Privacy Policy

Information according to Art. 13 GDPR — Last updated: 2026-05-09

1. Controller

Karl Tiller
Wilhelm-Liebknecht-Str. 30, 35396 Gießen, Germany
Phone: +256 779 100 993
Email: info@karl-tiller.de

2. Data Protection Officer

A formal data protection officer is not required (private project, no large-scale data processing). Inquiries are handled directly by the controller.

3. Personal data we process

Data	Purpose	Legal basis
Name, Email, Password (hashed)	User authentication, account management	Art. 6 (1) b GDPR
Google account ID (sub), Name, Email	Sign in via Google OAuth	Art. 6 (1) a + b GDPR
Registration reason (optional)	Admin review for account approval	Art. 6 (1) b GDPR
IP address, User-Agent, Login timestamps	IT security, abuse prevention, audit log	Art. 6 (1) f GDPR (legitimate interest)
Session ID	Keep user logged in	Art. 6 (1) b GDPR

4. Cookies

We only use technically necessary cookies. No consent is required under § 25 Abs. 2 TDDDG.

Cookie	Purpose	Lifetime
ug_session	Login session	30 days
flask_session	OAuth state during Google sign-in	Browser session
ug_lang	Selected interface language	1 year

5. Third-party services and recipients

We use the following processors under Art. 28 GDPR:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — Hosting (Germany). Privacy
• Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France — Transactional email (EU). Privacy
• Google Ireland Ltd / Google LLC — OAuth sign-in. Data transfer to USA covered by EU-US Data Privacy Framework. Privacy
• Let's Encrypt / ISRG — TLS certificates.

6. International data transfer

When you sign in with Google, your data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework. All other processors are based in the EU.

7. Storage period

• User account: until you delete it (right of erasure, Art. 17 GDPR).
• Audit log entries: 90 days (automatic deletion).
• Email tokens (verification, password reset): 24 hours.
• Server access logs (nginx): rotated after 14 days.

8. Your rights as a data subject

Under the GDPR, you have the right to:

• Information about your data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure of your data (Art. 17) — available in your profile
• Restriction of processing (Art. 18)
• Data portability — JSON export available in your profile (Art. 20)
• Objection to processing (Art. 21)
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority (Art. 77) — e.g. Hessian Commissioner for Data Protection

9. Server logs (nginx)

When you visit this site, our web server temporarily stores the following data in log files: IP, User-Agent, Referer, URL, Status-Code. Logs are rotated and deleted after 14 days. Legal basis: Art. 6 (1) f GDPR (IT security).

10. Changes to this policy

This policy may be updated to reflect changes in the service or legal requirements. Significant changes will be communicated by email.

← Back to start