Privacy Policy

1. Controller

The controller within the meaning of the GDPR is the operator named in the Impressum.

2. Hosting and Content Delivery Network

Cloudflare Pages

This website is hosted and delivered via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare acts as web host and Content Delivery Network (CDN) to deliver the website quickly and securely and to protect it against attacks (e.g. DDoS). When accessing the website, technical request metadata and your IP address are inevitably processed by Cloudflare.

The use of Cloudflare is based on our legitimate interest in a secure, fast and error-free provision of our online offering (Art. 6 (1) (f) GDPR). The data transfer to the USA is legitimized by the EU-US Data Privacy Framework (DPF), under which Cloudflare is certified. We have also concluded a Data Processing Agreement (DPA) with Cloudflare.

Language setting

FusePlan is available in English and German. On your first visit your browser tells us which languages you prefer and we show you the matching version. If you switch the language with the EN/DE links in the header, your browser stores that choice in local storage (localStorage) under the key fuseplan_lang so that the site opens in that language next time. This happens entirely in your browser. Nothing is sent to our server. The legal basis is Section 25 (2) No. 2 TDDDG, because you explicitly request this setting. You delete it by clearing the site data in your browser.

3. Web Analytics

Umami (Self-hosted)

This site sets no cookies. For web analytics, we use Umami, a self-hosted, privacy-focused analytics tool. Umami does not use cookies and does not track users across websites. The visit data used for statistical analysis is processed by Umami in anonymized form. Only aggregated page view statistics are collected (e.g. page URL, referrer, country, browser, operating system). IP addresses are not stored permanently. The analytics server is operated privately on our own infrastructure in Germany. The statistics are not deleted automatically. They remain stored until we delete them manually.

The use of analytics is based on Art. 6 (1) (f) GDPR (legitimate interest in the statistical evaluation and continuous improvement of our website).

No fonts, maps or social widgets from third parties are embedded and no profiling takes place.

4. Feedback, comments and reactions

On this website you can send feedback, report ideas and bugs, comment on articles, vote on posts and react to articles. For this we use the open-source software astro-feedback-board, which we run ourselves on Cloudflare (Cloudflare Workers with a Cloudflare D1 database). The board sets no cookies, loads no third-party scripts or fonts and contains no tracking.

When you open a page

Pages with the feedback board or with comments load their content from feedback.dieck-labs.de when you open them. If you let us remember your device, every page with the feedback button also asks there for new replies to your posts. Cloudflare processes your IP address and technical details of the request, such as the browser and the requested address, to deliver the content and fend off attacks. We ourselves do not store an IP address in the process.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure delivery of the website.

When you send a post

We store:

• the text of your post,
• the name, if you give one,
• the address of the page you wrote on, without parameters,
• the time,
• a hash of your IP address (see “Protection against abuse”).

We check posts before they appear. Approved posts are publicly visible with the name you gave. Without a name, “Anonymous” appears or, if you let us remember your device, a randomly generated name such as “Lunar Otter 42”. Please do not put personal data into the text or the name. The form does not accept names containing an email address or phone number.

If we have approved posts from a remembered device several times, we can mark the device as trusted. Its posts then appear without being checked first.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to collect feedback on FusePlan, answer it and discuss it in public.

Remember this device

Below the form you can tick “Remember this device so I can see replies”. The box is not ticked by default. Only if you tick it does your browser store a random device ID and your name in local storage (localStorage). This lets you see your own posts, even while they are not yet approved and the replies to them. You can also delete your posts yourself. On our server we store only a hash of this ID: on your posts, votes and reactions and together with the time you last looked at replies.

With “Forget” below the form you delete all posts from this device together with the replies to them, your votes and reactions, the generated name and all of the board’s entries in local storage.

The legal basis for storing data in your browser is Section 25 (2) No. 2 TDDDG, because you explicitly request these functions. For the processing on our server, Art. 6 (1) (f) GDPR applies.

Voting and reactions

At most one new vote per post, internet connection and day is added. For this we store, with each vote and for two days, a hash of your IP address and a random value that changes daily. If you let us remember your device, we store your vote with the hash of your device ID. It then stays your vote on the following days and you can take it back. Otherwise we store it with the hash of your IP address. We store reactions to articles with the hash of your device ID if you let us remember your device, otherwise with the hash of your IP address.

Protection against abuse

To keep the board free of spam, we limit posts, votes and reactions per internet connection. For this our server creates a hash from your IP address and a random value that is newly generated every day. We do not store the IP address itself. We delete the random value after two days. After that, not even we can tell which IP address a stored hash belongs to. We also delete the hash on posts, votes and reactions after two days.

Before sending, your browser also solves a small computing task (ALTCHA). No third party is involved.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is protecting the board against spam and abuse.

Recipients and transfer to the USA

The servers are operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as a processor under Art. 28 GDPR. The stored data is kept in a database in the EU. For delivery, Cloudflare may also use servers outside the EU. For transfers of personal data to the USA, Cloudflare relies on its certification under the EU-US Data Privacy Framework. In addition, the data processing agreement concluded with Cloudflare provides for standard contractual clauses for international data transfers.

Storage period

Your rights

The rights in section 7 apply, in particular the rights to access, rectification and erasure and the right to object to processing based on legitimate interests under Art. 21 GDPR. We cannot reliably assign posts you wrote without a remembered device to you. In that case, write to us using the contact details in the Impressum with the page, the approximate time and the text. We will then delete the post.

5. Voluntary support

Buy Me a Coffee

We offer the option to support this project via Buy Me a Coffee. The provider of this service is Publisher Media LLC, 548 Market St, PMB 69533, San Francisco, CA 94104, USA.

The integration on our site is a pure external link. We load the button image locally from our own server. Absolutely no data flows to Buy Me a Coffee when you visit our page.

When you click the button, you leave our website and are redirected directly to the Buy Me a Coffee website. From that point on, the provider’s privacy policy applies. We have no influence on the data processing that takes place there. Only then does the provider collect data like your IP address or payment details. We have no access to this data. We never store payment information on our own infrastructure.

You can find details regarding their privacy practices in the Buy Me a Coffee privacy policy: https://www.buymeacoffee.com/privacy-policy.

Kinderhaus Weimar

We link to the donation page of Kinderhaus Weimar (kinderhaus-weimar.de/spenden/). This is a pure external link. No data flows to Kinderhaus Weimar when you visit our page. When you click the link, you leave our site and are subject to the privacy policy of the respective website operator.

6. Contact by email

If you contact the operator by email, the data you send (email address, message content) is processed solely to handle your request (Art. 6 (1) (b) / (f) GDPR) and is erased once it is no longer required.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority.

The supervisory authority responsible for us is:

Data subjects may also contact any other competent data protection supervisory authority.

8. Contact

For any data-protection request, use the contact details in the Impressum.