ltd, Dublin, Ireland) and, in future, Amazon (depending on the marketplace, the relevant Amazon company, e.g. Amazon.com Services LLC, USA) and Goodreads (Amazon group). These are not plug-ins, embeds or buttons that load data: no data is sent to these providers when this website loads. Only when you click a link do you leave this website; from then on the provider processes your data (for example IP address, device information, cookies, and your account if you are logged in) under its own responsibility and privacy policy. I have no influence on that processing. The links are set so that your browser sends no referrer information (noreferrer). I am not responsible for processing by these providers; you can exercise your rights against them there.

If a service for the advance-reader team (ARC) or a newsletter is used in future, I will update this policy before it goes live.

Where I am active on social-media profiles, the privacy policy of the respective provider applies there as well; the legal notice (Impressum) of this website also applies to those profiles.

7. Fonts, images, AI content

All fonts, images, scripts and style sheets are served from this domain itself; no Google Fonts, CDNs or other external resources are loaded. The images on this website are AI-generated and show no real people.

8. Security, automated decisions, children

Traffic between your browser and this website is encrypted (HTTPS/TLS). There is no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR. This website is intended for adults (18+). I do not sell or share personal information and I do not use it for advertising (including within the meaning of the California CCPA/CPRA).

9. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection (Art. 21 GDPR), and
• withdrawal of consent with effect for the future (Art. 7(3) GDPR); I currently do not base any processing on consent.

Right to object (Art. 21 GDPR): Where I process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. I will then stop processing unless I can show compelling legitimate grounds that override your interests or the processing is needed for establishing, exercising or defending legal claims. Please send requests and objections informally to [email protected].

Right to lodge a complaint (Art. 77 GDPR): You may complain to a data protection supervisory authority. The authority responsible for me, as controller based in Schleswig-Holstein, Germany, is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD; the State Commissioner for Data Protection of Schleswig-Holstein), Holstenstraße 98, 24103 Kiel, Germany, phone +49 431 988-1200, e-mail: [email protected], www.datenschutzzentrum.de

You may also contact the authority in the EU member state where you live or work. Visitors from the United Kingdom may also contact the Information Commissioner's Office (ico.org.uk).

10. Changes to this policy

I will update this policy when the website or the law changes, in particular before new features (such as a newsletter, ARC sign-up or analytics) go live. The version published here applies. Last updated: October 26, 2026.

This policy was written for this website on the basis of Articles 12 to 14 GDPR. The list of server log data (section 3) and the outline of some sections were inspired by the sample text published under CC0 1.0 by opr.vc (German). This is not legal advice.