Privacy

What we store

Your account: username, e-mail address, your password (only as a hash, never readable) and whether your name may be shown.

What connected apps report: the kind of activity, when it happened, how long or how many, and at most the country or electricity zone.

For the site's footprint: per day, how much data the site sent in total and in how many responses. Nothing else about a visit: no address, no cookie, no page.

Your redemptions and every booking of your Drops and Sparks.

What we don't store

No location more precise than a country, no contacts, no browsing history, no profile for advertising.

The page footprint at the bottom of each page is calculated in your browser. The country it uses is guessed from your time zone and never sent to us.

Cookies

Only three, and all of them only do what you asked for: your login (deleted when you log out, after seven days at the latest), your language and whether you use the light version. That's why there is no cookie banner: there is nothing to agree to.

Logins and security

When you log in, the server keeps your IP address and the name of your browser with that login, so misuse can be spotted. Both are deleted together with the login.

To stop password guessing, IP addresses are counted in memory for at most one hour. They are never written to disk.

Delivery through Cloudflare

Every request to this site passes through Cloudflare (Cloudflare, Inc., USA), which protects it against attacks. Cloudflare sees your IP address, your browser and the address you open, but not your password or what you do in your account. It is our processor under its data processing agreement and certified under the EU-US Data Privacy Framework.

Cloudflare does not keep copies of our pages for us: every request reaches our own server, so the daily totals for the site's footprint stay complete.

E-mails

Confirmation and password e-mails are delivered by Resend (Resend, Inc., USA). Resend receives your e-mail address and the content of that mail. We don't send newsletters.

What is public

Deeds are public: project, amount, receipt and, only if you chose it, your public name. Receipts are payment receipts of the operator and contain nothing about you.

The world map shows activity per country, never per person.

Deleting your account

Your name, e-mail address, password, logins and devices are erased. Bookings and Deeds stay, but without any link to you: public records stay complete and nobody can trace them back to you.

Redemptions that are still waiting are donated anonymously. Drops you haven't spent go back into the donation budget.

Your rights

You can see, download, correct and delete your data yourself in your account. For everything else, write to us. You can also complain to the Austrian Data Protection Authority (dsb.gv.at).

Who is responsible