Short version: we collect as little as possible, we never sell anything, and you can take your data with you or delete it yourself at any time.
Who is responsible
The controller under Art. 4(7) GDPR is the operator named in the Impressum.
What we store, and why
- Account data — username, email address and a hashed password (Art. 6(1)(b) GDPR, to provide the service). Your email is never shown publicly.
- Content — questions, answers and comments you post are public and stay visible with your username. Votes are recorded but only ever displayed as totals.
- Technical data — a short-lived record of your IP address for rate limiting and spam defence (Art. 6(1)(f), legitimate interest in keeping the site usable). These records are deleted automatically after 2 days. Server logs contain the usual request data.
Cookies
We set only strictly necessary cookies: a session cookie to keep you signed in, and an optional "remember me" cookie if you choose it. There are no advertising or third-party tracking cookies, which is why you don't see a consent banner.
Statistics
We count page views ourselves, on our own server, so we can see which questions are useful. This was deliberately built to collect as little as possible:
- No cookies and no other storage is used for statistics — nothing is written to your device.
- Your IP address and browser string are never stored. To estimate how many different people visited, they are combined with a secret that changes every day and turned into a short irreversible hash. Because yesterday's secret is thrown away, you cannot be recognised from one day to the next.
- What we do keep: the page visited, the day and hour, the website that linked you (domain only), and whether you were on a phone, tablet or desktop.
- Detailed rows are deleted automatically after 90 days; only daily totals remain.
- Nothing is sent to any third party — there is no Google Analytics or comparable service on this site.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in understanding whether the site works. Because no personal identifiers are stored, there is nothing for us to hand over or link back to you.
Third parties
- Fonts are hosted on our own server. Loading a page does not contact Google or any other font service.
- Emails we send (confirmation, password reset, notifications) go through our mail provider.
- The site is hosted by Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, as our processor under a data processing agreement (Art. 28 GDPR).
- We do not sell or share your data for advertising.
Your rights
You have the right to access, rectify, erase, restrict and port your data, and to object to processing (Art. 15–21 GDPR). Two of these work without asking anyone:
- Export — download everything we hold about you as JSON from your account settings.
- Deletion — delete your account from the same page. You can either anonymise it (your posts stay in their threads, detached from you) or remove your posts along with the account.
You may also lodge a complaint with a supervisory authority. For anything else, contact us at the address in the Impressum.
Retention
Account and content data is kept until you delete your account. Rate-limit records are kept 2 days; email confirmation and password-reset tokens expire within 3 days and 1 hour respectively.