Privacy notice
Find out what data the community processes, who can see it and how browser storage is used.
Language preference
Your chosen language is saved for this tab in session storage under etn-language. You can change it at any time using Deutsch / English. The preference is used only for presentation, not tracking.
1. Data controller & contact
- Operator
- Marcel Kranz
- Postal address for legal correspondence
- Limbacher Straße 12 53902 Bad Münstereifel Deutschland
2. Data we process
Visiting the website
When you access the website and API, technical connection data such as your IP address, time, requested resource and browser information is transmitted to the servers involved. Cloudflare Pages delivers the website; Supabase processes accounts, API requests and images. These connections serve content delivery, access control and detection of technical faults and abusive access.
Registration & sign-in
Your email address, public display name and authentication data are processed for your account. Your password is transmitted to Supabase over an encrypted connection for verification; it is not part of your public profile. Sign-in confirmations, password recovery and confirmations of sign-in email changes are handled by the configured email service. When changing your address, both the existing and new addresses are processed for verification.
Apps, images & test participation
Published app listings, tasks, logos and screenshots are public. Display names are publicly accessible. Please use a pseudonym if you do not want your real name published. Test links are visible only to the project owner and approved testers. Participation requests are visible to the relevant member and project owner.
Emails about test requests
When a member requests to test your app, we send a message to your verified sign-in address if email notifications are enabled. The configured email service processes the app name, the applicant’s display name and a link to the private request. Google addresses and private messages are not sent by email for this purpose. You can disable this feature, which is enabled by default, under “Manage account”.
Delivery jobs are stored securely and retried after temporary failures. Once completed, we remove the recipient and message content stored for delivery from the job. Technical delivery identifiers, timestamps and error codes are retained for troubleshooting and cleaned up during subsequent delivery runs once older than 30 days. Without further runs, they may remain longer. Deleting the request or an associated account also removes the related job. Emails already sent and service provider logs are not recalled.
Feedback
Feedback can be read by its author and the project owner. Share only information needed for the test. Do not upload images containing confidential content or other people’s personal data without appropriate authorization.
Public community forum
Forum topics and approved replies, including display names and timestamps, are public and may be indexed by search engines. Pending versions and post reports are stored securely. Moderators review initial posts and external links; decisions and reasons are logged. Subscriptions and notifications of new replies are visible only in your own account.
Cloudflare Turnstile is planned to protect against automated abuse. Once configured, security checks are loaded in posting and sign-in forms; Cloudflare processes technical browser and connection data for this purpose. The server verifies the result before storing forum content. Forum submissions remain disabled until Turnstile is configured.
For posting limits, we store the account ID, action, time and an IP identifier derived using a secret server key. The IP address itself is not stored in these forum records. Entries older than seven days are cleaned up during subsequent forum access. Service provider security logs may have separate retention periods. Do not publish confidential information; hiding a post does not immediately remove search engine copies.
Deleting an account removes pending submissions, subscriptions and the account association of published posts. Published discussion posts remain without a profile link so replies remain understandable. Personal information within post text is not automatically anonymized; contact the address above for help with this.
Friendships and private messages
For friend requests, we store the account IDs involved, status and timestamps. Signed-in members can find other members by their public display names. Your friends list and requests are visible only to the members involved.
Once a request is accepted, you can exchange text messages. We store message content, sender, sending time and read status for unread messages in Supabase. Other members and moderator accounts cannot read your messages through the website. Messages are not end-to-end encrypted. Drafts remain only in the open page’s memory and are not stored persistently in the browser.
Ending a friendship deletes the shared conversation history for both members. Account deletion also removes associated friendships, requests and messages. Message content is not sent by email. Backups and technical service provider logs are not removed immediately.
Google Play address and test access
With the email-list method, we process the Google address you provide separately and make it available only to you and the relevant project owner. They add it to their Google Play tester list themselves. We also store their confirmation of adding it and your optional self-declaration of joining on Google. This declaration is not verified by Google. With the group method, we do not request an additional Google address.
Each app developer is responsible for their app, Google tester list and any Google Group they manage. Participation on the platform alone neither enrols you on Google nor removes you. Access data and your self-declaration stored here are deleted when platform participation ends; previous feedback remains stored under the current functionality.
Reports and moderation
When you report a project, we store the reason, project reference, your account and the time. Authorized moderators can view reports and suspension reasons, remove projects and suspend or reinstate members. Decisions are logged with the acting account, target ID, reason and time. Decisions are made by people. Include only information necessary for review in reports.
Purposes & legal bases
Account features, project management, test participation and feedback serve your requested use of the community under Article 6(1)(b) GDPR. Technical security measures, fault analysis and moderation serve our legitimate interests in an available, secure service, preventing abuse and protecting the community under Article 6(1)(f) GDPR. Registration does not require consent to advertising or analytics.
