개인정보 처리방침

이 문서는 편의를 위한 번역본입니다. 법적 효력은 독일어판에만 있습니다.

Who is responsible

Please send questions about privacy to [email protected]. We have not appointed a data protection officer.

What this policy covers

This privacy policy applies to stellium.club with all its pages and to every Stellium product – Stellium account, Leitwert, apps, games and mods – however you use them. chat.stellium.club and weltenbrand.stellium.club also have their own notices.

The current version published here always applies, including to products you already use. You don’t have to confirm anything for this: a privacy policy informs you, it is not a contract. Where we need your consent (for example for Google Ads), we ask you explicitly, and that consent remains valid as long as the purpose does not change.

The essentials

• Stellium runs on its own small server (a Raspberry Pi) in Anchorage, Alaska, USA, with Cloudflare in front of it.
• Without your consent there is no tracking and there are no advertising cookies. Google Ads is only loaded after you choose “Accept”.
• We serve fonts, scripts, images and videos ourselves. Opening a page loads nothing from Google Fonts, YouTube or other third-party servers.
• A Stellium account is optional. Leitwert works without one; your progress then stays in your browser only.

Where your data is processed

The controller and the server are located in the USA, so your data is processed in the USA when you use stellium.club. The level of data protection there differs from the EU, and there is no EU adequacy decision covering us. Because our services are also offered to people in the EU, the General Data Protection Regulation still applies to us (Art. 3(2) GDPR), and we follow it.

Cloudflare

Every request to stellium.club passes through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare provides the domain (DNS), protects the server against attacks and forwards requests through an encrypted tunnel to our server. The encrypted connection from your browser ends at Cloudflare, so Cloudflare can technically see everything you send us, including sign-in data. Cloudflare processes the data on our behalf and is certified under the EU-US Data Privacy Framework.

The legal basis is our legitimate interest in a secure and available service (Art. 6(1)(f) GDPR). More: Cloudflare privacy policy.

The website can also be reached through a second route, Tailscale Funnel (Tailscale Inc., Toronto, Canada). Requests that use this route go through Tailscale instead of Cloudflare.

Server log files

On every request our web server automatically records:

• your IP address
• date and time
• the address requested, including parameters
• the page you came from (referrer)
• browser and operating system (user agent)
• status code and amount of data

We need this to find errors and fend off attacks (Art. 6(1)(f) GDPR). The log is limited to 200 MB and continuously overwrites the oldest entries; an entry is usually gone after about two weeks. We do not combine this data with other data.

Visitor statistics

From these log files we count how many people visit the website. To do this, your IP address is combined with a secret random value and turned into a short pseudonym (hash) from which the IP address cannot be recovered. For the daily figures the random value changes every week and the pseudonyms are deleted after 8 days. To tell new from returning visitors, we also keep a second pseudonym together with the day of your last visit. It is deleted 730 days after your last visit. We do not set cookies for this.

The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). You can object at any time; an email to [email protected] is enough.

While Leitwert is open, it sends a short signal every 15 seconds to our server at chat.stellium.club. It contains only the address of the page and a random number for the open page. The server turns your IP address and browser into a pseudonym with a random value that changes daily and stores only daily totals.

Storage in your browser

For some features the website keeps small entries in your browser’s storage (localStorage or sessionStorage). They stay on your device and are not sent to us, unless you have an account and Leitwert syncs your progress.

• stellium-sprache: the language you chose
• stellium-einwilligung: your choice about Google Ads
• stellium-sitzung (until the tab is closed): so the language is picked automatically only on your first visit
• stellium-ton: whether sounds are on
• leitwert-…: your progress, drafts of workshop tasks, the practice exam in progress, catalog filters and your class game session

These entries are needed for features you use yourself, so no consent is required (Section 25(2) No. 2 TDDDG). You can delete them in your browser at any time.

Google Ads (only with consent)

We use Google Ads to measure whether our advertising works. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also go to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework.

Without your consent not a single request goes to Google, and Google’s code is not loaded. Only when you choose “Accept” in the notice at the bottom does the page load Google’s code. Google then sets cookies (for example _gcl_au, valid for 90 days according to Google) and receives your IP address, information about your browser and device, the pages you visit and whether you took an action after clicking an ad.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via “Privacy settings” at the bottom of every page. We then delete the Google cookies we are able to delete. The IDE cookie on doubleclick.net belongs to Google; only you can delete it in your browser. More: Google privacy policy.

