Privacy policy (Datenschutz)

Controller

Simon Krätschmer, Spessartstraße 20, 14197 Berlin, Germany, derbimon@gmail.com (address also in the Impressum).

No account, no sign-up

You can use CHARITITS without registering. We ask for neither your name nor your email address as long as you don't buy or contribute anything.

No tracking, no advertising

No analytics or advertising tools are integrated — no Google Analytics, no pixels, no profiling, no sharing for advertising purposes.

What is stored for technical reasons

• A cookie called st_device: a random, signed identifier. Its only purpose is to assign your credit to the right device and to make misuse harder. It contains no personal data. Legal basis: § 25 (2) no. 2 TDDDG (technically necessary) and Art. 6 (1) (b) GDPR.
• A cookie called charitits_sprache: only set when you use the EN/DE switch, and contains nothing but "en" or "de", so the page stays in your language. Kept for one year. Legal basis: § 25 (2) no. 2 TDDDG (a function you asked for).
• Local browser storage: your settings (age confirmation, censorship on/off, controls). This information stays on your device.
• Server logs of our host (Vercel Inc.): IP address, time, requested address — to fend off attacks and to run the service, usually kept for a few days. Legal basis: Art. 6 (1) (f) GDPR.
• Quota and purchases in our database (Supabase): device identifier, number of views, time of purchase, chosen donation cause, amount. Retained for up to ten years under commercial and tax law.

Payments

When you buy, you are redirected to our payment service provider. Your payment data never reaches us — we only see whether a payment was confirmed and store a transaction number. The provider is an independent controller for the data collected there.

Bug reports

If you report a bug via the 🐛 button, we store your text, the address you were on and the time. Please don't put personal data in there.

Contributed models

If you upload your own 3D model, we store the file and the information you voluntarily provide (contact, consent, chosen donation cause). You can withdraw both at any time without giving a reason — an email is enough, see Complaints & content removal.

Recipients

• Vercel Inc. (hosting)
• Supabase (database and file storage)
• The payment service provider, once you buy

Data processing agreements (Art. 28 GDPR) are in place with these service providers. Where data reaches third countries, this happens on the basis of the European Commission's standard contractual clauses.

Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). An informal email to derbimon@gmail.com is enough. You can also complain to a data protection supervisory authority; for Berlin this is the Berlin Commissioner for Data Protection and Freedom of Information.

Deleting what is on your device

Cookie and local storage can be deleted at any time in your browser settings. After that, the free offer starts over; any purchased credit is, however, no longer assigned to this device — in that case, write to us.