PRIVACY / UPDATED 22 SEPTEMBER 2026
Privacy notice.
1. Who is responsible?
Timo Krämer, operating the Current Friction project
Geilsweg 1
31855 Aerzen
Germany
Email: kraemer.timo@mein.gmx. You may also send privacy requests by post to the address above. The operator has confirmed that this mailbox works and that privacy and deletion requests will be handled there.
2. Scope and information you provide
This website presents an English-language politics and current affairs project. There are no visitor accounts, checkout, newsletter signup or contact forms. You do not have to provide your name or email address to read it. Technical connection data is necessary to deliver pages. Contacting us is voluntary; without enough information we may be unable to answer a particular enquiry.
3. Hosting and technical connection data
This website uses Cloudflare Pages hosting. Cloudflare, Inc. processes technical request information such as IP address, requested URL, time of access, browser and device information, and security events, as applicable to the services used. This processing enables delivery of the website, reliability and protection against abuse. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating a secure, available information website.
Cloudflare may process data outside the European Economic Area, including in the United States. Section 6.1 of its Self-Serve Subscription Agreement incorporates the data processing addendum for relevant personal data. The addendum describes processor obligations and transfer safeguards, including standard contractual clauses where applicable. We do not claim that processing is EU-only. See Cloudflare's privacy policy and data processing addendum.
The site code does not keep its own visitor database or application access logs. Cloudflare retains technical and security information according to the purpose of processing, operational and security needs, and applicable legal requirements, as described in its privacy policy. No single fixed retention period for every provider record has been established for this configuration. We do not promise immediate deletion of provider logs or backups.
4. Cookies, analytics and external content
The public information website at currentfriction.com contains no analytics, advertising pixels, external fonts, social-media embeds, scripts or application cookies. The separate restricted reviewer portal uses a necessary session cookie and first-party scripts as explained in section 7a. Ordinary links to other websites only take you there when you follow them; those providers apply their own privacy notices. Cloudflare may use security cookies when a security challenge is necessary; the absence of application cookies on the information website is not a promise that every security response is cookie-free. Optional tracking is not part of this website.
Cloudflare may send Network Error Logging instructions in HTTP responses. Supporting browsers can report connection failures to Cloudflare to help diagnose availability problems. This is technical error reporting, not an advertising or audience analytics feature. The duration of a browser reporting instruction is not the retention period for submitted reports. Cloudflare's privacy information describes its handling of technical data.
5. Correspondence and privacy requests
If you contact us, we process the sender details, message, attachments and related correspondence needed to answer, handle corrections or address your request. Ordinary correspondence is assessed under Article 6(1)(f) GDPR, based on our interest in responding. Requests concerning a contract may fall under Article 6(1)(b); fulfilling applicable data-protection duties falls under Article 6(1)(c).
Our mailbox uses GMX, a service of 1&1 Mail & Media GmbH, Germany. Its privacy information explains processing by the email provider. Your own email or postal provider may also process the correspondence.
The operator has adopted a rule to delete ordinary enquiries 90 days after resolution, subject to a manual review. Longer retention must be justified by a legal obligation or a specific need to establish, exercise or defend legal claims; only information needed for that purpose is retained. This rule is not a guarantee that provider logs or backups disappear at the same time. Data-protection request records are assessed separately for the evidence needed to demonstrate handling of the request.
6. Your rights
Subject to the conditions and exceptions in the GDPR, you may request access, correction, erasure, restriction of processing and data portability. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing.
You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. If direct marketing is introduced, you may object to that processing at any time. This website currently has no newsletter or direct-marketing signup.
You can complain to a data-protection supervisory authority, particularly where you live or work or where an alleged infringement occurred. For the operator's location, the Lower Saxony data-protection authority provides a complaint channel. You do not have to contact us first.
Requests must be handled without undue delay and normally within one month of receipt. Where the GDPR permits an extension of up to two further months because of complexity or number of requests, you must be informed within the first month with the reasons. See our deletion instructions.
7. Google and YouTube API Services
Current Friction uses the YouTube Data API through Google OAuth for the operator's own YouTube channel. The requested scopes are limited to youtube.readonly and youtube.upload. They are used to verify the connected channel, read its own channel and video metadata, record publication results and upload a finished video only after an explicit human approval.
Raw Google user data accessed. The integration may access the authorised channel identifier and title; identifiers, titles, descriptions, privacy and publication status of videos on that channel; basic video statistics; and the OAuth access and refresh credentials required to maintain the authorised connection. It does not request the account holder's Gmail, Drive, contacts, private messages, payment information or data from other YouTube channels. The upload package sent to YouTube contains the approved video file, title, description, tags and operator-selected privacy status.
Aggregated or anonymised data. Current Friction does not request a separate aggregated or anonymised Google dataset. It may calculate limited operational summaries from its own channel data, such as upload counts, publication success or failure rates and performance trends over time. These summaries are used only to operate and improve the channel's publishing workflow and are not used to profile other Google users.
How the data is used. Read data is used to confirm that the intended Current Friction channel is connected, verify publication results, identify technical failures and assess the performance of the operator's own published videos. For editorial publishing, write access uploads the exact finished media package after the operator gives an explicit POSTEN approval. Separately authorised artificial verification tests are described in section 7a. Google-authorised account data is not used for advertising, credit decisions, surveillance, unrelated analytics or general-purpose AI/ML model development, improvement or training. It is not included in prompts sent to editorial AI services.
