Cookie policy
This policy describes in full which information delikaasy.app stores on or reads from your device, for what purpose, on what legal basis, for how long, and who receives the data.
What it covers
It applies to the website delikaasy.app including all its subpages. It does not apply to the iOS application “Delikaasy” – there we use PostHog rather than Google Analytics, likewise only after consent. Details are in section 3.11 of the privacy policy.
This policy complements the privacy policy with the technical layer and takes precedence over it for statements about cookies and local storage. In all other respects the privacy policy applies.
Controller
The controller within the meaning of Art. 4(7) GDPR is:
Robert Oestmann · Barmbeker Straße 27a · 22303 Hamburg · Germany
Email for data protection matters: datenschutz@delikaasy.app · General contact: kontakt@delikaasy.app · Full provider identification in the imprint.
No data protection officer has been appointed; the statutory requirements of § 38 BDSG are not met.
Your current decision
Cookies and local storage – the terms
A cookie is a small text file that a website places on your device through your browser and can read again on a later visit. Local storage (Web Storage) serves the same purpose but is not sent to the server with every request; it is read only when the website asks for it.
By lifetime, a distinction is made between session cookies, which expire when the browser closes, and persistent cookies with a fixed lifetime. By origin, first-party items are set by the domain you visited, third-party items come from a foreign domain.
Legally, cookies and local storage are treated alike. § 25(1) TDDG permits storing information on your device and accessing it only with your consent. § 25(2) no. 2 TDDG provides an exception where the storage is strictly necessary to provide a service you have expressly requested.
Legal bases at a glance
Four legal bases apply on this website:
- § 25(2) no. 2 TDDG for storing your consent decision on your device – it is strictly necessary in order to honour that decision.
- Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDG for audience measurement and for joining the waitlist.
- Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 7(1) GDPR for documenting your consent – we are legally required to be able to demonstrate it.
- Art. 6(1)(f) GDPR for server-side log data. Our legitimate interest lies in the secure and uninterrupted operation of the website.
For transfers of personal data to the United States, Art. 49(1)(a) GDPR applies in addition: by consenting to audience measurement you expressly consent to that transfer as well.
1. Necessary – no consent required
A single entry in local storage. It records how you decided in the consent banner. Without it we would have to ask you again on every page view and could not honour a refusal.
Four items are stored: the version of the consent, a randomly generated identifier with no link to your person, the time of your decision, and whether you agreed to audience measurement. The entry stays on your device and is at no point transmitted to us or to third parties.
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
delikaasy.einwilligungLocal storage | Delikaasy (first party) | Stores the decision from the consent banner with version, time and identifier | 6 months |
Legal basis: § 25(2) no. 2 TDDG for the storage, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR for the record-keeping function. No consent is required for this and none is obtained.
No language cookie: which language version you get is determined on each request from your browser's Accept-Language header. That information is not stored.
No session cookie: the website has no login and no shopping basket, so it needs no session identifier.
2. Statistics – only with your consent
We would like to understand which sections of the page get read, which sources bring visitors to us and where they leave. For this we use Google Analytics 4.
The service is loaded only after your express consent. Before you agree, no Google script is loaded, no cookie is set and no connection to a Google server is opened. We also do not use the anonymised cookieless advance signals Google offers (“Consent Mode Advanced”), because they would transmit your IP address to Google before the decision.
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
_gaCookie | Google Ireland Limited (first-party cookie) | Distinguishes visitors by a pseudonymous identifier | 2 years |
_ga_<measurement ID>Cookie | Google Ireland Limited (first-party cookie) | Keeps the session state and the number of sessions | 2 years |
What data is processed
Collected are: a pseudonymous identifier from the cookies listed below, pages opened and their titles, sections read, the use of individual controls (click on the waitlist, start and submission of the form, opening a legal text, switching language), time spent, the previously visited page, approximate location based on the IP address, and technical details about device, operating system, browser and screen size.
Input into form fields is not collected. Whatever you type into the waitlist field is at no point transmitted to Google – all that is reported is that a field was used and a button pressed.
Voluntary
Consent is voluntary. If you refuse it or withdraw it later, the website remains fully and unchangedly usable; you suffer no disadvantage. Use of the website is not conditional on consent (Art. 7(4) GDPR).
Provider and processing agreement
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data on our behalf as a processor; the requirements of Art. 28 GDPR are met through Google's Ads Data Processing Terms.
Transfer to the United States
Google Ireland Limited may transfer personal data to its parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, California, United States.
The transfer relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, which Google LLC has joined, and additionally on standard contractual clauses under Art. 46(2)(c) GDPR.
We point this out expressly: the United States does not have a level of data protection comparable to European law. US security authorities may access data under their law without you being informed, and effective legal remedies against this may not be available to you. By consenting you expressly also consent to this transfer and to the risks associated with it (Art. 49(1)(a) GDPR).
How we have configured the service
According to Google, your IP address is evaluated solely for coarse location and is not logged or stored.
Switched off are: the “Google Signals” feature and with it cross-device consolidation, all advertising features and ad personalisation, data sharing with Google for its own purposes, and any link to Google Ads.
