Data privacy

This explains which personal data this notefeed instance processes and why, as required by the GDPR (DSGVO). Last updated: 2 October 2026.

Controller (Verantwortlicher)

Marcel Bruckner, Kempten, Germany. Email: privacy@notefeed.me. No data protection officer is appointed, as none is required.

Hosting

The instance runs on my own server in Germany. No hosting provider or other processor has access to the data, and no data is transferred to third countries.

Notes, feeds and images

What: what you post is stored as you sent it: the notes, the feed name, the optional feed title, description and title image, and uploaded images.
Why and legal basis: to provide the feed you asked for (Art. 6 (1) (b) GDPR).
Retention: until you delete the feed. Deleting a feed deletes everything in it.

Careful with images: metadata such as the GPS position is left in uploaded images. Anyone who can read the feed can see it. Remove it before uploading if you do not want to share it.

Feeds have no accounts. Anyone who knows a feed's name can read and post to it, and anyone with its read link can read it, images included. Do not post personal data of other people without a reason to.

Server logs and IP addresses

What: when you visit, the web server logs your IP address, the time, the requested path, the status code and your browser's user agent.
Why and legal basis: to keep the service secure and to find and stop abuse (Art. 6 (1) (f) GDPR, legitimate interest).
Retention: 14 days, then the logs are deleted.

Separately, notefeed uses your IP address to rate-limit posting and failed password attempts (same legal basis). That is kept in memory only, for about a minute, and is not written to disk by notefeed.

Cookies

If the instance or a feed is password-protected, a cookie keeps you logged in. It is strictly necessary to provide the service you requested (§ 25 (2) no. 2 TDDDG), so no consent is needed. It holds no personal data and carries no tracking. There are no analytics, advertising or third-party requests, and nothing is loaded from external servers.

Recipients and automated decisions

Your data is not passed on to anyone. There is no automated decision-making or profiling.

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21 GDPR). You can delete a feed and its notes yourself. For anything else, write to privacy@notefeed.me. I will answer within one month.

You also have the right to lodge a complaint with a supervisory authority. For me that is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, www.lda.bayern.de.