Privacy policy (website)
What this website records about your visit, and why.
Last updated: 2026-11-03 1. Controller Jan Metzger Alter Turnplatz 2 75181 Pforzheim Germany Email: legal@sparkroute.eu We are not required to appoint a Data Protection Officer. 2. Scope This policy covers the website at sparkroute.eu. The SparkRoute mobile app has its own privacy policy, available inside the app, because it processes different data for different purposes. Nothing described here applies to the app, and nothing in the app's policy applies to this site. 3. Hosting and Server Log Files This site runs on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, acting as our processor under Art. 28 GDPR. The servers are located in the European Union. Every request to this site is recorded in a log file containing: - the requested address and the time of the request - the HTTP status and the amount of data transferred - the referring page, where the browser sends one - the browser and operating system identification - the IP address of the requesting device Purpose: operating the site securely, diagnosing faults, and recognising and defending against attacks. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a functioning, secure site). These records are deleted after 14 days unless a specific incident requires us to retain a record for longer. To check that our services work, we send PostHog operating information from these logs and counts of how often each page of this site and of our account portal is visited. This information contains no personal data — no IP address, account, email address, location or search — and the visits are counted without cookies and without anything that could recognise a visitor. This happens whether or not you agree to analytics (section 7), because nothing in it relates to you. 4. Contact Form If you send a message through the contact form, we process the category you choose, the message you write, and the email address you supply so that we can reply. Purpose: answering your enquiry. Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR (our legitimate interest in responding to enquiries). The message is stored on our server for a maximum of 90 days and then deleted automatically. A copy reaches our mailbox, where it is kept for as long as answering and documenting the enquiry requires. 5. Early Access Requests If you ask for early access through the early access page, we process the email address you give, the platform you choose (Android or iOS), the language of the page you used, and the comment you choose to add. Purpose: inviting you to the test of the app on the platform you chose, which a store does by email address, and telling you once, by email, when the app is publicly available on that platform. Legal basis: Art. 6(1)(b) GDPR, because you ask us to take steps towards giving you access to the app. We use your address for nothing else. We send you one confirmation after your request. If the app becomes publicly available on your platform we send you one email saying so, and delete your request at the same time. Otherwise your request is deleted automatically after 365 days at the latest. You can have it deleted at any time by replying to one of our emails or writing to legal@sparkroute.eu. To invite you, we enter your email address in the test programme of the store you chose: Google Play (Google Ireland Limited) for Android, or TestFlight (Apple Distribution International Ltd.) for iOS. Those providers process it under their own terms. For Android the address has to be the one of your Google account. Copies made only so that an email can be sent are deleted 30 days after it was sent. Backups of our database are deleted after 14 days. 6. Feature Roadmap Voting You can vote for entries on our roadmap without an account and without telling us who you are. To stop the same visitor raising a count repeatedly, we store two things: an opaque random value placed in your browser at the moment you vote, and a non-reversible derivation of your IP address combined with a secret that we rotate every 30 days. We do not store your IP address itself, and we do not build a fingerprint of your device or browser. Purpose: keeping vote counts meaningful. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a usable feedback mechanism). The derived value is deleted after 30 days at the latest, when the secret behind it is discarded. 7. Analytics If, and only if, you agree to it, we use PostHog to understand which pages are read and which links are followed. PostHog Inc. processes this data on servers in the European Union as our processor. We record: page views, a click on an app store link, a vote, a contact submission and its category, an early access request and its platform, and a change of language. We do not record the content of your messages or the email addresses you give. Legal basis: Art. 6(1)(a) GDPR, your consent. Nothing is requested from PostHog before you agree, and you can withdraw your agreement at any time from our cookie notice; withdrawal does not affect processing carried out beforehand. Retention: a maximum of 12 months. Declining analytics leaves every part of this site fully usable. 8. Cookies and Local Storage What is stored in your browser, and why, is described in our cookie notice. In summary: your language preference, your analytics choice and your voting marker are stored because the site cannot do what you asked without them, and nothing else is stored unless you agree to analytics. 9. Your Rights You have the right to obtain information about the personal data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16), to have it erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable form (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing rests on your consent, you may withdraw it at any time with effect for the future. To exercise any of these, write to legal@sparkroute.eu. You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is Der Landesbeauftragte fuer den Datenschutz und die Informationsfreiheit Baden-Wuerttemberg, Lautenschlagerstrasse 20, 70173 Stuttgart. 10. Changes We may update this policy as the website develops.