Privacy Policy
Last updated: October 1st 2026
1. Controller
Kira Wagner
E-Mail: kirah@endiversum.com
Controller within the meaning of the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).
2. What data we process and why
This is a private, non-commercial website run by an individual. It can only be used with an account, and accounts can only be created with an invite code issued by the operator.
a) Account data
Username, password (stored only as a cryptographic hash), account creation date, your role (e.g. "New user", "Trusted"), your karma score, and, if you choose to use one, a Gravatar identifier (see section 3). The Gravatar identifier is a hash derived from your email address. We do not store the email address itself, which means we cannot reset your password by email.
Purpose: Account management and the permission/reputation system. Legal basis: Art. 6(1)(b) GDPR; for the optional Gravatar identifier, Art. 6(1)(a) GDPR (your consent, which you can withdraw at any time by removing it).
b) Invite codes
Invite codes are created only by the operator. We store which code you registered with and when it was used, so a code can be traced to the account that used it.
Purpose: Access control and abuse prevention. Legal basis: Art. 6(1)(b) and (f) GDPR.
c) Contributions
When you add or edit entries, we store your suggested changes (old and new values), their timestamps, their status (pending, approved or rejected) and that you are the creator. Other logged-in users can see who made a contribution.
Purpose: Operating the community database. Legal basis: Art. 6(1)(b) GDPR.
d) Reviews, votes and reports
We store which contributions you supported or disapproved and your up- and downvotes on comments. This information is visible to other logged-in users.
Purpose: Quality control and moderation. Legal basis: Art. 6(1)(b) and (f) GDPR.
e) Comments
Your comment text, timestamp and replies. Comments are visible to all logged-in users. Please don't post personal data about other people.
Purpose: Providing the comment function. Legal basis: Art. 6(1)(b) GDPR.
f) Session cookie
One random session token, which is not derived from your user ID, to keep you logged in. It is technically necessary, so no consent is required. We do not use tracking or analytics cookies.
g) Server logs
When you visit the site, our server automatically processes technical data (including IP address, date and time, requested page and browser type). This serves the security and stability of the service and the prevention of abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Logs are deleted after 14 days.
3. Recipients and processors
We share data only with the following service providers:
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hosting). Server location: Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner.
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (DNS). Transfers to the USA are based on the EU-US Data Privacy Framework and/or Standard Contractual Clauses (Art. 46 GDPR).
Gravatar (Automattic Inc.), 60 29th Street #343, San Francisco, CA 94110, USA. Profile pictures are loaded directly from Gravatar's servers. When you view a page that shows a profile picture, your browser connects to Gravatar, which therefore receives your IP address and the picture identifier. This happens for every viewer of the page, whether or not you have your own Gravatar. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing profile pictures); for users who choose to set one, additionally Art. 6(1)(a) GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
We do not share your data with any other third parties.
4. Retention
Account data, contributions, comments and votes are kept until you delete your account or ask us to. On deletion, your account data is erased. Contributions, comments and votes are kept but detached from your account.
5. Provision of data
Providing a username and password is required for registration. Without them, we cannot provide you with an account.
6. Your rights
Under the GDPR you have the following rights:
- Access (Art. 15)
- Rectification (Art. 16)
- Erasure (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Objection to processing based on legitimate interests (Art. 21)
To exercise them, simply write to kirah@endiversum.com.
7. Right to lodge a complaint
If you believe the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, email: dsb@dsb.gv.at, web: www.dsb.gv.at.
8. Automated decision-making
No automated decision-making, including profiling, takes place.
9. Changes
We update this policy when the application or the legal situation changes. The version published here applies.