Privacy policy
This page was prepared by the founders and is not legal advice.
Operator
Hosting
This website is hosted by Vercel Inc., a company based in the United States. Processing of personal data by Vercel takes place under an EU data processing agreement. Server logs may include technical data such as IP addresses for a limited time as part of hosting operations.
Contact form
When you send the contact form we store your name, email address, optional organisation and role, your stated interest, your message, the page path you came from, and a salted hash of your IP address. We use this information to reply to you. Leads are kept until the founders delete them in the admin panel.
Newsletter
Newsletter signup uses double opt in. After you enter your email we send a confirmation message via Resend. Your address is stored as pending until you confirm. You can unsubscribe in one click using the link in any newsletter email. A salted IP hash is stored with the signup.
IP address hashes
IP addresses are never stored in plain text. We store a salted SHA 256 hash for spam prevention and abuse handling. An automated retention job removes hashes after 90 days.
Analytics
We use Vercel Web Analytics. It does not set cookies and does not identify individual visitors for advertising.
YouTube embeds
Videos on this site use youtube-nocookie.com and load only after you click a placeholder that explains what will load. Until you click, no YouTube cookies or scripts are loaded.
Kiko face camera feature
On the Kiko page you may choose to allow camera access so the face on screen can follow you. Camera frames are processed only in your browser. No frames leave the browser. Nothing is stored or sent to a server. You can stop the camera at any time.
Spam protection
Public forms use Cloudflare Turnstile, a honeypot field and a minimum fill time. Turnstile may process a limited amount of technical data as described in Cloudflare's own privacy documentation.
Admin session
The admin panel sets one secure httpOnly session cookie after login. Public pages set no cookies.
Your rights under GDPR
You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. You may also withdraw consent where processing is based on consent. To use these rights, write to the email address above.
Supervisory authority
You may lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information).
Translations
We translate the German, Chinese and Japanese versions of this site ourselves. The other languages in the language menu open the page in Google Translate, a service of Google. Google then receives the address of the page and processes it under its own privacy policy. Nothing from Google loads until you choose one of those languages.