Privacy policy

For the website whatshouldido.de · Last updated: [PRÜFEN: publication date] · The German version is the legally binding one.

1. Controller

No data protection officer has been appointed; the statutory thresholds (§ 38 BDSG) are not met.

2. Hosting and server log files

This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA, acting as a processor under a data processing agreement pursuant to Art. 28 GDPR.

When you visit the site, technically necessary access data is processed in server log files: truncated or full IP address, date and time of access, name and URL of the requested file, volume of data transferred, HTTP status code, browser type and version, operating system, and the referring page where applicable.

Purpose: delivering the site, ensuring stability and security, defending against attacks and abuse.
Legal basis: Art. 6 (1)(f) GDPR — legitimate interest in the secure and error-free operation of the website.
Retention: Netlify normally retains access data for 30 days and deletes it automatically thereafter. This data is not combined with other sources.

Transfer to a third country: Netlify is based in the USA, so a transfer to a third country takes place. Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework; in addition, the European Commission's Standard Contractual Clauses apply (Art. 46 (2)(c) GDPR). See netlify.com/privacy.

3. Forms (Netlify Forms)

There are two forms on this website. Both run through Netlify Forms (provider as under section 2). There is no separate database and no newsletter tool.

3.1 iPhone waiting list

[PRÜFEN: new section, replaces the former tester and early-access lists.]

Data processed: your email address.
Purpose: notifying you once by email when What Should I Do? launches on iPhone.
Legal basis: Art. 6 (1)(a) GDPR — your consent, given by actively submitting the form.
Retention: until the notification is sent or you withdraw consent, at most [PRÜFEN: 24] months.

3.2 „Want to build this with me?" form

Data processed: name, area of interest, your free-text message and your email address.
Purpose: handling your enquiry and getting in touch about possible collaboration.
Legal basis: Art. 6 (1)(a) GDPR (consent) and Art. 6 (1)(b) GDPR where the enquiry aims at entering into a collaboration.
Retention: until your enquiry has been dealt with, at most 12 months, unless statutory retention obligations apply.

3.3 Spam protection

All forms contain a field that is invisible to you („honeypot") and is only filled in by automated bots. No additional personal data is collected and no profiling takes place. Netlify also screens submissions for typical spam characteristics. Legal basis: Art. 6 (1)(f) GDPR.

3.4 Receiving submissions

Submissions are stored in the Netlify dashboard and forwarded by email to wsd.app.support@gmail.com. That mailbox is operated by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (Gmail). See policies.google.com/privacy.

4. Cookies, tracking and fonts

• No cookies and no comparable storage techniques (no localStorage, no sessionStorage). That is also why there is no cookie banner — no consent under § 25 TDDDG is required.
• No analytics or tracking tool — no Google Analytics, no Plausible, no pixels, no fingerprinting, no conversion trackers.
• Self-hosted font. „Figtree" is served from our own server; there is no connection to Google Fonts or a CDN.
• No social media plugins, no embedded videos, no advertising.
• No JavaScript. The site works entirely without JavaScript and loads none.

If that changes — for example because an analytics tool or a newsletter service is added — we will update this policy before putting it to use.

5. External links, especially Google Play

This website links to the Google Play Store (Google Ireland Ltd., address as under section 3.4) and to the app's privacy policy. When you follow an external link you leave our site; the respective provider is responsible for the data processing there. No data is sent to Google before you click; the badge image is served from our own server.

[PRÜFEN: new paragraph.] The Play Store links contain campaign parameters (utm_source, utm_medium, utm_campaign) that only say which part of this website you came from. They contain no personal data. Google receives them when the Play Store opens and provides us with aggregated statistics in the Google Play Console.

6. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21).

You may withdraw consent at any time with effect for the future — an email to wsd.app.support@gmail.com is enough, no reason needed. The lawfulness of processing carried out until then remains unaffected.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Thuringian Commissioner for Data Protection and Freedom of Information, Haesslerstrasse 8, 99096 Erfurt, Germany. You may also contact the authority where you live.

7. Changes to this policy

We update this policy when the website, the services used or the legal situation change. The current version is always available at whatshouldido.de/en/privacy/.

Last updated: [PRÜFEN: publication date]