Privacy Policy

1. Controller

The controller within the meaning of the GDPR is the operator named in the Impressum.

2. Hosting and Content Delivery Network

Cloudflare Pages

This website is hosted and delivered via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare acts as web host and Content Delivery Network (CDN) to deliver the website quickly and securely and to protect it against attacks (e.g. DDoS). When accessing the website, technical request metadata and your IP address are inevitably processed by Cloudflare.

The use of Cloudflare is based on our legitimate interest in a secure, fast and error-free provision of our online offering (Art. 6 (1) (f) GDPR). The data transfer to the USA is legitimized by the EU-US Data Privacy Framework (DPF), under which Cloudflare is certified. We have also concluded a Data Processing Agreement (DPA) with Cloudflare.

Language setting

FusePlan is available in English and German. On your first visit your browser tells us which languages you prefer and we show you the matching version. If you switch the language with the EN/DE links in the header, your browser stores that choice in local storage (localStorage) under the key fuseplan_lang so that the site opens in that language next time. This happens entirely in your browser. Nothing is sent to our server. The legal basis is Section 25 (2) No. 2 TDDDG, because you explicitly request this setting. You delete it by clearing the site data in your browser.

Your projects in the planner

The board planner and the room planner store your projects, the settings of the interface and the values you enter in the test report template in your browser’s local storage (localStorage). This data only leaves your device when you export a JSON file, save a PDF or pass on a share link yourself. A share link carries the project in the part of the address after the #, which the browser does not send to the server. The legal basis for storing it is Section 25 (2) No. 2 TDDDG, because you explicitly request that your projects are saved. You delete the data by deleting the projects in the planner or by clearing the site data in your browser.

3. No web analytics and no cookies

This site sets no cookies and uses no web analytics. No fonts, maps or social widgets from third parties are embedded and no profiling takes place.

4. Feedback, comments and reactions

On this website you can send feedback, report ideas and bugs, comment on articles, vote on posts and react to articles. For this we use the open-source software astro-feedback-board, which we run ourselves on Cloudflare (Cloudflare Workers with a Cloudflare D1 database). The board sets no cookies, loads no third-party scripts or fonts and contains no tracking.

When you open a page

Pages with the feedback board or with comments load their content from feedback.dieck-labs.de when you open them. If you let us remember your device, every page with the feedback button also asks there for new replies to your posts. Cloudflare processes your IP address and technical details of the request, such as the browser and the requested address, to deliver the content and fend off attacks. We ourselves do not store an IP address in the process.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure delivery of the website.

When you send a post

We store:

• the text of your post,
• the name, if you give one,
• the address of the page you wrote on, without parameters,
• the time,
• a hash of your IP address (see “Protection against abuse”).

We check posts before they appear. Approved posts are publicly visible with the name you gave. Without a name, “Anonymous” appears or, if you let us remember your device, a randomly generated name such as “Lunar Otter 42”. Please do not put personal data into the text or the name. The form does not accept names containing an email address or phone number.

If we have approved posts from a remembered device several times, we can mark the device as trusted. Its posts then appear without being checked first.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to collect feedback on FusePlan, answer it and discuss it in public.

Remember this device

Below the form you can tick “Remember this device so I can see replies”. The box is not ticked by default. Only if you tick it does your browser store a random device ID and your name in local storage (localStorage). This lets you see your own posts, even while they are not yet approved and the replies to them. You can also delete your posts yourself. On our server we store only a hash of this ID: on your posts, votes and reactions and together with the time you last looked at replies.

With “Forget” below the form you delete all posts from this device together with the replies to them, your votes and reactions, the generated name and all of the board’s entries in local storage.

The legal basis for storing data in your browser is Section 25 (2) No. 2 TDDDG, because you explicitly request these functions. For the processing on our server, Art. 6 (1) (f) GDPR applies.

Voting and reactions

At most one new vote per post, internet connection and day is added. For this we store, with each vote and for two days, a hash of your IP address and a random value that changes daily. If you let us remember your device, we store your vote with the hash of your device ID. It then stays your vote on the following days and you can take it back. Otherwise we store it with the hash of your IP address. We store reactions to articles with the hash of your device ID if you let us remember your device, otherwise with the hash of your IP address.

Protection against abuse

To keep the board free of spam, we limit posts, votes and reactions per internet connection. For this our server creates a hash from your IP address and a random value that is newly generated every day. We do not store the IP address itself. We delete the random value after two days. After that, not even we can tell which IP address a stored hash belongs to. We also delete the hash on posts, votes and reactions after two days.

