This site is built to need as little of your data as possible. It sets no cookies on its own, loads nothing from third parties until you allow it, and keeps no profile of you. What follows is the detail.
Secret Samples is an unregistered brand of JRM-Studios and not a legal entity of its own. We have not appointed a data protection officer, as we are not required to.
This website is hosted on Cloudflare Pages, operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. To deliver a page to you, Cloudflare necessarily processes your IP address, the page you requested, the time of the request, your browser and operating system, and the page you came from. This is unavoidable – without your IP address no server can send you anything.
Legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is operating a website that loads quickly and is protected against attacks. We have a data processing agreement in place with Cloudflare, and transfers to the United States are covered by the EU standard contractual clauses.
This website sets no cookies. Not for analytics, not for advertising, not for anything else.
Two pieces of information are stored locally in your browser: your decision about YouTube, described below, and whatever you have put in your basket. Both are kept in local storage rather than in a cookie, neither ever leaves your device, and neither is readable by us. Legal basis is § 25 (2) no. 2 TDDDG – storage that is strictly necessary to provide a service you explicitly asked for.
The basket is a list of product names and nothing else. It stays in the browser you used, which is why it does not follow you to another device. You can empty it on the basket page, and clear both entries at any time through your browser; the YouTube decision can also be changed using the “Cookie settings” link in the footer.
The typeface used on this site is served from our own server. No request is made to Google Fonts or to any other font provider, and no data about you reaches one.
Product pages contain walkthrough videos hosted on YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Nothing is loaded from YouTube until you allow it. Before you decide, the player is not embedded at all – you see a still image held on our own server, and your browser makes no contact with Google. Only after you choose to allow it does the player load, at which point Google receives your IP address and can link the view to your Google account if you are signed in. Google may also process this data in the United States.
Legal basis is your consent under Art. 6 (1) (a) GDPR. You may withdraw it at any time through the “Cookie settings” link in the footer, with effect for the future. Google’s own privacy policy is at policies.google.com/privacy.
If you decline, you can still watch the same videos by following a link to YouTube. That is then your own visit to Google’s site, under Google’s terms, not something this site does for you.
We use Cloudflare Web Analytics to see how many people visit and which pages they read. It sets no cookies, uses no fingerprinting, and builds no profile across sites or visits. Your IP address is used momentarily to derive the country you are in and is not stored.
Because this does not involve storing or reading information on your device, no consent is required for it; legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in knowing whether the site is reaching anyone at all. We chose this over a conventional analytics service precisely so that you are not asked to agree to being measured.
Purchases are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. When you buy, you enter your email address and payment details on a checkout page operated by Stripe. Stripe processes your name, email address, payment data, IP address and the details of the transaction. We never see your card number.
After payment, we process your email address and the purchased product in order to deliver the download link to you. The email itself is sent through Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany), and the files are stored on Cloudflare R2.
Legal basis for all of this is Art. 6 (1) (b) GDPR – processing necessary to perform the contract you entered into.
For invoicing and bookkeeping we use Collmex GmbH, Hauptstraße 30, 71691 Freiberg am Neckar, Germany. Invoice data is retained for as long as German commercial and tax law requires, generally ten years under § 147 AO and § 257 HGB. Legal basis is Art. 6 (1) (c) GDPR, compliance with a legal obligation.
If you email us, we process the address you wrote from and whatever you put in the message, for as long as it takes to deal with your request and afterwards for as long as any retention obligation applies. Legal basis is Art. 6 (1) (b) GDPR where it concerns a purchase, and Art. 6 (1) (f) GDPR otherwise – our legitimate interest in answering you.
There is no contact form on this site, which means there is no form data and no spam protection service processing anything about you.
Cloudflare and Google are based in the United States and may process data there. Such transfers are based on the EU standard contractual clauses under Art. 46 (2) (c) GDPR, and on each provider’s certification under the EU-US Data Privacy Framework. We cannot rule out that US authorities may gain access to data despite these measures – this is the residual risk you accept when you allow YouTube, and the reason we keep every other third party out of the page.
You have the right to request access to the data we hold about you (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to have processing restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on your consent, you may withdraw that consent at any time with effect for the future.
To exercise any of these, write to john@secret-samples.com. You also have the right to complain to a supervisory authority. Ours is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.
This site is served over HTTPS. Everything between your browser and the server is encrypted, including anything you type.
We update this policy when the site changes. The date below tells you which version you are reading.
Last updated: November 2026
Secret