Information on the processing of personal data according to Art. 13 GDPR.
This English version is a courtesy translation. Only the German version is legally binding.
This website runs on dedicated servers rented from Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The data centres are located in the EU. Database backups are stored encrypted in Hetzner Object Storage in Finland and kept for up to 6 months.
When you visit this website, the upstream web server logs: IP address, date/time, requested address, HTTP method and status, amount of data transferred, referrer, user agent and further technical details of your browser (without cookies). The application itself logs date/time, requested address and user agent, but no IP address. SafeNote requests and Leak-Check queries are not logged in either case. Purpose: operation, troubleshooting and defence against attacks. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operation and IT security). Retention period: 14 days, after which the entries are deleted automatically.
This website is delivered via Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare processes connection data such as the IP address to provide the service, for DDoS protection and for bot defence, and may set its own technically necessary security cookies for this purpose. Legal basis: Art. 6 (1) (f) GDPR. Data is transferred to the USA; Cloudflare is certified under the EU-US Data Privacy Framework.
Whether the site appears in German or English is determined by your browser's language setting and, if that does not match, by the country Cloudflare derives from your IP address. Both are only evaluated for the individual page request and are not stored. A manual choice is part of the address (?lang=) and is not stored in your browser.
To protect against automated requests, the SafeNote form and the Leak-Check use Cloudflare Turnstile. The widget is loaded from challenges.cloudflare.com; Cloudflare processes your IP address and technical browser and device characteristics in order to detect bots. Legal basis: Art. 6 (1) (f) GDPR.
The SafeNote service allows sending messages that can be retrieved once. Encryption takes place client-side in the browser using AES-GCM-256; the key stays in the URL fragment and is not transmitted to the server (zero knowledge). Only the ciphertext, the initialisation vector and timestamps are stored on the server. Notes are deleted on first retrieval; notes that are never retrieved are deleted automatically after 7 days. The encrypted database backups (see hosting) may contain the ciphertext for up to 6 months, but it cannot be read without the key from the link. No personal reference is created on the server side. Legal basis: Art. 6 (1) (f) GDPR.
When you check an email address in the Leak-Check, it is sent to Have I Been Pwned (Superlative Enterprises Pty Ltd, Australia; haveibeenpwned.com/Privacy) and to XposedOrNot (xposedornot.com/privacy), which report the known data breaches the address appears in. We neither store nor log the address. For the homepage, only the total number of breaches found is counted, without any link to the address. To limit abuse, your IP address is kept in memory for at most 10 minutes and is not stored permanently. Both services may process data outside the EU, including in countries without an adequacy decision of the European Commission; the transfer takes place because you explicitly request the check. Legal basis: Art. 6 (1) (b) GDPR, transfer under Art. 49 (1) (b) GDPR.
The protected area is currently disabled. When active, it uses WebAuthn / passkeys: the public key, credential ID and a counter are stored, no passwords are processed, and session cookies are only set when you log in. Legal basis: Art. 6 (1) (b)/(f) GDPR.
This website itself sets no cookies and stores nothing in your browser (no local storage, no tracking). Cloudflare may set technically necessary security cookies (see Cloudflare); embedded content (Discord widget, Turnstile) may set cookies in its own context.
The following are loaded directly from your browser: the site operator's GitHub profile picture (avatars.githubusercontent.com), a GitHub contribution graph (ghchart.rshah.org), the Discord server widget (discord.com, embedded as an iframe) and Cloudflare Turnstile (challenges.cloudflare.com). The respective providers receive your IP address in the process. Public GitHub profile data and the status of the Minecraft server are fetched by our server itself; no data about you is transmitted.
You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) under the GDPR. You also have the right to lodge a complaint with a data protection supervisory authority. Please send requests to [email protected].
All connections are TLS-encrypted (HTTPS). You can report security vulnerabilities in a coordinated way via /.well-known/security.txt.
See also: Legal notice