Transfers and processors. The OAuth request and YouTube API calls are executed by n8n on behalf of Current Friction. Minimal publication and audit records may be stored in Neon/PostgreSQL and local operational records. The approved media file is retrieved from Current Friction's Cloudinary media storage by n8n and sent to YouTube; Cloudinary does not receive account data back from Google through this workflow. Raw or aggregated Google user data is not sold, provided to data brokers or advertisers, or transferred to third-party AI/ML services for model training. Service providers receive only the data necessary to perform the operator-directed publishing, security, storage or audit function.
Protection. OAuth credentials are kept in n8n's encrypted credential store and are available only to authorised workflow operations. Access to n8n, the database and local operational systems is restricted to the operator; secrets are not placed in source files, editorial prompts or public logs. The workflow uses the minimum two scopes listed above, validates the connected channel, requires a content identifier, version and cryptographic hash, and records an upload only after the human approval gate succeeds.
Specific safeguards for sensitive Google user data.
- Google OAuth authorisation and YouTube API requests are transmitted over HTTPS/TLS. Current Friction does not intentionally transmit OAuth credentials over unencrypted channels.
- Access and refresh tokens are stored only in n8n's encrypted credential store. They are not stored in the newsroom database, media files, source-code repository, AI prompts or public website.
- Access is limited to the operator's authenticated n8n account and to the specific workflows that need the credential. The publishing workflow requests only
youtube.readonlyandyoutube.upload. - The editorial publishing path requires an approved content identifier, version and SHA-256 content hash to bind approval to the media package. Separately authorised artificial verification uploads are not editorial publications; the restricted reviewer test uses the controls described in section 7a. The live OAuth demonstration is not evidence of an interactive editorial approval gate.
- Operational database records contain only the minimum channel, publication, status and audit information needed for the service. Database credentials are separated by role, and public access to the operational schemas is revoked.
- OAuth tokens and raw Google-authorised account data are excluded from editorial AI prompts and are not transferred to third-party AI/ML services for training.
- Access can be revoked through Google at any time. When access is revoked or no longer required, the stored n8n credential is disconnected and Google-authorised data retained solely for that connection is deleted under the periods stated below.
- Security incidents affecting Google-authorised data are investigated promptly; access can be disabled while the incident is contained, and applicable legal notification duties are followed.
Current Friction's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The integration also follows the YouTube API Services Developer Policies. See the Google Privacy Policy and YouTube Terms of Service.
7a. Restricted OAuth reviewer portal
The temporary portal at review.currentfriction.com is an additional testing interface for Google's verification team, not a public registration service or a production editor. It uses a separate reviewer username and password and the operator's already-connected YouTube integration. It does not ask reviewers for Google passwords and does not itself implement the Google OAuth consent flow. The recorded demonstration shows that consent flow separately.
The portal can display the connected channel identifier and title and, after an explicit confirmation, request one fixed artificial eight-second test upload. The operator authorises this limited test separately from editorial POSTEN approvals. The file's SHA-256 hash, expected channel and resulting Unlisted visibility are checked by the backend. Reviewers cannot supply files or metadata, choose public visibility, delete videos or edit workflows. Unlisted videos are accessible to anyone with their link and are not private. The artificial clip is retrieved from the public verification-assets path on this website, not from the editorial Cloudinary library.
The portal stores a salted scrypt password verifier, not the plaintext password. Backend and tunnel secrets are encrypted with Windows CurrentUser DPAPI and are never returned to the reviewer. Its separate backend key is not the Google OAuth token. OAuth tokens remain in n8n's credential store. Public access uses HTTPS through Cloudflare Tunnel; the local service binds only to loopback and its setup ports are not exposed. Sessions use a Secure, HttpOnly, SameSite=Strict cookie with a 30-minute lifetime. Host and Origin checks, CSRF tokens, rate limits, a restrictive Content Security Policy and no-store responses protect the testing interface.
The portal processes the reviewer username, session and request-security information, the connected channel's identifier/title, the fixed upload request identifier/time and the resulting test video's identifier/privacy status. A persistent attempt record prevents repeat uploads even after restart. Access expires automatically on 28 September 2026 at 21:53 UTC. Minimal test receipts and attempt records remain for troubleshooting and verification under the retention rules in section 8; expiration disables access but does not itself delete records or YouTube videos. Successful and failed execution-payload saving is disabled in the reviewer bridge after validation; earlier operator-validation records may remain for reconciliation. Cloudflare processes connection/security data to deliver and protect access, as described in section 3. n8n performs the authorised YouTube API operations. The portal contains no advertising or audience analytics.
8. Authorisation, retention and revocation
The Google authorisation remains active only while the operator keeps the channel connected. Authorised API data is retained only as needed for the connected publishing and audit function. Stored API metadata is refreshed or deleted within 30 calendar days unless continued storage is permitted and current authorisation is reconfirmed. Publication records that no longer require API data are reduced to the minimum operational record.
Access can be revoked through Google's third-party access settings or by contacting the operator. On revocation, the credential is disconnected and its token is revoked without delay. Google-authorised data held solely under that consent is deleted as soon as possible and no later than seven calendar days, subject only to a specific legal duty that requires limited retention. The operator periodically checks that authorisation remains valid.
9. Other newsroom services
Current Friction uses or tests services including Meta (Facebook and Instagram), n8n, Neon/PostgreSQL, Cloudinary and AI/media providers. Depending on the workflow, records can include public source links, account or channel identifiers, metrics, transcripts, editorial drafts, media files and publication logs. These are not anonymised simply because a source is public.
Processors receive only the information needed for their function. Secrets and OAuth tokens must not be placed in editorial prompts or public files. WhatsApp is not part of the current approval process. Visiting this website alone does not send contact details to an AI model or connect a social account.
10. Changes
This notice is reviewed when hosting, account connections, tracking, communication channels or newsroom processing changes. The date above identifies this version. There is no automated decision-making about website visitors with legal or similarly significant effects.