Privacy policy

1. Who is responsible

The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is:

Name: PLACEHOLDER — legal name of the operator (person or company)
Address: PLACEHOLDER — postal address
Email: PLACEHOLDER — contact email

The controller is established in the United States. Because this website is also offered to people in the European Union, the GDPR applies to it under Art. 3(2) GDPR.

Representative in the EU (Art. 27 GDPR): PLACEHOLDER — name and address of the EU representative, or removal of this line if a lawyer confirms the Art. 27(2) exemption applies

We have not appointed a data protection officer, because none of the conditions of Art. 37 GDPR applies. For every question about your data, and for exercising your rights, write to the email address above.

2. Overview

This policy covers this website and its subdomains. It does not cover other websites we link to, or Discord, which has its own policy (section 9).

What happens	Data	Legal basis	Kept for
Delivering the website (server logs)	IP address, date and time, requested address, referring page, browser and operating system, status code, transferred data volume	Art. 6(1)(f) GDPR	A short period set by Cloudflare
You email us	Email address, name if you give one, content of your message	Art. 6(1)(f) GDPR; Art. 6(1)(b) GDPR where your message concerns a contract	Until your request is dealt with, then deleted unless the law requires us to keep it
Visit statistics (section 5)	Date and time, page address, referring domain, device class, browser and operating system, browser language, visible time and scroll depth, loading times, links followed to other websites and the button clicked, whether a page did not exist, a visitor code valid for one day; your IP address is used only in memory and is not stored	Art. 6(1)(f) GDPR	400 days

You are not required to provide any personal data. The only data processed without you actively sending it is what your browser transmits technically to load a page (section 3), and visit statistics (section 5), which you can prevent.

3. Hosting and server logs

This website consists of pre-built static files. There is no user account and no login. The files are delivered through the content delivery network of:

Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA

Cloudflare processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. To deliver the website and protect it against attacks, Cloudflare processes your IP address, the requested address, date and time, the referring page, and your browser's user agent. This happens on servers close to you and may also happen in the United States and other countries outside the EU. Cloudflare is certified under the EU–US Data Privacy Framework, so transfers to the United States are based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). The standard contractual clauses in Cloudflare's data processing agreement (Art. 46(2)(c) GDPR) apply in addition.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is delivering the website quickly, reliably and securely. We do not use Cloudflare's analytics, cookies or bot-detection features on this website. Cloudflare deletes request logs after a short period that it sets itself and that we cannot configure. We cannot see logs of individual requests.

4. Contacting us by email

If you email us, we process your email address, any name you give and the content of your message in order to deal with your request. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in answering messages sent to us), or Art. 6(1)(b) GDPR where your message relates to a contract or to steps before one. We delete the correspondence once your request has been dealt with and no statutory retention obligation applies. Our email is hosted by PLACEHOLDER — email provider, its address and where it processes data, which processes the messages on our behalf.

5. Visit statistics

To understand which pages are read, how quickly they load and which links are used, we measure page views ourselves. A small script from our own website (/besuch.js) reports each page view to our own analytics server, the Content Hub, at hub.aiofmcity.com. The server is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in Nuremberg, which processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. No analytics company receives the data. It is not shared with anyone, not used for advertising, and not used to build profiles.

For each page view, the server stores:

the date and time;
the address of the page. Of anything after the question mark, only the campaign parameters utm_source, utm_medium and utm_campaign are kept; the rest is discarded;
the domain of the website you came from, not its full address;
device class, browser and operating system, which the server derives from the user-agent header your browser sends with every request;
your browser language, which the server takes from the Accept-Language header your browser sends with every request;
how long the page was visible and how far down it was scrolled;
loading-performance timings: Largest Contentful Paint, Interaction to Next Paint, Cumulative Layout Shift, Time to First Byte and First Contentful Paint;
when you click a link to another website: the link's target (domain and path) and which button or placement it was, taken from the link's data-platz attribute or its utm_source parameter. On our Discord forwarding page that is the page and button the click came from (section 9);
whether the page you asked for did not exist (a 404 error).

To count how many people visit per day, the server also stores a visitor code: a one-way hash of your IP address, your browser's user agent and a random value that is replaced every day. The random value is deleted shortly after the day ends (at 00:05 UTC at the latest) and is not included in our database backups. Backups made before 6 October 2026 may still contain older values until they are deleted, at the latest after 90 days. While a value exists, someone who already knows a specific IP address and user agent could recompute that day's code. Afterwards this is no longer possible, and the code cannot link visits across days. We never do this, and the code is not used to identify anyone. Your IP address itself is processed only in the server's memory, to form this code and to protect the service against abuse. It is not written to the database or to any log.

Visits from known bots are discarded.

The statistics set no cookies and store nothing on your device. To send its report, the script does read some information in your browser that relates to the page itself: the page address and three campaign parameters (utm_source,utm_medium, utm_campaign; never the rest of the address and never a search term), the domain of the page that linked here, whether the page is visible, the window and page height (only to calculate the scroll percentage, which is all that is sent), the browser's own loading and responsiveness timings for the page, whether the browser is run by automation software (to skip bots), and whether your browser sends a Global Privacy Control or Do Not Track signal. It does not read your screen size, language, installed fonts or other device characteristics, and it does not use fingerprinting.

Under § 25 of the German TDDDG and Art. 5(3) of the ePrivacy Directive, reading information in your browser can require consent. We have designed the statistics to read as little as possible and to send nothing when you object through your browser settings. If your browser sends a Global Privacy Control or Do Not Track signal, the script sends nothing at all.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is knowing, in aggregate, which content is useful, how well the pages load and which links people follow, so that we can improve the website. Page views are kept for 400 days and then deleted.

