Privacy Policy

1. Information We Collect

This website (roblemumin.com) is a personal, professional portfolio website. We collect minimal information:

Contact form submissions (name, email, company, message) sent via your email client
Basic web server logs (IP address, browser type, pages visited)
Authentication and protected-document features use cookies and server-side sessions. Other interactive features use browser storage and feature-specific activity data as described below.
Activity processing covers Kaboom (1.1), the Library (1.2), Calixa (1.3), NDA-protected documents (1.4), Zork saves (1.5), and the guestbook (1.6).
No advertising trackers, no cross-site analytics, no third-party ad networks

1.1 Kaboom Game Telemetry

Kaboom records gameplay and technical request data to understand performance and use of the game.

Data Collected:

Technical session identifiers: Random UUID (generated in your browser), session start/end times, total playtime
Gameplay Statistics: Score, level reached, lives remaining, audio mode choice (podcast/soundtrack)
Technical Metrics: Performance data (frame rate, latency), crash reports, browser type, device type
Geographic Data: Country and city (derived from IP address, not stored directly)

Processing boundaries:

❌ No names, email addresses, or contact information
Technical identifiers, including an IP hash and available connection metadata, may be retained; see the description above and hosting logs in section 5.
Technical identifiers, including an IP hash and available connection metadata, may be retained; see the description above and hosting logs in section 5.
❌ No cross-site tracking or third-party data sharing

Why We Collect This Data:

Improve Game Experience: Identify performance issues, optimize for different devices, fix bugs
Understand Engagement: See if visitors actually play the game and enjoy it
Audio Feature Analysis: Understand whether players prefer listening to the podcast or game soundtrack
Technical Optimization: Ensure the game runs smoothly across different browsers and devices

Legal Basis: This processing is based on legitimate interest (GDPR Art. 6(1)(f)) for improving our website's interactive features and user experience.

1.2 Library Page Activity

When you browse the Library page, we quietly note which documents people open, preview, or download, and which search terms help visitors find things. This is how we keep the library organised and prioritise materials that are actually useful — nothing more glamorous than that.

Data Collected:

Technical session identifiers: Random UUID generated in your browser, session start/end, per-page time
Document activity: Which documents were viewed, previewed, or downloaded
Search terms: Text entered into the library search bar (helps improve the search)
Technical metrics: Page load time, browser, device type — to spot and fix slowness
Approximate location: Country and city, derived from your IP address at the moment of the request. The IP itself is hashed before storage — the raw address is never kept.

Processing boundaries:

❌ No names, email addresses, or contact information
Technical identifiers, including an IP hash and available connection metadata, may be retained; see the description above and hosting logs in section 5.
Technical identifiers, including an IP hash and available connection metadata, may be retained; see the description above and hosting logs in section 5.
❌ No cross-site tracking or advertising networks

Legal Basis: Legitimate interest (GDPR Art. 6(1)(f)) — strictly for keeping the Library useful to visitors.

1.3 Calixa — Career Q&A Chat and Terminal

Calixa has two surfaces: the compact chat window reachable from the navigation, and the full-screen retro terminal at /calixa.html. Both answer questions about my professional background. If you open either surface and send a message, here is exactly what happens:

What flows where:

Your question → our server → forwarded to OpenRouter → answer returned to your browser
Context documents: a short set of background notes about my career travels alongside the question so the AI can stay on topic
IP address: Used for rate limiting and technical session records; a hashed IP identifier can be stored. Hosting access logs are described in section 5.
Only the terminal also sends: When you use the full-screen terminal at /calixa.html (not the navigation widget), each request additionally carries a browser-generated UUID plus session UUID, your preferred browser language, your timezone, your screen resolution, the entry URL, and the referrer URL. These help the terminal format replies correctly (language, time-of-day) and understand which pages visitors arrived from. Every value is generated in the browser — none come from cookies or a persistent account.

Processing boundaries:

Selected memory facts can remain on the server as described above; this is not a promise that nothing from a conversation is retained.
The browser UUID can associate visits with stored session and memory records; no registered account is required.
❌ No advertising use of anything you type

About OpenRouter: Calixa sends your question and selected context through OpenRouter to the configured model provider. When external query embedding is enabled, query text is also sent to Cohere. Provider handling depends on the applicable service terms and configuration; this site does not establish a universal no-training guarantee for every provider.

