Privacy policy

In short

• No sign-up, no accounts, no e-mail addresses, no phone numbers.
• No cookies, no tracking, no analytics, no advertising, no external fonts or scripts.
• All data is processed and stored exclusively in data centres within the European Union (Frankfurt am Main).
• Plans are deleted automatically 18 months after the last shift or the last change – or earlier by the administrator.

1. Controller

E-mail: marvin@herzenberger.at

2. What data we process

a) Plan data

Whoever creates a plan (“admin”) enters a title, optionally a description, a time zone, shifts (date, time, station, number of places), a withdrawal deadline and optionally a contact note. The contact note is free text; we recommend entering only information that all participants may see.

b) Sign-ups

Whoever signs up for a shift enters a name (first name, nickname or full name – your choice). The name is visible to everyone who knows the participant link. Administrators can additionally add people manually and attach a note that is visible only in the admin view and the print view.

c) Access tokens

Access works exclusively via links containing random tokens (admin link, participant token). We store tokens only as a cryptographic hash (SHA-256); the token cannot be reconstructed from the hash. The same applies to the optional admin PIN. Failed PIN attempts are counted per plan for 15 minutes to prevent abuse.

d) Data in your browser (localStorage)

To recognise you, your browser stores the participant token, the last name you used and, while creating a plan, a draft locally on your device. This data does not leave your device, is not transmitted to us (except the token when signing up or withdrawing) and can be deleted at any time via your browser settings. No cookies are set.

e) Technical data

When you visit the website, our hosting provider processes technically necessary connection data (in particular IP address, time, requested address, browser identifier) to deliver the page and to fend off attacks. To prevent abuse (rate limiting) we store a counter per action and IP address for at most 24 hours; the IP address is stored as a hash only.

3. Purposes and legal bases

• Providing the service (creating, viewing, signing up, withdrawing, live updates): Art. 6(1)(b) GDPR (performance of the usage relationship) or Art. 6(1)(f) GDPR (legitimate interest in coordinating shifts) where someone else signed you up.
• Security, abuse prevention and troubleshooting: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
• Legal obligations, where applicable: Art. 6(1)(c) GDPR.

We make no automated decisions and do not build profiles.

4. Note for administrators

If you add other people to a plan manually or mention their names in notes or the contact note, you process third parties’ personal data. Please inform these people and enter only what the rota requires. For purely private or club-internal use you are generally not a separate controller under the GDPR; if in doubt, contact us.

5. Recipients and processors

We do not pass data on to third parties and do not sell data. To operate the service we use the following processors:

• Supabase, Inc. (970 Toa Payoh North #07-04, Singapore 318992) – Datenbank und Echtzeit-Aktualisierung. Storage location: Frankfurt am Main, Deutschland (AWS eu-central-1). Privacy notice: https://supabase.com/privacy
• Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) – Hosting der Anwendung und Ausführung der Server-Funktionen. Execution location: Frankfurt am Main, Deutschland (Region fra1). Privacy notice: https://vercel.com/legal/privacy-policy

Data processing agreements under Art. 28 GDPR are in place with both providers. Processing and storage take place in EU data centres. Where a provider is established outside the EU and access from a third country (e.g. for support) cannot be excluded, it is safeguarded by the EU Commission’s standard contractual clauses (Art. 46 GDPR).

The “Share via WhatsApp” function merely opens a link in your WhatsApp application; no data is transmitted from us to WhatsApp. WhatsApp’s own privacy policy applies to your subsequent use of WhatsApp.

6. Retention

• Plans including shifts and sign-ups: automatic deletion 18 months after the later of “end of the last shift” and “last change”. Administrators can delete the plan permanently at any time or extend the period. The deletion date is shown in the admin view.
• Rate-limiting counters (hashed IP address): at most 24 hours.
• Technical connection data at the hosting provider: short-term according to its policies.
• Data in localStorage: until you delete it in your browser.

7. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR).

You can do much of this yourself:

• Your own sign-ups: withdraw via the participant link or your personal link (within the withdrawal deadline).
• After the deadline, or for entries someone else made for you: contact the plan’s administrator (contact note in the plan).
• Administrators: edit or permanently delete the plan via the admin link.

You can also reach us at marvin@herzenberger.at. Please note that we can only identify plans via the admin link or participant token, as we store no accounts or contact details.

If you believe the processing of your data violates data protection law, you may lodge a complaint with the Austrian Data Protection Authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

8. Data security

Transmission is encrypted (TLS). Write access runs exclusively through our servers; the database is not directly accessible from the browser. Access tokens are stored hashed only, and capacity and deadline checks are enforced server-side.

9. Children

The service is aimed at clubs, teams and organisations. We do not collect age information. Parents or guardians who find that a child’s data was entered without their consent can contact the plan’s administrator or us.

10. Changes

We update this privacy policy when the service or the legal situation changes. The version published here applies; the date of the current version is shown above.