Privacy

Who is responsible

The provider named in the legal notice is the controller for the purposes of the GDPR. Privacy enquiries go to the address below and are answered within a month, as Art. 12(3) requires.

Reading the site

You can read every published entry without an account and without being identified. There is no advertising network, no analytics provider and no tracking pixel on any page.

Two cookies are set without an account, both because you asked for something: the language you picked, and whether you collapsed the navigation. Neither identifies you and neither is read by anyone else. A third appears only once you sign in — the session that keeps you signed in.

If you have an account

An account stores the email address you signed in with, and whatever you choose to add: a display name, names, a date of birth, a contact address and a phone number. Every one of those is optional and blank until you fill it in. Legal basis: Art. 6(1)(b), performing the service you asked for.

It also stores what you saved and what you proposed, because those are the account. If you take part as a partner, the record of what was placed and what was spent is kept as long as tax law requires it — Art. 6(1)(c).

How the site is measured

The site counts what was asked and whether it could answer. Those records carry no account identifier, ever. The only identifier is a hash of a coarse network address and browser description, salted with a secret that changes every midnight — so today's records cannot be linked to yesterday's, by us or by anyone.

That is why there is no consent banner: there is nothing to consent to. Legal basis: Art. 6(1)(f), the legitimate interest in knowing whether the thing works, weighed against an interference that stops at the day boundary by design.

Paid placements

Some entries carry a labelled placement from a partner. It is chosen by the topic of the page and by nothing about you — no profile, no history, no inference. That is why the disclosure on the card can name the parameter used, and why Art. 26(3) DSA, which forbids advertising targeted using profiling with special-category data, is met by there being no profiling at all. You can switch placements off entirely in your account.

Who else handles it

The database is hosted by Supabase in Frankfurt, Germany. The site is served by Vercel. Email is sent by Resend. Each is a processor under Art. 28 with a contract in place, and each is used for exactly the one job named here.

How long

Account data lasts as long as the account. Measurement records are kept in monthly partitions and dropped whole once they are no longer useful. Records the law requires us to keep are kept for as long as it requires and no longer.

What you can do

You can download everything held about you as a file, from your account, at any time — Art. 15 and Art. 20. You can close the account and have it deleted from the same screen — Art. 17. Neither requires writing to anybody or waiting for a reply.

You also have the right to correct what is wrong (Art. 16), to restrict processing (Art. 18), to object (Art. 21), and to complain to a supervisory authority (Art. 77) — in Germany, the authority for the state where the provider is established.