Privacy policy

Controller

Christian Götze, Rathenaustr. 3, 16761 Hennigsdorf, Deutschland

Email: kontakt@urlaubsbruecken.de

Overview

Types of data: access data in the server log files (full IP address, time, requested address, browser and device details), truncated IP addresses, page views and clicks on outbound links in the reach measurement, and — if you use the contact form or write to the mailbox — your name, your email address and the text of your message.

Purposes: running the site, defending against attacks and abuse, reach measurement (cookieless Matomo), answering enquiries from the contact form and by email, and protecting the form against automated abuse.

Recipients: the delivery provider rapidmail GmbH for sending the form message and Proton AG as the operator of the mailbox — more under “Contact form and email”.

Legal bases: Art. 6(1)(f) GDPR (legitimate interest in secure operation, in abuse defence and in privacy-friendly statistics) and Art. 6(1)(b) or (f) GDPR for answering your enquiry.

Your plan is explicitly not part of this: state, year, working week, leave allowance and the days you place stay in your browser and are not sent to the server — see "Data that stays on your device". The one exception is described under "Shared links".

No cookies, no banner

This site sets no cookies — neither for sessions nor for advertising or tracking. A consent banner is therefore not required.

What is stored in the browser (see the next section) serves only the function you explicitly asked for — remembering your plan and your theme — and is strictly necessary for it. It is therefore exempt from consent under § 25 (2) no. 2 TDDDG.

Data that stays on your device

Your input in the planner is stored solely in your browser (localStorage). It is never transmitted to the server and the operator cannot see it. Up to three entries are written:

• urlaubsbruecken:plan — your federal state, the planning year, the number of vacation days you have, the days placed in the calendar, the weekdays you work, whether you work on public holidays, the weekdays that matter most to you, the chosen suggestion type, a pinned month, whether Christmas should stay free, whether the planner should put your leave only in the school holidays, your leave allowance for the following year, how many leftover days you want to carry over, the deadline by which you have to take them, and a random identifier that lets a calendar recognise the events of your .ics file when you import it again
• urlaubsbruecken-theme — your choice between the light and the dark theme
• urlaubsbruecken:plan-backup — your previous plan if a shared link replaced it, so you can restore it; overwritten by the next link or removed when you restore it

The contact form is explicitly excluded: what you type there you deliberately send to the server, so that it can be read and answered. The section “Contact form and email” describes what happens then.

What that says about you

The first entry and the backup of your previous plan describe your working week and your leave entitlement. That is information about you, and it therefore stays with you: it never reaches the server, not even when you export a calendar file, copy the list of dates or print the plan — your browser does all of that itself.

If “Put my leave in the school holidays” is switched on, that suggests school-age children live in your household. This setting, too, stays in your browser; it only appears in a link if you share one yourself.

You can delete these entries through your browser settings at any time. On a shared device, anyone using the same browser can see your stored plan.

Shared links

When you tap "copy link", your plan sits in the parameters of the address — state, year, number of vacation days, the days placed and the remaining settings, such as whether your leave should go into the school holidays. As long as the link stays with you, nothing changes.

Once it is opened, the full address is part of that request and is recorded in the server access log like any other request (see "Hosting and server log files"; deleted after 31 days at the latest). The parameters do not appear in the reach measurement: only the path without parameters is counted there.

Hosting and server log files

The site runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A processing agreement under Art. 28 GDPR is in place with Hetzner. Server location: Germany.

Every request passes through a front-end web server (Traefik) that writes an access log on the same machine. It contains: the full IP address of your connection — it is neither truncated nor anonymised at this point — date and time, the requested address including its parameters, the HTTP method, the status code, the amount of data transferred, the processing time, and the headers your browser sends, in particular the user agent and the referring page. Credentials and cookie headers are explicitly not written.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is secure, reliable operation and troubleshooting. The log stays on the same server in Germany and is not passed to any external service provider; the only exception is the reporting of attacker addresses described in the next section.

Storage period: the log is rotated daily and at most 30 older generations are kept, so an entry is deleted after 31 days at the latest. Further application log output is deleted after 30 days. If a specific security incident is being investigated, the entries concerned may be kept until it is resolved.

Defence against attacks and abuse

The same access log is evaluated automatically by the open-source security software CrowdSec on the same server. It recognises patterns such as mass login attempts or probing for known vulnerabilities, and it decides on the basis of the IP address: a conspicuous address is blocked for 96 hours, a conspicuous address range for 24 hours. This IP-based evaluation is a purpose of its own alongside providing the site.

IP addresses that attacks originate from are additionally reported to CrowdSec SAS (France) and feed a shared block list there. Only addresses that stood out as attackers are reported; ordinary use of this site is not reported.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security). A block expires by itself; if you consider one unjustified, write to the address above.

Reach measurement with Matomo

Reach is measured with the self-hosted open-source software Matomo on our own infrastructure (matomo.cgoetze.de). The data stays on a server in Germany and is not passed to third parties, not even to the makers of Matomo.

