Privacy notice

Controller

Accessing the website

When you access the website, the server must temporarily process your IP address as well as the date and time, requested address, request method, response status, referrer if supplied, and browser and operating-system information transmitted by your browser.

This processing is required to deliver the website, maintain its stability, and protect it against misuse. The legal basis is Article 6(1)(f) GDPR. The legitimate interests are reliable and secure operation of the website.

The application does not keep a separate access log of ordinary page views. Technical error and security logs may contain a time, path, response status, and account identifier. Production application logs are volume-limited to three files of 10 MB; older entries are overwritten during rotation.

Hosting

The website is hosted on a server in Germany provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes technical connection and server data on my behalf to provide and secure the server. The legal basis for my processing is Article 6(1)(f) GDPR.

User accounts and sign-in

Registration stores your username, first and last name, email address, a password hash, registration date, last sign-in, and assigned permissions. The plain-text password is not stored.

The data is used to create and secure your account and to provide registered functions such as ordering and reviews. The legal basis is Article 6(1)(b) GDPR, the user agreement for this free service.

There is no statutory requirement to provide this data. Fields marked as required are needed to create an account; without them, the registered functions cannot be used.

Orders and reviews

An order stores the account, drink and selected options, responsible bar, and order, serving, or cancellation times. The person who placed the order and authorised bartenders can see the information needed to fulfil it. The legal basis is Article 6(1)(b) GDPR.

If you submit a review, your displayed full name, rating, comment, and time of submission are visible to all website visitors. Publication is part of the review function you request and is based on Article 6(1)(b) GDPR. You can request deletion at any time.

Recipes, inventory, and images

Users with editing permission can submit recipe and inventory content and upload images. Published recipe content and images are visible to website visitors. Account identifiers may be recorded in security and error logs when changes are made. Processing is based on Article 6(1)(b) and (f) GDPR; the legitimate interest is maintaining the shared drinks menu.

Cookies and browser storage

The website uses the functional cookies “sessionid” for sign-in, language, and bar selection for up to 14 days and “csrftoken” to protect forms against forged requests for up to one year. These cookies are required for the functions you request. They are used under section 25(2)(2) TDDDG; associated personal-data processing is based on Article 6(1)(b) and (f) GDPR.

The missing-ingredients list is stored locally in your browser until you clear the list or browser data. Recipe drafts, draft images, and inventory display settings are stored in session storage and normally disappear when the tab is closed. This storage provides functions you explicitly request and is used under section 25(2)(2) TDDDG.

No analytics, advertising, or marketing cookies are used. The fonts and interface libraries are served from this website.

Contact by email

If you contact me by email, I process your email address, message, and related metadata to answer your request. Depending on the subject, the legal basis is Article 6(1)(b) or (f) GDPR. The legitimate interest is answering enquiries. Messages are deleted when the request has been resolved and no legal reason requires further retention.

The mailbox is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data in the United States. Google states that it uses the EU-US Data Privacy Framework and standard contractual clauses where required.

Recipients

I can access the stored data. Authorised bartenders receive the order information described above. Hetzner and Google receive the data described in their sections. Data is otherwise disclosed only when legally required. It is not sold.

Retention and deletion

Account data and its linked orders and reviews are stored until the account is deleted or an earlier justified deletion request is fulfilled. Published content remains until it is removed. The shorter periods for connection data, cookies, browser storage, and contact messages are stated above.

Database access is restricted to the application and administration. Rolling database backups are configured for 14 days; because deletion runs once a day by file age, a deleted record can remain in a backup for up to approximately 16 days and is used only for recovery.

Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing, and data portability. You may withdraw consent at any time for the future. Contact the controller named above to exercise these rights.

You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR.

You also have the right to lodge a complaint with a data-protection supervisory authority, in particular the authority responsible for your place of residence or the alleged infringement.

Automated decisions

There is no automated decision-making or profiling within the meaning of Article 22 GDPR.