Google's retention period for event data is 14 months; after that the data is deleted automatically.
We do not combine the measurement data with other datasets, in particular not with your email address from the waitlist. We do not sell data and do not pass it on for advertising purposes.
Withdrawal
You can withdraw your consent at any time with effect for the future – using the button at the top of this page or “Cookie settings” in the footer of every page. Withdrawal takes one click and is therefore just as easy as giving consent (Art. 7(3) GDPR).
On withdrawal we stop the measurement immediately, block transmission to Google and delete the cookies Google has set from your browser. The lawfulness of processing carried out before the withdrawal is unaffected.
Independently of this, Google offers a browser add-on to deactivate Google Analytics, which applies to all websites.
3. Duration and renewal of consent
Your decision is valid for six months. After that the stored entry expires and we ask again. Until you agree again, no measurement takes place.
Regardless of that period, we obtain your consent afresh as soon as the scope changes – for instance if another service is added, a purpose changes or a provider is replaced. A consent given covers only what we informed you about beforehand.
As evidence under Art. 7(1) GDPR we store, together with your decision, the version of the consent, the time and a random identifier. This information stays on your device.
4. Waitlist and confirmation email
The waitlist sets no cookies and reads nothing from your device. It is therefore not part of the consent banner. We describe it here nonetheless, because it is the only other processing on this website.
If you sign up, we process your email address in order to inform you about the launch of the application. As evidence of consent we additionally store the time and IP address of the sign-up and of the confirmation.
We use the double opt-in procedure: after signing up you receive a message with a confirmation link. Only once you have followed it do we add you to the list. If confirmation does not follow, we delete the address after 14 days.
Delivery is handled by Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, California, United States) as a processor under Art. 28 GDPR; delivery runs on the provider's European infrastructure.
No open or click tracking takes place. We do not learn whether you opened a message or clicked a link in it; the messages contain no tracking pixels and no rewritten links.
Legal basis: your consent under Art. 6(1)(a) GDPR in conjunction with § 7(2) no. 3 UWG, and for the evidence data Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. Retention: until withdrawal, at most until the launch communication is complete. You can unsubscribe via the link in every message or informally at kontakt@delikaasy.app.
5. Server-side log data
When the website is opened, our hosting provider processes connection data: IP address, date and time of access, the resource requested, the HTTP status code, the amount of data transferred and the browser identifier.
This processing is technically unavoidable – without an IP address no response can be delivered – and serves to deliver the page, keep it running and fend off attacks.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in secure and uninterrupted operation. Retention: normally 30 days. This data is not covered by the consent banner because no access to your device takes place, and it does not feed into audience measurement.
The hosting provider is Railway Corporation, San Francisco, California, United States, acting as a processor under Art. 28 GDPR. Delivery runs on servers within the European Union. As the company is based in the United States, access from a third country cannot be ruled out; that transfer relies on standard contractual clauses under Art. 46(2)(c) GDPR.
The domain delikaasy.app is registered with STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The registrar does not process any data of this website's visitors.
6. What does not happen on this website
We use no advertising cookies, no retargeting, no conversion pixels from social networks and no social media plugins. There is no profiling across other websites and no fingerprinting, that is, no recognition based on technical device characteristics.
We embed no third-party content from external servers. Fonts, images and scripts are delivered from our own server; opening the page sends no request to Google Fonts, to a content delivery network, to a map portal or to a video portal. The only exception is Google Analytics – and only after your consent.
Automated decision-making including profiling with legal effect or similarly significant impact within the meaning of Art. 22 GDPR does not take place.
7. Recipients
| Recipient | Purpose | Place of processing | Basis |
|---|---|---|---|
| Google Ireland Limited / Google LLC | Audience measurement, only after consent | Ireland, possibly the United States | Art. 28 GDPR, Data Privacy Framework, standard contractual clauses |
| Resend (Plus Five Five, Inc.) | Delivery of waitlist and confirmation emails | European Union | Art. 28 GDPR |
| Railway Corporation | Hosting and delivery of the website, server logs | European Union (company based in the USA) | Art. 28 GDPR, standard contractual clauses |
Beyond the processors named, we pass your data on only where we are legally obliged to do so or where a court order exists.
8. Settings in your browser
Independently of our banner you can inspect cookies and local storage in your browser settings at any time, delete them individually or entirely, and block them for the future. The relevant instructions are in your browser's help under headings such as “manage cookies” or “clear site data”.
If you block cookies entirely, this website remains usable. If you clear this site's local storage, the stored entry with your decision goes as well – we will then ask again on your next visit.
9. Your rights
As a data subject you have the following rights against the controller:
- Access to the data processed about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
An informal message to datenschutz@delikaasy.app is enough to exercise them. No disadvantage arises for you from doing so.
Independently of this you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The one responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information; you may also contact the authority where you live. Their contact details are on their website.
10. Changes to this policy
We adapt this policy as soon as the technologies used or the legal situation change. The version published here is the one that applies; the date is at the top of the page. If the scope of processing requiring consent changes, we obtain your consent afresh – no silent extension takes place.