Privacy.

Who is responsible

The controller for the processing described below, within the meaning of Article 4(7) GDPR, is:

For any data protection question or request, write to [email protected]. No data protection officer is appointed, as the thresholds in Article 37 GDPR and § 38 BDSG are not met by a project of this size and processing profile.

What this build collects

Community submissions

Display name, email address, submission type, title and body, stored in a database on the server that runs this site. The email is used only for moderation follow-up. It is never displayed publicly and is never published alongside a submission.

Poll votes

A cookie recording that this browser voted in a given poll, so the same browser is not counted twice. It contains no identifier for you. The vote itself is stored as the chosen option and the time — no IP address, no cookie value, and nothing else that links it to you or your browser.

Rate limiting

A short-lived, in-memory record of recent submission attempts per connection, to stop automated abuse. It is not persisted and is discarded when the window elapses.

Request log

One line per page request in the server’s log: the time, the page (without any search terms), the browser identification, the country Cloudflare reports, the referring site’s domain, and in place of your IP address a hash that changes every day and cannot be turned back into it. The server tallies these lines into daily counts — visitors, pages, countries, referring sites — to tell readers apart from crawlers and scanners.

Offline copies (installed app only)

If you add this site to your home screen as an app, your device keeps copies of the pages and pictures you open — up to the last 40 pages — so you can read them without a connection. They stay on your device and are never sent to us; removing the app removes them. In a browser tab, nothing is stored.

Visitor statistics

When a page loads, a small script from this domain reports the page, the referring site, your screen size and browser language, and the browser, operating system and device type your browser identifies itself with. The statistics software (Umami, running on this site’s own server, not a service) derives your country from your IP address and recognises a repeat visit by a hash of IP address, browser identification and a value that changes every month; the IP address itself is not stored. No cookies are set, nothing is stored on your device, and if your browser sends Do Not Track, nothing is reported at all.

Legal basis

• Community submissions — your consent under Article 6(1)(a) GDPR, given explicitly by the consent checkbox on the form. You may withdraw it at any time, which does not affect processing carried out before withdrawal.
• Poll cookie and rate limiting — our legitimate interest under Article 6(1)(f) GDPR in keeping a poll meaningful and the submission form usable, weighed against the near-zero intrusion of a flag with no identifier in it.
• Delivery and security logs at Cloudflare, and the request log — legitimate interest under Article 6(1)(f) GDPR in operating and securing the site. The request log holds no IP addresses.
• Visitor statistics — our legitimate interest under Article 6(1)(f) GDPR in knowing which pages are read and how readers find them, so the site can be improved. Weighed against it: no cookies, no stored IP address, no profile across sites or beyond a month, and no one but the operator ever sees the data. You can object at any time by turning on Do Not Track in your browser, or by writing to us.

Recipients and hosting

This site is not rented from a hosting company. It runs on the operator’s own hardware in Germany, so there is no hosting provider to name. Everything a visitor sends to the site still passes through one service on its way here, a processor under Article 28 GDPR; mail to the contact address, and messages through the contact form linked from the imprint, pass through a second:

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA

Content delivery, DNS, the tunnel that connects this site to the internet, and the Access identity check in front of it. It sees: IP address, browser identification, requested URL and, because Cloudflare terminates the TLS connection, the content of requests — including anything typed into the submission form. For Access, the email address of whoever signs in. Transfer outside the EEA: United States, on the basis of Cloudflare’s certification under the EU-US Data Privacy Framework and the standard contractual clauses in its data processing addendum.

Clear-Media UG (haftungsbeschränkt), operator of Online-Impressum, Europaring 90, 53757 Sankt Augustin, Germany

Receives mail sent to the contact address and messages sent through the contact form linked from the imprint, and forwards them to the operator. For that form, Online-Impressum states that it has no access to the content of the messages. It sees: The sender’s email address, any name given, and the message as it is forwarded. Transfer outside the EEA: Online-Impressum’s website, including that contact form, runs behind Cloudflare in the United States — according to Online-Impressum’s privacy policy, on the basis of the standard contractual clauses and Cloudflare’s certification under the EU-US Data Privacy Framework.

Worth stating plainly, because it is easy to miss: Cloudflare terminates the encrypted connection, so it can read what you send — a submission and the email address attached to it included. The connection from Cloudflare to this server is a tunnel the server opens itself; the server has no port open to the internet.

Nothing is sold, shared for advertising, or transferred outside the EEA without an appropriate safeguard under Chapter V GDPR. No analytics company is involved — the visitor statistics run on this site’s own server, and the site loads nothing from third-party servers: fonts are served from this domain, and videos are linked rather than embedded, so no request reaches a video platform unless you follow a link.

What this build does not collect

• Accounts, passwords or profiles — there is no login
• Advertising or cross-site tracking cookies
• Third-party analytics; no analytics company receives anything from this site

Retention

Submissions are kept while they are being moderated and, if published, for as long as the published contribution remains on the site. The email address attached to a rejected submission is deleted automatically at the moment it is rejected. Poll votes are anonymous and kept for as long as the poll is shown on the site.

The database of submissions and votes is backed up every night, on the same hardware that runs this site — its own SSD and SD card, nowhere else. Backups are kept for 30 days, so anything deleted from the site, including the email address of a rejected submission, is gone from the backups within 30 days as well.

Request log lines are overwritten as the log fills (it is capped at 30 MB); the daily counts made from them are kept for 90 days, the daily visitor hashes for two. Visitor statistics are deleted automatically after 14 months.

Your rights

Under the GDPR you have the right to:

• Access the data we hold about you (Article 15)
• Have inaccurate data corrected (Article 16)
• Have data erased (Article 17)
• Restrict processing (Article 18)
• Receive your data in a portable form (Article 20)
• Object to processing based on legitimate interest (Article 21)
• Withdraw consent at any time, with effect for the future (Article 7(3))

Write to [email protected] or use the contact page. You also have the right to lodge a complaint with a supervisory authority under Article 77 GDPR — for an operator based in Germany, the data protection authority of the relevant federal state.

Before this page goes live

This is an accurate description of what the software actually does, and the structure follows Articles 13 and 14 GDPR. It has not been reviewed by a lawyer. Before launch the operator must complete lib/legal.ts, including the email provider once the contact mailboxes exist, and have the result checked for the territory they publish from. The imprint flags whichever details are still missing.