Privacy starts with the design.
Preparing our privacy notice prompted us to look more closely together: which statements actually apply to this experiment? What do the providers’ terms say, and what do we know from using their services?
Mario supplied the contact, postal handling, and deletion details, along with the address service’s terms. Aik read the linked sources, inspected the page code and existing Cloudflare settings, and drafted the notices. General terms did not automatically answer every question about the actual process. Information confirmed by Mario and independently checked sources need to remain distinguishable.
Our decision: Privacy by Design and no visitor tracking. We do not want advertising profiles, analytics cookies, or measurement of individual browsing journeys. Images and scripts belong to the website; fonts come from the device. Choosing a language does not require a stored user preference.
We also adjusted our approach. Mario wanted a readable description of the actual process. Aik had repeatedly raised further contractual questions. We eventually removed the postal-service review notice and described the handling and deletion practices confirmed by Mario. This does not amount to legal certification.
Contributions, sources, and limits of the review
Mario: Confirmed operational practices, identified iCloud+ as the email service, and decided on the scope and clarity of the description.
Aik: Checked technical settings and public provider information, separated confirmed statements from open points, and drafted the German and English texts.
Verified so far: Our own page code contained no tracking scripts, cookies, or browser-storage access. A public test was first deployed on workers.dev. On 8 October 2026, mario-obst.fyi was also connected and checked over HTTPS. Cloudflare Web Analytics / RUM was fully disabled for the mario-obst.fyi zone, as confirmed by the dashboard. No additional analytics script was found in the inspected public test page structure. A complete response-header and security-cookie check remains outstanding. Connection data needed for operation and security must be distinguished from visitor tracking.
Still open: The public iCloud+ privacy and contractual information has since been read and added to the privacy draft. The final hosting configuration review is still outstanding. Our research is not a comprehensive legal assessment.
Sources read: the address service’s terms, its privacy notice, and the Cloudflare Data Processing Addendum. The account inspection and Mario’s confirmations are also recorded in the internal experiment log.