Privacy policy

Last updated: 2026-09-14

1. Controller
Jan Metzger
Alter Turnplatz 2
75181 Pforzheim
Germany
Email: legal@sparkroute.eu

We are not required to appoint a Data Protection Officer.

2. Scope
This policy covers the website at sparkroute.eu. The SparkRoute mobile app has its own privacy
policy, available inside the app, because it processes different data for different purposes.
Nothing described here applies to the app, and nothing in the app's policy applies to this site.

3. Hosting and Server Log Files
This site runs on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen,
Germany, acting as our processor under Art. 28 GDPR. The servers are located in the European Union.

Every request to this site is recorded in a log file containing:
- the requested address and the time of the request
- the HTTP status and the amount of data transferred
- the referring page, where the browser sends one
- the browser and operating system identification
- the IP address of the requesting device

Purpose: operating the site securely, diagnosing faults, and recognising and defending against
attacks. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a functioning, secure site).
These records are deleted after 14 days unless a specific incident requires us to retain a record
for longer.

4. Contact Form
If you send a message through the contact form, we process the category you choose, the message you
write, and the email address you supply so that we can reply.

Purpose: answering your enquiry. Legal basis: Art. 6(1)(b) GDPR where your message concerns a
contract or its preparation, otherwise Art. 6(1)(f) GDPR (our legitimate interest in responding to
enquiries).

The message is stored on our server for a maximum of 90 days and then deleted automatically. A copy
reaches our mailbox, where it is kept for as long as answering and documenting the enquiry requires.

To keep the form usable, we limit how often it can be submitted from one network address and we
require your browser to perform a short computation before a submission is accepted. Neither
involves any third party and neither identifies you.

5. Feature Roadmap Voting
You can vote for entries on our roadmap without an account and without telling us who you are.

To stop the same visitor raising a count repeatedly, we store two things: an opaque random value
placed in your browser at the moment you vote, and a non-reversible derivation of your IP address
combined with a secret that we rotate every 30 days. We do not store your IP address itself, and we
do not build a fingerprint of your device or browser.

Purpose: keeping vote counts meaningful. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in
a usable feedback mechanism). The derived value is deleted after 30 days at the latest, when the
secret behind it is discarded.

6. Analytics
If, and only if, you agree to it, we use PostHog to understand which pages are read and which links
are followed. PostHog Inc. processes this data on servers in the European Union as our processor.

We record: page views, a click on an app store link, a vote, a contact submission and its category,
and a change of language. We do not record the content of your messages.

Legal basis: Art. 6(1)(a) GDPR, your consent. Nothing is requested from PostHog before you agree,
and you can withdraw your agreement at any time from our cookie notice; withdrawal does not affect
processing carried out beforehand. Retention: a maximum of 12 months.

Declining analytics leaves every part of this site fully usable.

7. Cookies and Local Storage
What is stored in your browser, and why, is described in our cookie notice. In summary: your
language preference, your analytics choice and your voting marker are stored because the site
cannot do what you asked without them, and nothing else is stored unless you agree to analytics.

8. Your Rights
You have the right to obtain information about the personal data we hold about you (Art. 15 GDPR),
to have it corrected (Art. 16), to have it erased (Art. 17), to restrict its processing (Art. 18),
to receive it in a portable form (Art. 20), and to object to processing based on legitimate
interests (Art. 21). Where processing rests on your consent, you may withdraw it at any time with
effect for the future.

To exercise any of these, write to legal@sparkroute.eu.

You also have the right to lodge a complaint with a supervisory authority. The authority
responsible for us is Der Landesbeauftragte fuer den Datenschutz und die Informationsfreiheit
Baden-Wuerttemberg, Lautenschlagerstrasse 20, 70173 Stuttgart.

9. Changes
We update this policy when the site changes what it does with data. The date at the top tells you
which version you are reading.