Privacy

This page explains, in plain words, what personal data cowboymachines.com processes and why. The site is run by Tuul UG (haftungsbeschränkt), Marlene-Dietrich-Allee 15, 14482 Potsdam, Germany, which is the controller under Art. 4 (7) GDPR. Questions about your data: hello@cowboymachines.com.

The short version

• No tracking cookies. No analytics. No ads.
• If you sign up for news, we use your email to tell you about Cowboy Machines: when Trick-E is ready and when new stories come out. Nothing else.
• If you order from our store, we use your details to handle your order and, if Trick-E is part of it, your reservation.
• Write to hello@cowboymachines.com and we'll delete your data, except what we still need for a reservation or an order, or must keep by law.

The sign-up form

When you send the form we store: your email address, the country you chose, whether you're here as a parent or developer (if you said), what you're interested in (if you ticked anything), your browser's language setting, the page you signed up on, and when you signed up and ticked the box agreeing to hear from us, together with the exact wording of that box. We keep this so we can write to you about Cowboy Machines, in your language where we can, and so we can show that you asked us to.

The legal basis is your consent (Art. 6 (1) a GDPR). You can withdraw it any time, with effect for the future, through the unsubscribe link in any email we send or by writing to us. We keep your sign-up until you unsubscribe or ask us to delete it.

To stop automated spam, and so that nobody can use the form to send our emails to strangers, the form also counts how often it is sent from one connection and how many confirmation emails it asks for; one address gets at most three confirmation emails a day. For that we keep a one-way, salted hash of your IP address that changes every day; it can't be turned back into your address and is deleted after an hour. The legal basis is our legitimate interest in keeping the form working and stopping its misuse (Art. 6 (1) f GDPR).

To preselect your country, the page asks our server which country your connection comes from. That answer comes from Cloudflare's network, is not stored, and you can change it.

Orders

When you order from our store, we store what you ordered, your name, email address and country, the language of the page and when you ordered. If you also tick the box for news, we store a sign-up as described above. You pay on Stripe's own page, so we never see your card or bank details.

We use this to email you the payment link, to send you what you bought and, if Trick-E is part of your order, to keep your place in line. The legal basis is the steps before a contract that you asked for (Art. 6 (1) b GDPR). We keep your order until you pay (then it becomes part of your purchase), until you ask us to delete it, and at the latest six months after we email you the payment link if you don't pay.

The contact form

When you write to us with the contact form, we store your name, email address, the topic you picked, your message, the language of the page and when you sent it, and we email it to our team's own inboxes (shreyas@tuul.ai and kuba@tuul.ai) so we can answer you.

We use this only to answer you and to keep track of what we promised. The legal basis is our legitimate interest in answering messages (Art. 6 (1) f GDPR), or the steps before a contract when you ask about an order (Art. 6 (1) b GDPR). We delete the message from our database 12 months after it arrives; the emails stay in our inboxes as long as we need them for the conversation.

Visiting the site

When you open a page, your browser sends technical data such as your IP address, the page requested, time, and browser type. Our host needs this to deliver the site and keep it secure (Art. 6 (1) f GDPR). We don't build profiles from it.

The site uses no tracking cookies and no third-party trackers. It sets one small cookie, and only when you pick a language in the menu: it remembers that language for a year, so the home page opens in it next time (§ 25 (2) no. 2 TDDDG: needed for something you asked for). When you haven't picked one, our server chooses the home page's language from your browser's language setting and, if that doesn't settle it, the country your connection comes from; neither is stored. Fonts are served from our own server, not Google's. If you use the comic reader, your browser remembers locally (in its own storage, on your device) the page you stopped at, and on the Stories page, which language you like to listen in. That data never leaves your device.

Who processes data for us

The site, its server code and the sign-up database run on Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which acts as our processor under Art. 28 GDPR. Cloudflare may process data outside the EU; transfers are covered by the EU–US Data Privacy Framework, under which Cloudflare is certified, and by the European Commission's Standard Contractual Clauses. Cloudflare also sends our confirmation emails (Cloudflare Email Service). We don't sell or rent your data, and we share it with others only where the law requires it.

Your rights

You can ask us what data we hold about you and for a copy of it, and ask us to correct, delete or restrict it. Where processing is based on consent you can withdraw it; where it is based on our legitimate interests you can object to it (Art. 21 GDPR). You also have the right to complain to a data protection supervisory authority, for example the one where you live.

Contact

Tuul UG (haftungsbeschränkt)
Marlene-Dietrich-Allee 15
14482 Potsdam
Germany
hello@cowboymachines.com

Last updated: 13 October 2026