How to prevent it: turn on Global Privacy Control or Do Not Track in your browser, and the script records nothing. Blocking /besuch.js on aiofmcity.com with a content blocker has the same effect. You can also object at any time by email under Art. 21 GDPR (section 12).

6. Nothing is stored in your browser

This website does not set cookies and does not use local storage, session storage or any comparable technology to store information on your device or to read information stored there. It does not use browser fingerprinting. The visit statistics (section 5) store nothing on your device either.

There is one exception, and it is off unless you switch it on. On the page Your first 7 days you can tick off days and choose “Remember my ticks on this device”. Only then does the page save which days you ticked in your browser’s local storage, under the name aiofmcity-7-days. The entry contains nothing but the numbers of the ticked days. It never leaves your device and is not sent to us or anyone else. Switching the option off deletes it, and you can also delete it with your browser’s site data. Storing it is strictly necessary to provide the function you asked for (§ 25(2) no. 2 TDDDG), so no consent banner is involved.

The site search runs entirely in your browser: it loads parts of a search index from our server as ordinary files. What you type is not sent to us as text, although, like any file request, the loading of index files appears in the server logs described in section 3.

If you open a link that contains a search term or the inputs of one of our calculators, for example one someone shared with you, those values are part of the address. The visit statistics do not transmit them (they keep only campaign parameters), but the address does appear in the hosting provider’s server logs like any other page request.

7. No third-party content

All fonts, images and scripts are served from our own servers. The website does not embed videos, maps, social media buttons or widgets, advertising, or any content from third-party servers, so your browser does not connect to any third party when you read it. In particular, fonts are not loaded from Google. The visit statistics go to our own analytics server (section 5), not to a third party.

The member numbers of our Discord server shown on some pages are retrieved by our own build process from Discord when the website is built, not by your browser when you visit.

8. Links to other websites, including affiliate links

Our pages link to other websites. We do not pass any information about you to them. When you follow a link, the other website receives the usual technical data from your browser and is solely responsible for what it does with it under its own privacy policy. Our visit statistics record which link was followed (section 5); that record stays with us.

Some links are affiliate links, marked as such (see our affiliate disclosure). They contain a referral code identifying us, not you, so that the provider can credit us with a commission if you sign up. The provider may set its own cookies on its own website for that purpose; this happens outside our website and under that provider's responsibility.

9. Our Discord server

Links to our Discord server go through a forwarding page on this website, which sends you on to an invitation. The invitation address can carry parameters naming the page and button you came from; they describe our pages, not you. Our visit statistics record the forwarding as a click on the invitation link, together with that page and button (section 5). From the moment you open Discord, Discord Inc. processes your data as an independent controller under its own privacy policy at discord.com/privacy.

If you join the server, we as its operators can see your username, profile and the messages you post there, and we use them to run and moderate the community. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is operating a safe community that complies with the law and with our server rules. Messages you post stay on Discord and are managed by Discord; we do not copy them to this website.

10. Recipients

Personal data is disclosed only to the service providers named in this policy, who process it on our behalf and under our instructions, and to public authorities where we are legally required to do so. We do not sell personal data, we do not share it for advertising, and we do not use it for automated decision-making or profiling within the meaning of Art. 22 GDPR.

11. Transfers outside the EU

The website is delivered through Cloudflare, which may process data in the United States (section 3). Because the controller is established in the United States, personal data, in particular emails you send us and log data and visit statistics where we need to access them, is transferred to the United States. The United States does not have a general adequacy decision. Where a recipient is certified under the EU–US Data Privacy Framework, the transfer is based on the adequacy decision of 10 July 2023 (Art. 45 GDPR); otherwise it is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards at the email address in section 1.

12. Your rights

Under the GDPR you have the right to:

obtain confirmation of whether we process your data, and access to it (Art. 15);
have inaccurate data corrected (Art. 16);
have your data erased (Art. 17);
have processing restricted (Art. 18);
receive data you provided in a portable format (Art. 20);
lodge a complaint with a supervisory authority (Art. 77).

Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

No processing on this website is based on consent, so there is no consent to withdraw. Send requests to the email address in section 1. We may need information to confirm that a request concerns you; because the website stores nothing that identifies individual visitors, we often cannot link data to a person at all (Art. 11 GDPR), and will tell you if that is the case.

You can complain to any data protection supervisory authority in the EU, in particular in the member state where you live or work or where the alleged infringement took place.

13. Information for United States residents

In the preceding twelve months this website has collected the following categories of personal information, for the purposes described above: identifiers (IP address, and email address if you write to us), internet activity information (pages viewed, referring website, links followed to other websites, browser and device type). We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the preceding twelve months. We do not collect sensitive personal information.

Depending on the state you live in, you may have the right to know, access, correct and delete personal information we hold about you, and not to be discriminated against for exercising these rights. Send requests to the email address in section 1; we will verify and answer them within the period your state's law requires.

Do Not Track. Our visit statistics do not track visitors across websites or across days. If your browser sends a Global Privacy Control or Do Not Track signal, the statistics script sends nothing at all. No other tracking takes place on this website.

14. Children

This website covers running a business and is intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 16, or under 13 in the United States. If you believe a child has sent us personal data, contact us and we will delete it.

15. Security

The website is delivered exclusively over an encrypted connection (HTTPS). Access to server logs, the analytics server and our email is limited to the operator and to people working for us who are bound to confidentiality, and is protected by individual credentials.

16. Changes

We update this policy when the website or the law changes. The date at the top shows when it was last updated. If a change requires your consent, we will ask for it before the change takes effect.