A Door for You

Privacy policy

This English version is provided for convenience. The German version is legally binding.

In short: we only store what your calendar needs. No ads, no third-party tracking or analytics services, no third-party content. Fonts and all files come from our own server. We count visits to our pages ourselves – anonymously and without cookies (section 10).

1. Controller

Patrick Schöller, Salzgasse 11, 74206 Bad Wimpfen, Germany, email: impressum@gq9.de

2. Account and sign-in

To sign in, you enter your email address. We send you a sign-in link that is valid for 24 hours. After signing in, we set a technically necessary cookie (“sid”) so that you stay signed in (for at most 30 days). The legal basis is the performance of the user agreement (Art. 6 (1) (b) GDPR); the cookie is permitted without consent under § 25 (2) no. 2 TDDDG. When you sign in you can optionally subscribe to the newsletter (section 6).

3. Content of your calendar

We store what you enter in your calendar: title, names, texts, riddles, photos, voice messages, dates, links and, if you add your heartbeat, pulse and heartbeat curve. Photos are already resized in your browser, which removes location and camera data. The legal basis is Art. 6 (1) (b) GDPR. If you upload photos or recordings of other people, you need their consent.

Trying it out without an account: If you design a calendar without signing in, your browser stores the draft in local storage (localStorage) on your device – not in a cookie. So that we can check the doors and show the preview, your browser sends the draft to our server with every change. The server processes it only for that one request and does not store it. Only when you sign in do we move the draft into your account; from then on, the above applies. You can only add photos and voice messages with an account. You delete the draft with “Discard draft” or by clearing the site data in your browser. The legal basis is Art. 6 (1) (b) GDPR; storing it on your device is strictly necessary for the service you requested (Section 25 (2) no. 2 TDDDG).

As the operator, we can view the content of your calendar where this is necessary to fix errors, handle your support requests or review a report. We do not look at calendars without a reason and do not pass the content on (Art. 6 (1) (b) and (f) GDPR).

4. What the recipient sees and what we store

Anyone with the secret link can open the published calendar. We store when each door was first opened and which riddle was solved, so that creators can see this and solved riddles stay solved. We do not collect personal data about the recipient in the process.

5. Daily reminder (optional)

The recipient can choose to receive an email reminder about the new door every morning. We only store the email address once it has been confirmed via a link (double opt-in). The legal basis is consent (Art. 6 (1) (a) GDPR). You can unsubscribe at any time via the link in every email; the address is then deleted immediately, at the latest together with the calendar. Unconfirmed addresses are deleted after three days.

6. Newsletter (optional)

When you sign in, and later under “My calendars”, you can subscribe to the newsletter. The box is never ticked in advance. We will then occasionally send ideas, news and offers about A Door for You to the email address of your account. If you subscribe while signing in, clicking the sign-in link in the email also confirms your address (double opt-in). As proof we store the time of the request and of the confirmation. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 7 (2) no. 3 UWG). You can withdraw it at any time with effect for the future: via the unsubscribe link in every newsletter email, under “My calendars” or by email to us. When you withdraw, we delete the proof; otherwise it is kept until your account is deleted. Emails are sent via the mail server named in section 9.

7. Reminders about your account and calendars

So that you don't miss your calendar, we send reminders to the email address of your account – each one only once: one about 24 hours after you register if you haven't created a calendar yet (not from 1 December onwards), and two for each calendar you have created but not yet unlocked, seven days and one day before the first door. Our server checks this automatically from your registration time, your calendars, their unlock status and start date. We only store that such an email was sent, so that it isn't sent twice. The legal basis is the performance of the user agreement and our legitimate interest in supporting you (Art. 6 (1) (b) and (f) GDPR). You can object at any time: each of these emails contains an unsubscribe link, and under “My calendars” you can switch the notices off. You will still receive emails with your sign-in link.

8. Reports

If someone reports content, we store the door concerned and the reason given in order to review the report (Art. 6 (1) (c) and (f) GDPR). Reports are deleted at the latest 90 days after the calendar has been deleted.

9. Server, email and security

The site runs on a server operated by IONOS SE in Germany. To deliver the site and to protect against misuse (rate limiting), the server briefly processes your IP address in memory. We send emails via the mail server of STRATO AG in Germany. We have data processing agreements with both providers. All connections are encrypted (HTTPS).

To protect against data loss, we create an encrypted backup every night. Backups are kept at STRATO in Germany for up to twelve months and are then deleted automatically.

10. Statistics and audience measurement

We count anonymously how often per day, for example, calendars are created or doors are opened. We do not store IP addresses or identifiers.

We also measure how our pages are used with our own counter – without external services, without cookies and without storing anything on your device. When a page loads, your browser tells our server which page was opened (without identifiers in the link, so for example without a secret calendar link), which website you came from (the domain only, such as google.com, not the full address) and, if present in the link, a campaign label (such as “?ref=etsy”). When you leave the page, it reports how long the page was visible. From the browser identifier the server derives only a rough device group (phone, tablet or computer) and uses it to filter out search engine robots. It processes the IP address and the browser identifier only briefly in memory for this and does not store them. We store only daily counters from which no individual person can be identified. We do not count visits with “Do Not Track” or “Global Privacy Control” switched on; we delete the daily counters after 400 days. The legal basis is our legitimate interest in improving the service (Art. 6 (1) (f) GDPR). You can object by switching on “Do Not Track” or “Global Privacy Control” in your browser or by writing to us.

11. Payment (Stripe) and unlock codes (Etsy)

Paying directly: If you pay for the unlock directly with us, we redirect you to the payment page of our payment provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). For this we send Stripe the amount, your email address and an internal ID of your calendar. You enter your payment details (e.g. card number) only at Stripe; we never see them. Stripe also processes the data for fraud prevention and its own legal obligations; data may be transferred to the USA (Stripe is certified under the EU-US Data Privacy Framework; standard contractual clauses also apply). See Stripe's privacy policy: https://stripe.com/privacy. On our side we store with the calendar when and with which payment (Stripe ID, amount, email address) it was unlocked and when you agreed to the notice about your right of withdrawal.

Unlock codes via Etsy: We also sell unlock codes via Etsy. For the purchase, Etsy and we process the order data according to Etsy's rules (see Etsy's privacy policy). To send you the code, we note the order number or the name from the order next to the code. When a code is redeemed, we store which code unlocked which calendar and when you agreed to the notice about your right of withdrawal. The legal basis is Art. 6 (1) (b) and (c) GDPR; we keep this information for as long as tax retention obligations apply.

12. Gift idea PulsePoster

A gift idea from PulsePoster may be behind one door. The pulseposter.com website only opens when you click the link. We do not transmit any data from your calendar; we only count anonymously that the link was clicked.

13. Retention periods

14. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent. Just send us an email. You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.