Legal Basis: Legitimate interest (GDPR Art. 6(1)(f)) for answering visitor questions, combined with your voluntary action — nothing is sent unless you type and hit send.

1.4 Document Viewer — NDA-Protected Access

NDA-protected documents require an acceptance form with contact details for NDA administration. Other features can process identifiers or voluntarily supplied names as described in this policy.

Data Collected (only in the NDA form):

Full name: as entered in the NDA acceptance form.
Email address: used to issue and verify your per-document access password, and to contact you if the NDA needs to be enforced or amended.
Company or organisation: optional free-text field.
Proof of consent: a server-side record that you checked the acceptance box, with a timestamp and document identifier.
CSRF and session tokens: short-lived technical tokens whose only purpose is to prevent cross-site request forgery against the form itself.

What is NOT collected here:

❌ Nothing beyond the fields listed above — no profiling, no advertising IDs, no social-network linkage.
❌ This form is not used for marketing, newsletters, or any other tracking outside NDA administration.

Legal Basis: Contract (GDPR Art. 6(1)(b)) — the NDA itself is the contract whose performance requires this processing. Deletion rights under Art. 17 apply subject to the retention duties that flow from the NDA.

1.5 Zork — Shareable Save Codes

The Zork terminal (zork.html) lets you save progress to your own browser (localStorage, never sent anywhere) or — only when you explicitly type /export or press the export button — upload a save snapshot to our server so you can resume on another device via a short 8-character code.

What is stored when you use /export:

Game number: 1, 2, or 3 (which Zork episode the save belongs to)
Save blob: the opaque binary state the Z-machine interpreter produced — typically 1–3 KB of base64
Random code: 8-character identifier generated on the server; this is what you share to resume
Timestamps: creation time and last-read time (used only to expire unused codes)

Processing boundaries:

❌ No visitor identifier, no session, no account
A one-way IP hash is used for rate limiting. It is not the raw address; this does not establish deletion of every technical record after one hour.
❌ No play history, no commands typed, no parser input
❌ No cross-device tracking — a save code is just a bookmark you chose to create

Retention: Save codes are automatically deleted after 90 days of inactivity. If you want to hold onto a save forever, just resume it occasionally — that touch resets the clock. Conversely, if you change your mind there is no account to delete: the code ages out on its own.

Legal Basis: Your voluntary action (GDPR Art. 6(1)(a) consent, by typing /export). The feature exists only to make portable resumes convenient.

1.6 CCIT Guestbook — Anonymous Messages

The Calixa terminal (calixa.html) includes an optional anonymous guestbook reached via the /GUESTBOOK and /SIGN commands. If you type /SIGN followed by a short message, that message is stored on the server and shown to later visitors who read the board. Nothing is stored unless you explicitly submit.

What is stored when you sign the guestbook:

Message: the text you submit (maximum 280 characters). Control characters are stripped and < > are escaped so no markup can execute.
Display name: optional — if you pass /SIGN -n NAME, the name is stored next to the message. Without it, the entry is shown as ANONYMOUS.
Country code (two letters): if Cloudflare's edge resolved one for your request (e.g. DE, US). No city, no region, no raw IP.
Timestamps: when the message was created and last updated.
Hashed IP and User-Agent: a one-way salted hash of each, used only for rate limiting (3 submissions per 30 minutes) and abuse correlation. The raw values are never stored.

What is NOT stored:

❌ No account, no login, no visitor identifier
❌ No raw IP address (only the hash, which cannot be reversed to the original IP)
❌ No fingerprinting, no cross-device tracking
The moderation filter rejects contact details from public guestbook messages. Rejected submissions may still be stored with their rejection status.

Moderation: A server-side filter rejects messages containing URLs, contact details, slurs, hate keywords, spam, and prompt-injection attempts. Rejected messages are stored with a rejected status (not shown) so repeat-abuse patterns can be reviewed. The filter is conservative — false positives go into the logs with a reason, nothing more.

