Privacy Policy

General Information and Mandatory Disclosures

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for.

Information About the Responsible Party

The responsible party for data processing on this website is:

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data.

Your Rights (Access, Deletion, Rectification, Restriction)

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of data processing and, if applicable, a right to correction, blocking or deletion of this data. Furthermore, you have the right to request the restriction of the processing of your personal data under certain circumstances.

Right to Lodge a Complaint with the Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

The supervisory authority responsible for us is:

Data subjects may also contact any other competent data protection supervisory authority.

Data Security (SSL/TLS Encryption)

This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line. The encryption protects the transmitted data in transit from being read by unauthorized third parties.

Data Collection on This Website

Local Storage

This website uses local storage to save your patio configurations and projects locally on your device. This data is not transmitted to our servers.

Hosting and Content Delivery Network

Cloudflare Pages

This website is hosted and delivered via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare acts as web host and Content Delivery Network (CDN) to deliver the website quickly and securely and to protect it against attacks (e.g. DDoS). When accessing the website, technical request metadata and your IP address are inevitably processed by Cloudflare.

The use of Cloudflare is based on our legitimate interest in a secure, fast and error-free provision of our online offering (Art. 6 (1) (f) GDPR). The data transfer to the USA is legitimized by the EU-US Data Privacy Framework (DPF), under which Cloudflare is certified. We have also concluded a Data Processing Agreement (DPA) with Cloudflare.

Web Analytics

Umami (Self-hosted)

We use Umami, a self-hosted, privacy-focused analytics tool. Umami does not use cookies and does not track users across websites. The visit data used for statistical analysis is processed by Umami in anonymized form. Only aggregated page view statistics are collected (e.g. page URL, referrer, country, browser, operating system). IP addresses are not stored permanently. The analytics server is operated privately on our own infrastructure in Germany. The statistics are not deleted automatically. They remain stored until we delete them manually.

The use of analytics is based on Art. 6 (1) (f) GDPR (legitimate interest in the statistical evaluation and continuous improvement of our website).

Feedback

On this website you can send feedback, report ideas and bugs and vote on posts. For this we use the open-source software astro-feedback-board, which we run ourselves on Cloudflare (Cloudflare Workers with a Cloudflare D1 database). The board sets no cookies, loads no third-party scripts or fonts and contains no tracking.

When you open a page

The page with the feedback board loads its content from feedback.dieck-labs.de when you open it. If you let us remember your device, every page with the feedback button also asks there for new replies to your posts. Cloudflare processes your IP address and technical details of the request, such as the browser and the requested address, to deliver the content and fend off attacks. We ourselves do not store an IP address in the process.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure delivery of the website.

When you send a post

We store:

• the text of your post,
• the name, if you give one,
• the address of the page you wrote on, without parameters,
• the time,
• a hash of your IP address (see “Protection against abuse”).

We check posts before they appear. Approved posts are publicly visible with the name you gave. Without a name, “Anonymous” appears or, if you let us remember your device, a randomly generated name such as “Lunar Otter 42”. Please do not put personal data into the text or the name. The form does not accept names containing an email address or phone number.

If we have approved posts from a remembered device several times, we can mark the device as trusted. Its posts then appear without being checked first.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to collect feedback on PatioPlanner, answer it and discuss it in public.

Remember this device

Below the form you can tick “Remember this device so I can see replies”. The box is not ticked by default. Only if you tick it does your browser store a random device ID and your name in local storage (localStorage). This lets you see your own posts, even while they are not yet approved, and the replies to them. You can also delete your posts yourself. On our server we store only a hash of this ID: on your posts and votes, and together with the time you last looked at replies.

With “Forget” below the form you delete all posts from this device together with the replies to them, your votes, the generated name and all of the board’s entries in local storage.

The legal basis for storing data in your browser is Section 25 (2) No. 2 TDDDG, because you explicitly request these functions. For the processing on our server, Art. 6 (1) (f) GDPR applies.

Voting

At most one new vote per post, internet connection and day is added. For this we store, with each vote and for two days, a hash of your IP address and a random value that changes daily. If you let us remember your device, we store your vote with the hash of your device ID. It then stays your vote on the following days and you can take it back. Otherwise we store it with the hash of your IP address.

Protection against abuse

To keep the board free of spam, we limit posts and votes per internet connection. For this our server creates a hash from your IP address and a random value that is newly generated every day. We do not store the IP address itself. We delete the random value after two days. After that, not even we can tell which IP address a stored hash belongs to. We also delete the hash on posts and votes after two days.

Before sending, your browser also solves a small computing task (ALTCHA). No third party is involved.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is protecting the board against spam and abuse.

Recipients and transfer to the USA

The servers are operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as a processor under Art. 28 GDPR. The stored data is kept in a database in the EU. For delivery, Cloudflare may also use servers outside the EU. For transfers of personal data to the USA, Cloudflare relies on its certification under the EU-US Data Privacy Framework. In addition, the data processing agreement concluded with Cloudflare provides for standard contractual clauses for international data transfers.

Storage period

Your rights

The rights in the section “Your Rights” above apply, in particular the rights to access, rectification and erasure, and the right to object to processing based on legitimate interests under Art. 21 GDPR. We cannot reliably assign posts you wrote without a remembered device to you. In that case, write to us using the contact details above with the page, the approximate time and the text. We will then delete the post.

Voluntary Support

Buy Me a Coffee

We offer the option to support this project via Buy Me a Coffee. The provider of this service is Publisher Media LLC, 548 Market St, PMB 69533, San Francisco, CA 94104, USA.

The integration on our site is a pure external link. We load the button image locally from our own server. Absolutely no data flows to Buy Me a Coffee when you visit our page.

When you click the button, you leave our website and are redirected directly to the Buy Me a Coffee website. From that point on, the provider’s privacy policy applies. We have no influence on the data processing that takes place there. Only then does the provider collect data like your IP address or payment details. We have no access to this data. We never store payment information on our own infrastructure.

You can find details regarding their privacy practices in the Buy Me a Coffee privacy policy: https://www.buymeacoffee.com/privacy-policy.

Kinderhaus Weimar

We link to the donation page of Kinderhaus Weimar (kinderhaus-weimar.de/spenden/). This is a pure external link. No data flows to Kinderhaus Weimar when you visit our page. When you click the link, you leave our site and are subject to the privacy policy of the respective website operator.