No cookies are set, the active detection of device and browser features is switched off, and your IP address is truncated by its last two bytes before it is stored. Recorded are page views, the approximate location derived from the already truncated address, browser and device type, the referring website — its domain only, not the path — and clicks on outbound links and downloads, each with the address the clicked link points to. There is no cross-site tracking, no user profiles are built and no user ID is assigned.

If your browser sends a "Do Not Track" signal, the measurement is not even loaded. It is likewise switched off in local development and on non-production hosts.

Not every browser offers that signal: Safari removed the setting in 2019, and on iOS that applies to every browser. There you can switch the measurement off by blocking the address matomo.cgoetze.de, for example with a content or ad blocker — the site keeps working unchanged. Independently of that, you may object to the analytics at any time under Art. 21 GDPR, informally, to the address given in the imprint.

Storage period: individual visit data is deleted after 90 days. The reports derived from it are condensed after twelve months; only aggregated monthly and yearly figures without any personal reference are kept.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly usage statistics). § 25 (1) TDDDG does not apply because nothing is stored on or read from your device.

Technical usage counters

So that the operator can see whether the site works and which functions are used, the browser reports individual events back to the same server. All that is transmitted is one fixed keyword from a list built into the program — the report contains nothing else. Reported are:

• that the planner was opened
• that a federal state was chosen — not which one
• that a suggestion was applied, together with its type (one long holiday, several longer holidays, around the public holidays, keep your favourite working days)
• that a calendar file was downloaded, the list of dates copied, the link copied or the plan printed

What the counters do not contain

Not transmitted are: your plan, your vacation days, your state, your year, your leave allowance, any identifier or anything else that would make you recognisable. On the server one number per keyword is incremented; these counters contain no personal data and therefore need no deletion period. If your browser sends "Do Not Track", nothing is reported at all.

The report itself is an ordinary request to this server and therefore appears in the access log like any other (see "Hosting and server log files"). Legal basis: Art. 6(1)(f) GDPR.

Contact form and email

The contact form transmits three things to the server: your name, your email address and the text of your message. Added to that are the tick box acknowledging this policy, and the solution to the spam task. Your plan is not among them — the state, the year and the days you placed are not sent along. If you would like to show it, use “Copy link” in the planner and paste the link into your message yourself.

From those details the server builds an email and sends it to kontakt@urlaubsbruecken.de. The sender is no-reply@urlaubsbruecken.de; your address appears only as the reply-to address, so that you can be answered directly. The message itself is not stored: there is no database and no file it would be written to.

Delivery is handled by rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg im Breisgau, as a processor. The mailbox is operated by Proton AG in Geneva, Switzerland; for Switzerland an adequacy decision of the EU Commission pursuant to Art. 45 GDPR is in place.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering enquiries), or Art. 6(1)(b) GDPR for contract-related enquiries. The tick box in the form is an acknowledgement, not a consent under Art. 6(1)(a) GDPR — so there is nothing to withdraw. Deletion no later than six months after the matter is closed, unless statutory retention duties apply. No newsletter is sent.

You do not have to use the form: an email straight to kontakt@urlaubsbruecken.de reaches the same mailbox and does not pass through the delivery provider. In both cases the server keeps numbers only — how often a message was accepted or rejected, with no content and no link to you.

Spam protection for the form (ALTCHA)

The form is protected against automated abuse with ALTCHA. Your browser solves a small computational task — invisible to you, with nothing to click and nothing to decipher. The task is only set when you submit, not when the page opens.

The task comes from this website itself, not from a third party: no external service is embedded and nothing is transmitted to anyone. No cookie is set and nothing is written to your browser storage, so § 25(1) TDDDG does not apply.

Fetching the task is an ordinary request and appears in the access log like any other (see “Server log files”). A solved task is remembered by the server for five minutes so that the same solution cannot be used twice; only the solution itself is kept.

Storage periods at a glance

In summary, the following periods apply:

• server access log: 31 days at the latest
• further application log output: 30 days
• blocks issued by the attack detection: 96 hours per address, 24 hours per address range
• Matomo, individual visit data: 90 days; the reports derived from it are condensed to aggregated monthly and yearly figures after twelve months
• technical usage counters: no period, as they are plain numbers without personal reference
• messages from the contact form and email: no later than six months after the matter is closed
• solved spam tasks: five minutes
• data in your browser: until you delete it — it is held by you alone

Backups: every night a backup is taken that contains the analytics data and the database of the attack detection (with the IP addresses of detected attackers). It is held on a separate storage volume in the same data centre in Germany, kept for 14 days and then deleted automatically; it is restored only in the event of a fault. A record already deleted may therefore still sit in a backup for up to 14 days. The server access log and the application log output are not backed up.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR).

Because your plan is stored locally only, the operator holds no data about it that could be the subject of an access request; you can view, change and delete it yourself at any time in the planner and through your browser settings.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent one here is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

Changes to this policy

This policy is updated whenever the processing described here changes. The date given above states when it was last changed.