Before sending, your browser also solves a small computing task (ALTCHA). No third party is involved.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is protecting the board against spam and abuse.

Recipients and transfer to the USA

The servers are operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as a processor under Art. 28 GDPR. The stored data is kept in a database in the EU. For delivery, Cloudflare may also use servers outside the EU. For transfers of personal data to the USA, Cloudflare relies on its certification under the EU-US Data Privacy Framework. In addition, the data processing agreement concluded with Cloudflare provides for standard contractual clauses for international data transfers.

Storage period

Your rights

The rights in section 8 apply, in particular the rights to access, rectification and erasure and the right to object to processing based on legitimate interests under Art. 21 GDPR. We cannot reliably assign posts you wrote without a remembered device to you. In that case, write to us using the contact details in the Impressum with the page, the approximate time and the text. We will then delete the post.

5. Voluntary support

Buy Me a Coffee

We offer the option to support this project via Buy Me a Coffee. The provider of this service is Publisher Media LLC, 548 Market St, PMB 69533, San Francisco, CA 94104, USA.

The integration on our site is a pure external link. We load the button image locally from our own server. Absolutely no data flows to Buy Me a Coffee when you visit our page.

When you click the button, you leave our website and are redirected directly to the Buy Me a Coffee website. From that point on, the provider’s privacy policy applies. We have no influence on the data processing that takes place there. Only then does the provider collect data like your IP address or payment details. We have no access to this data. We never store payment information on our own infrastructure.

You can find details regarding their privacy practices in the Buy Me a Coffee privacy policy: https://www.buymeacoffee.com/privacy-policy.

Kinderhaus Weimar

We link to the donation page of Kinderhaus Weimar (kinderhaus-weimar.de/spenden/). This is a pure external link. No data flows to Kinderhaus Weimar when you visit our page. When you click the link, you leave our site and are subject to the privacy policy of the respective website operator.

6. FusePlan Android app

This section applies to the Android app FusePlan (de.diecklabs.fuseplan) by SlashGordon from Google Play. The controller is the operator named in section 1.

Summary

The app does not collect, store or share any personal data. It has no account, no ads, no analytics and no tracking and does not send anything over the internet itself. A plan is contained in its share link, and the app decodes it on your device.

Share links

A FusePlan share link holds the whole plan: the board and the room plan. When you open a share link in the app, by tapping it, sharing it to the app or pasting it, the app reads the plan from the link on your device. Nothing is uploaded and nobody is told that you opened it.

Project files

The app also opens the project files that the planner saves with “Export JSON”: with “Open file” in the app, from a files app or shared to the app. The app reads the file on your device and keeps the plan as its share link in the list of recently opened plans, like a link you opened. It does not keep a copy of the file.

Data stored on your device

The app stores the list of recently opened plans on your device: the link, the title the app shows for it and the date you opened it. You can remove each entry in the list. This data never leaves your device. It is removed when you uninstall the app or clear its storage. The legal basis is Section 25 (2) No. 2 TDDDG, because without this storage the app cannot provide the functions you use.

Clipboard and sharing

The app reads the clipboard only when you tap Paste. When you tap Share, Android’s share menu opens and you choose where the link goes.

Permissions

The app does not ask for camera, location, microphone or contacts. The Android app framework (Capacitor) declares the internet permission. Apart from the files it ships with, the app reads only the files you open in it, and it makes no network requests itself.

Links to this website and Google Play

“Edit in the browser” and “Open the planner in the browser” open this website in your browser. From then on the sections above apply. The Google Play links open Google Play.

Google Play

When you download the app from Google Play, Google processes data under its own privacy policy: policies.google.com/privacy. We do not receive personal data about you from Google beyond the anonymous statistics Google Play Console shows to all developers.

Children

The app collects no data from anyone, children included.

Your rights

The rights in section 8 apply. Since the app processes no personal data, we hold no data about you from the app.

Changes

If the app ever starts processing data, we will update this section before that version is released.

7. Contact by email

If you contact the operator by email, the data you send (email address, message content) is processed solely to handle your request (Art. 6 (1) (b) / (f) GDPR) and is erased once it is no longer required.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority.

The supervisory authority responsible for us is:

Data subjects may also contact any other competent data protection supervisory authority.

9. Contact

For any data-protection request, use the contact details in the Impressum.