Privacy

1. Controller

The controller for the processing described here is:

chinin-rebe9c@icloud.com

Please direct data protection matters to this address. We have not appointed a data protection officer under Art. 37 GDPR, and in our assessment a representative in the EEA under Art. 27 GDPR is not required.

2. What we process

We do not collect data from third parties and do not buy data. We process only what arises when you visit this website:

• Server logs: IP address, timestamp, page requested, browser and device identification. These arise necessarily for a connection to be made at all.
• Items that stay in your browser: language choice, appearance, your decision about measurement, your own likes.
• If you give a heart: a random identifier and a value derived from your IP address that cannot be turned back into it.
• If you consent: pseudonymous usage data via Google Analytics.

3. Purposes and legal bases

We process this data to provide and operate the website, to order the selection of excuses by the hearts given, and to detect and prevent abuse. Where the GDPR applies, the legal basis is Art. 6(1)(f) GDPR: our legitimate interest in secure and functioning operation.

Measurement with Google Analytics is based solely on your consent, Art. 6(1)(a) GDPR. You may withdraw it at any time; withdrawal does not affect processing already carried out.

No other legal basis applies: there is no contract with you, no statutory retention duty and no processing of vital interests.

We do no direct marketing, no advertising and no market or opinion research.

4. Browser storage, cookies and measurement

A cookie is a small file your browser stores, letting us recognise your browser even though we do not know who you are. You can configure your browser to reject or delete cookies. If you block them, individual parts stop working, such as the language choice or the heart.

Without your consent, only the following is stored:

If you give a heart, we additionally store on our server the identifier, the item concerned, the time and a value derived from your IP address. That value cannot be turned back into the IP address and exists solely to detect mass manipulation. We do not store the IP address itself.

If you consent to measurement, we use Google Analytics 4. The provider is Google Ireland Limited, based in Ireland, which relies on Google LLC, based in the USA, as a processor (together Google). Cookies are set (_ga and _ga_…, lasting two years) and it is recorded pseudonymously which pages are opened and which contexts, scenarios and tones are used. Technical details are added automatically: device type, browser, operating system, screen size, language setting, an approximate location derived from the IP address, and where the visit came from. We do not transmit names, e-mail addresses or similar - we do not have any.

We have configured the service with data sharing and Google Signals switched off. Although we assume that what we share with Google is not personal data for Google, Google may draw conclusions about the identity of visitors for its own purposes, build profiles and link them to Google accounts. If you are signed in to Google, Google knows you anyway. That processing is Google's responsibility under its own privacy terms. Google tells us only how the website is used.

Independently of this website you can switch off Google Analytics for your whole device. Google provides a browser add-on for this: tools.google.com/dlpage/gaoptout

Google’s script is loaded only once you have consented. If you decline or decide nothing, it is never requested and not a single request goes to Google.

We use no social media plug-ins and send no newsletters.

5. Disclosure and transfer abroad

We disclose data only to service providers processing it on our behalf:

• Google (Firebase App Hosting, Cloud Run, Firestore) to operate the website and store the hearts. The servers are in region europe-west4 in the Netherlands.
• Google (Analytics and App Check), if you consented to measurement or as soon as you give a heart.

Data may be transferred to the USA in the process. Where a recipient is in a country without adequate statutory data protection, we bind it contractually to comply with applicable data protection, using the European Commission's standard contractual clauses, unless it is already subject to a recognised framework.

There is no disclosure for third parties' own purposes, no sale of data and no sharing with advertising networks.

6. Retention

We keep personal data only as long as necessary for the respective purpose.

7. Data security

We take appropriate technical and organisational measures. These include transmission exclusively encrypted over HTTPS, database access restricted to the server with limited permissions, pseudonymisation of IP addresses, and further measures that detect and repel abusive and automated access. We deliberately do not set out their details, because part of their effect depends on their not being public.

8. Obligation to provide data

You do not have to provide us with any data. The website cannot be used, however, without disclosing the items technically necessary for transmission, such as the IP address. Everything else - measurement and hearts - is voluntary.

9. No profiling, no automated decision-making

We build no profiles of individuals and use no automated decision-making within the meaning of Art. 22 GDPR. The order of excuses follows the total number of hearts given, not information about you.

10. Your rights

Within the data protection law applicable to you, you have the right to access, rectification, erasure, restriction of processing, objection, and to receive certain data for transfer to another body. Please use the address under section 1.

Access is generally free of charge. We reserve the right to invoke the restrictions provided by law. Exercising these rights generally requires you to prove your identity.

Note that we cannot attribute hearts to a person: we store only a random identifier and a derived value that cannot be reversed. Access or erasure is therefore possible only if you tell us the identifier from the lk cookie.

You also have the right to enforce your claims in court or to lodge a complaint with the competent data protection authority. In Switzerland this is the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

11. Changes

We may adapt this privacy policy at any time without notice. The version published here at the time applies.

Liability

The contents of this website are an entertainment offering. We aim for correct information but cannot rule out errors and give no warranty of completeness, accuracy or currency. Liability for damages arising from use is excluded unless demonstrably caused by intent or gross negligence.

The operators of linked third-party websites are solely responsible for their content and availability.

Advertising to our contact address

We object to the use of the contact details published here for sending advertising that was not expressly requested.