Privacy Policy

This privacy policy applies to the website schliessfach.app. For the iOS app itself, the separate App Store privacy disclosure applies.

1. Data controller

Lukas Osterheider
Bahnhofstraße 63
58452 Witten
Germany
Email: [email protected]

2. Principle: minimal processing

This website follows a Privacy-by-Design approach. We deliberately avoid cookies, advertising pixels, third-party fonts (Google Fonts), and cross-site tracking. Fonts are served locally from our server.

3. Server logs

When you visit this website, the hosting provider (Cloudflare Pages) processes technically necessary data:

• IP address (truncated/anonymised per Cloudflare practice)
• Date and time of request
• URL requested
• Browser type and version
• Volume of data transferred

This processing is necessary to deliver the website and protect it from abuse (Art. 6(1)(f) GDPR — legitimate interest). Logs at Cloudflare are deleted after a short retention period.

4. Analytics with Umami (cookieless)

We use Umami Analytics, available at analytics.lukasosterheider.de, to measure reach and improve this website. Umami works without cookies, without fingerprinting, and without cross-site tracking. Aggregated usage data may include pages viewed, referrer, browser, operating system, device type, approximate country/region, and browser language.

We also measure selected click events, especially clicks on App Store buttons, contact email links, and key CTA links to features and security. We do not collect app inventory data, form contents, or directly identifying contact details through these events. Processing is based on our legitimate interest in operating a user-friendly, technically stable, and economically viable website (Art. 6(1)(f) GDPR).

5. Contact

If you contact us by email, we process the data you submit to handle your request (Art. 6(1)(b) or (f) GDPR). Inquiries are kept only as long as needed and deleted thereafter.

6. Your rights

You have the right to:

• Access processed data (Art. 15 GDPR)
• Rectify inaccurate data (Art. 16 GDPR)
• Erasure ("right to be forgotten", Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

The competent supervisory authority is the data-protection authority at the controller\'s place of business.

7. AI crawlers and search engines

The contents of this website are public and indexed by search engines and AI-based answer systems (e.g., ChatGPT Search, Perplexity, Claude, Google AI Overviews). We allow this explicitly because the site is intended to inform. See robots.txt for details.

8. Changes to this policy

We may update this policy when legal grounds or processing activities change.

As of January 2026. For the app privacy disclosure, see the separate information in the App Store.