Privacy notice
Last updated 30 August 2026. This notice covers the information collected by this service, why it is held, and what you can do about it.
Who is responsible
Ydrath (the operator) operates this service and decides how your data is handled — the “controller”, in the language of the GDPR. Reach the operator through the help centre. The service is small enough that no data protection officer is required, so questions come to the operator directly.
What is collected, why, and on what basis
| Data | Why | Legal basis |
|---|---|---|
| Username and email address | To create your account, confirm it belongs to you, and send sign-in codes | Performance of a contract — Art. 6(1)(b) |
| Password verifier | To let you sign in. Your password itself is never stored — only a cryptographic verifier derived from it, which cannot be turned back into the password | Performance of a contract — Art. 6(1)(b) |
| Content and activity associated with your account | To provide the service and keep your data between sessions | Performance of a contract — Art. 6(1)(b) |
Sign-up attempts: time, IP address, browser string, username, and a
masked email such as pl****@example.com |
To detect and block automated sign-up abuse. Full addresses are never written to this log | Legitimate interest — Art. 6(1)(f): keeping the service usable and free of bots |
| Web server logs: IP address, time, page requested | Security and fault diagnosis | Legitimate interest — Art. 6(1)(f) |
Providing a username, password and email address is necessary to hold an account. If you would rather not, you simply cannot register — there is no other consequence.
What is not done
No analytics, no advertising, no tracking pixels, no third-party scripts, no profiling and no automated decision-making. Nothing is sold, rented or shared for marketing. The only cookie is the session cookie that keeps you signed in — it is strictly necessary for the service to work, so it needs no consent banner.
Who else sees it
Confirmation and sign-in emails are delivered through an external email provider, which necessarily receives your email address and the message. Depending on that provider, this may involve a transfer outside the EU/EEA under the provider's own safeguards. The service itself is hosted in Austria. Nobody else receives your data, and it is disclosed to authorities only where the law actually requires it.
How long it is kept
- Account and its content — until you ask for deletion, or the service is retired.
- Sign-up log — 180 days, then deleted automatically.
- Unconfirmed registrations — 24 hours, then discarded.
- Sign-in codes — 10 minutes.
- Database backups — 14 days, then overwritten.
- Web server logs — rotated and discarded within a few weeks.
Your rights
Under the GDPR you may ask for:
- Access to the data held about you (Art. 15)
- Rectification of anything inaccurate (Art. 16)
- Erasure of your account and data (Art. 17)
- Restriction of processing (Art. 18)
- Portability — a copy in a machine-readable form (Art. 20)
- Objection to processing based on legitimate interest (Art. 21)
Send a Data request through the help centre and it will be done. Nothing here relies on consent, so there is no consent to withdraw. You also have the right to complain to a data protection supervisory authority in your country; the EDPB publishes the list.
Security, honestly
The site is served over HTTPS, passwords are stored only as verifiers, and database credentials are kept out of the web root. That said, this is a hobby service run by one person in their spare time — do not reuse a password here that protects anything you care about, and assume any hobby service could one day be compromised.
Changes
If this notice changes, the date at the top changes with it. Material changes will be announced on the site.