Stellium account

A Stellium account lets you sign in to Stellium products such as Leitwert. We store:

• your username
• your email address, encrypted
• your password, as a hash only (we don’t know it ourselves)
• when you created the account and confirmed your address
• if you turn it on: the second factor (TOTP) and backup codes, the backup codes as hashes only
• which Stellium products you use and when you last used them

The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR). The data is kept until you delete your account. An account that is not confirmed within 24 hours is deleted automatically.

Sign-in and security

After you sign in we set the cookie __Host-stellium_konto. It is strictly necessary (Section 25(2) No. 2 TDDDG) and lasts until you close the browser, or 60 days with “Stay signed in”. For each sign-in we store the IP address and browser so you can see in your account where you are signed in. We delete these entries as soon as the sign-in ends: after 7 days without use, after 14 days at the latest, or after 60 days with “Stay signed in”.

To prevent abuse we also store security events (for example sign-in, wrong password, account changes) with the IP address for 90 days, and failed attempts per IP address for 24 hours (Art. 6(1)(f) GDPR).

Emails

We send confirmation codes, confirmation links and password reset links through Resend, Inc., USA. Resend receives your email address, your username and the code or link (Art. 6(1)(b) GDPR). More: Resend privacy policy. We do not send marketing emails.

Access and deletion

In your account you can download all your data as a file and delete the account. Deleting removes the account, sign-ins, learning progress and log entries immediately. Our nightly backups are kept on the same server and overwritten after 7 days; until then deleted data may still be contained in a backup.

Leitwert

Without an account Leitwert keeps your progress in your browser only. With an account we sync it with our server so it is the same on all your devices. We then store:

• your progress for each question (how well you know it and when it is due again)
• your answers with time, question, right or wrong, how sure you were and how long you took (deleted after 2 years)
• the questions you have bookmarked

The legal basis is the user agreement (Art. 6(1)(b) GDPR). Progress and bookmarks are kept until you delete them or your account.

Reporting errors

If you report an error in a question, we store your text, the question, the time and, if you are signed in, your username. We use it only to improve the question (Art. 6(1)(f) GDPR). Reports are deleted after one year; if you delete your account, we immediately remove your name from your reports.

Class game

In the class game you and the teacher see your nickname (or your username if you are signed in), your answers and points. The game exists only in our server’s memory and is deleted no later than 2 hours after the last action. To prevent abuse we briefly count failed attempts per IP address, also in memory only (Art. 6(1)(b) and (f) GDPR).

Emails to us

If you write to an address @stellium.club, Cloudflare (Email Routing) receives the email and forwards it to our mailbox on our own server. Some addresses are also forwarded to a mailbox at Google (Gmail, Google LLC, USA). We use your email and address to reply to you (Art. 6(1)(b) or (f) GDPR) and delete them when they are no longer needed for that and no retention obligation applies.

Downloads and Mac apps

Downloading an app creates an entry in the server log files like any other request. The apps themselves send no data to us. The one exception is Kerbe: if the app finds no cover for a song on your Mac, it asks Apple’s search (iTunes Search, Apple Inc., USA) using the artist and title.

Links to other sites

We link to sites such as YouTube, GitHub, Gumroad and BisectHosting. Only when you click such a link do you leave our site; the privacy policy of that provider then applies. The BisectHosting link is a partner link: if you buy there with our code, we receive a commission.

Chat and Weltenbrand

chat.stellium.club (for our team only) and weltenbrand.stellium.club have their own privacy notices, which you will find there.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Write to [email protected].

You can also lodge a complaint with a data protection supervisory authority, for example the one in the EU country where you live.

For an account we need a username, email address and password; everything else is optional. We make no automated decisions about you and do not create profiles.

Changes

We reserve the right to change this privacy policy and the legal notice at any time. When a new version is published, the previous one ceases to apply immediately; the current version published here always applies.

Your rights under the GDPR and any consent you have given are not affected. If we want to use your data for a new purpose, we will ask you first.