3. Recipients & service providers
Cloudflare: website hosting, DNS and website protection
We use Cloudflare Pages and the DNS and network services of Cloudflare, Inc., USA. When you visit the website, Cloudflare processes in particular IP addresses, requested URLs, timestamps, browser information and technical security data. These services deliver website files over a global network, encrypt connections and protect against abusive access. Processing outside the EU or EEA is possible. Cloudflare provides terms for data processing and international data transfers; the terms applicable to our account still need to be fully documented.
Cloudflare privacy policy · Cloudflare data processing terms
Supabase: accounts, database and image storage
Supabase is used for authentication, the database and image storage. The provider is Supabase Pte. Ltd. Data processing terms, subprocessors and any third-country transfers must be reviewed and documented before public launch. An EU project region alone does not rule out additional international processing.
- Supabase project region
- EU – Ireland (eu-west-1)
- Website hosting
- Cloudflare Pages (Cloudflare, Inc., USA)
- Account email delivery
- Resend (Plus Five Five, Inc., USA)
Sentry: technical app errors
To detect and resolve technical faults, we send error reports to Sentry (Functional Software, Inc., USA). Reports include the error type, time, build ID and positions in the deployed code. Message text, page URLs with parameters, account data, form content and click trails are removed from reports. Session recording and performance analytics are disabled. Error monitoring does not create additional cookies or persistent identifiers in browser storage.
Transmission involves technical connection data, including the IP address. Automatic inclusion of the IP address in error reports is disabled. The actual project region, applicable data processing terms, international transfers and retention periods must be fully documented before public launch. Processing serves technical troubleshooting; its legal assessment is part of the outstanding review.
Resend: account email delivery
Registration confirmations, email address change confirmations and password reset emails are sent via Resend (Plus Five Five, Inc., USA). Supabase triggers delivery through the configured SMTP connection. Resend receives in particular the recipient address, sender, message content including the confirmation link, and sending and delivery information. Your account password is not included in the email. Delivery serves the account feature you requested under Article 6(1)(b) GDPR.
Resend describes processing customer data in the USA. Selecting a European sending region therefore does not mean all data is stored exclusively in the EU. The provider offers a data processing agreement with standard contractual clauses. The contractual and transfer terms and retention settings applicable to our account must be fully documented before launch.
Resend privacy policy · Data processing terms
Whether open or click tracking is enabled still needs to be confirmed in the Resend domain settings. Analysis of opening and clicking behaviour is not intended for account emails.
Google Play and Google Groups test links are ordinary external links. Google content is not embedded automatically. Opening a link takes you away from our website; the relevant provider’s information applies to further use.
4. Cookies & local browser storage
The app currently sets no analytics or advertising cookies of its own. For a sign-in you request, Supabase stores session data in your browser’s local storage. This data enables recognition of your sign-in and session renewal. It is not used for advertising profiles.
Sign-in data may persist after a tab is closed. It is removed when you sign out; server-side validity and session expiry follow the authentication configuration. For details and a feature to remove your sign-in, see Cookies & storage.
When initializing a requested sign-in or saved session, the authentication library may briefly check storage availability with a random test entry. This is removed immediately and contains no account data.
Strictly necessary access to your device falls under the exception in Section 25(2)(2) of the German TDDDG. Additional consent is not intended as a blanket prerequisite for sign-in. The GDPR requirements also apply to the processing of personal data.
5. Retention & deletion
In the current development version, accounts, projects, participations and feedback are not automatically deleted after a fixed period. A binding deletion policy covering logs, backups and image files still needs to be defined before public launch. Until then, no specific deletion period is promised.
You can request permanent account deletion under “My dashboard → Manage account”. After successful server-side cleanup, your sign-in account, profile, projects and image files, test participations, saved Google addresses and feedback are deleted. If an error occurs, the account remains blocked from further community actions; deletion can be retried. Google tests, Google Groups and previously exported lists must be updated separately.
Project reports contain the reason and, until account deletion, a link to the reporting account. This link is then removed. Moderation decisions are logged with reasons, timestamps and technical target identifiers. Deleting the acting account removes its association. Suspension reasons are visible only to moderators. Retention periods for these logs, backups and cached images must be defined before public launch.
6. Your rights
Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may withdraw consent at any time with effect for the future.
You may lodge a complaint with a competent data protection supervisory authority, particularly in your place of habitual residence, workplace or the place of the alleged infringement. For requests, use the privacy contact above.
The app currently does not implement automated decision-making, including profiling.
The mandatory data requested for registration and participation is necessary to provide these features. You can still read public pages without an account. We only need a Google address if you choose an email-list test.
Private test links and Google addresses are not included in the sitemap or prerendered public pages. Public project descriptions and images can generally be accessed and further processed by third parties.
Last updated: 20 October 2026