Legal Basis: Your voluntary action (GDPR Art. 6(1)(a) consent, by typing /SIGN and submitting). The feature exists as a simple visitor-to-visitor shoutout board.

2. How We Use Information

Information is used solely for:

Responding to professional inquiries
Website maintenance and security
Improving the Kaboom game experience through anonymous telemetry analysis (section 1.1)
Keeping the Library page useful — knowing which documents and search terms help visitors (section 1.2)
Generating answers in the Calixa career chat or terminal when you ask a question (section 1.3)
Administering NDA acceptance records for protected documents (section 1.4)
Storing opt-in Zork save snapshots so visitors can resume play cross-device (section 1.5)
Legal compliance when required

On-site Activity Data Usage: The activity described in sections 1.1–1.6 is used exclusively to understand how visitors use the site's interactive features, identify technical issues, administer NDA access, and make the site more useful. This data is never sold, shared with third parties outside the narrow processors listed in section 5, or used for advertising purposes.

3. Information Sharing

We do not sell, trade, or share your personal information with third parties, except:

When required by law
To protect our rights or safety
With your explicit consent
Third-party processing for the services already described in section 5.

4. Data Security

We implement appropriate security measures to protect your information. However, no internet transmission is 100% secure. Contact forms use your email client (no data stored on our servers).

5. Third-Party Services

The site uses a small number of third-party services to operate. Each is listed here with its purpose:

OpenRouter / Cohere: Calixa sends your question and selected context through OpenRouter to the configured model provider. When external query embedding is enabled, query text is also sent to Cohere. Provider handling depends on the applicable service terms and configuration; this site does not establish a universal no-training guarantee for every provider.
Hosting provider: the server that delivers this website keeps short-term access logs (IP, URL, user agent) for security and abuse prevention — standard practice for any web host.

This website may also link to external sites (LinkedIn, GitHub, document sources in the Library). We are not responsible for their privacy practices. Please review their privacy policies before providing any information directly to them.

6. GDPR & DSGVO Compliance

The GDPR (also called DSGVO in German) provides the following data-subject rights:

Right of Access (Art. 15 DSGVO): Request information about personal data we process
Right to Rectification (Art. 16 DSGVO): Request correction of inaccurate personal data
Right to Erasure (Art. 17 DSGVO): Request deletion of your personal data ("Right to be forgotten")
Right to Data Portability (Art. 20 DSGVO): Receive your data in a structured, machine-readable format
Right to Object (Art. 21 DSGVO): Object to processing of your personal data
Right to Lodge a Complaint: Contact data protection authorities if you believe your rights have been violated

Legal Basis for Processing: Personal data processing is based on legitimate interests (Art. 6(1)(f) DSGVO) for professional communication and website security. Contact form data is processed with your consent (Art. 6(1)(a) DSGVO).

7. Your Rights

In addition to GDPR/DSGVO rights, you have the right to:

Withdraw consent at any time (does not affect prior processing)
Restrict processing under certain circumstances
Receive notification of data breaches when legally required
Lodge a complaint with the competent supervisory authority — for the operator's place of establishment in Cologne (North Rhine-Westphalia) this is LDI NRW, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany (https://www.ldi.nrw.de). For federal-level matters: BfDI in Bonn (https://www.bfdi.bund.de).

8. Children's Privacy

This website is not intended for children under 16. We do not knowingly collect personal information from children under 16.

9. Changes to This Policy

We may update this privacy policy occasionally. Changes will be posted on this page with an updated revision date.

10. Controller & contact

Controller within the meaning of Art. 4 No. 7 DSGVO: Roble Mumin, Cologne, Germany.

11. Legal Basis (GDPR)

For EU residents, our legal basis for processing your information:

Legitimate Interest: Professional networking and business communication
Consent: When you submit the contact form
Legal Obligation: When required by law

12. Copyright & Content Protection

All content on this website is protected by copyright law:

Unauthorized reproduction forbidden: Content may not be copied, distributed, or republished without written permission
Professional use only: Information is provided for professional networking and business communication purposes
Intellectual property: All materials represent original work and professional expertise
Contact for permissions: Use our contact form for any content usage requests