Privacy policy

This is an English translation for convenience. The legally binding version is the German Datenschutzerklärung.

In short

• No accounts, no tracking, no ads, no analytics tools. A single cookie only remembers your language; anything you choose to save stays in your browser.
• We don’t save what you type in a database. It only exists in the page address (URL).
• Your browser only connects to our website, never directly to third parties.
• Names and personal messages are never passed on to data sources.

1. Controller

TODO: full name or company name (with legal form, e.g. GmbH)
TODO: street and number
TODO: postcode and city
Germany

E-mail: TODO: contact e-mail

2. Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Whenever a page is opened, the host processes technically necessary data in server logs: IP address, date and time, the address (URL) requested, referrer URL, browser and operating system.

Important: because the birthday details (name, date, place and, if given, time and gift message) are part of the URL, they can appear in these logs. The logs are used only to keep the site secure and running and to fix errors, and are deleted automatically after a short time (30 days at most) unless needed to investigate a security incident.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). We have a data processing agreement with the host under Art. 28 GDPR. The host is based in the USA and certified under the EU-US Data Privacy Framework (EU Commission adequacy decision, Art. 45 GDPR); standard contractual clauses apply in addition. More information: host’s privacy policy.

3. Using the birthday tool

When you fill in the form we process what you enter: name, birth date, optional time, birthplace with coordinates and time zone, and for gifts an optional sender name and message. These details are not saved; they are written into the page address. Each time the page is opened, our server reads them from the address, builds the page and forgets them again.

To build the content, our server queries public data sources. Only the following is sent:

• Open-Meteo (weather archive and place search): coordinates and date, or the text you type into the place search
• Wikipedia and Wikidata (Wikimedia Foundation): the birth date or year and the birth country (for headlines, the country’s No. 1 songs and birthday twins), and the birth town’s name and coordinates (for its population then and now)
• World Bank (open data): the birth country (for prices, inflation, population and life expectancy)
• NASA (Astronomy Picture of the Day): the date
• GitHub (Billboard chart archive): the chart week’s date
• Apple iTunes Search: song title and artist

Your name, your message and your IP address are not sent, because the requests come from our server, not your browser. Responses from the data sources (which contain no names) are cached to make the site faster. The legal basis is Art. 6(1)(b) GDPR (providing the service you requested).

Images and song previews

Cover art, song previews and images from Wikipedia and NASA are loaded through our server, so your browser doesn’t connect to Apple, Wikimedia or NASA. Only when you click an external link (for example to Wikipedia or a NASA video) do you leave our site, and that provider’s privacy policy applies.

Gift links and sharing

Anyone who has a link can see the details in it. Please share links only with people meant to see them, and only enter other people’s details (for example for a gift) if they would likely be fine with it. When a link is shared in a messenger or social network, that service fetches a preview image showing the name, date and place; our host may cache this image briefly.

Film and downloads

The film, poster and certificate are created entirely in your browser. Saved videos, images and PDFs are never sent to us.

4. Language, cookie and browser storage

On your first visit the site’s language is chosen from your browser’s language setting (the “Accept-Language” header). If you pick a language yourself, we store that choice in a cookie called “lang” (it holds only the language code, such as “en”, and lasts one year). We set no other cookies.

If you switch between light and dark mode, your choice is kept in your browser’s local storage (“theme”). It never leaves your device. The legal basis for both is § 25(2) no. 2 TDDDG, as the storage is strictly necessary for a function you explicitly asked for. You can delete both at any time in your browser settings.

My people, games and badges. If you choose “Save” on a birthday page, that birthday (name, date, birthplace and the details shown on its card) is kept in your browser’s local storage so the “My people” page can show countdowns and collections. When you play one of our games, your answers, scores and streak are kept there too, along with the badges you have unlocked. None of this is ever sent to us or anyone else; it stays on your device. The legal basis is § 25(2) no. 2 TDDDG (strictly necessary for a function you asked for). You can remove single people on the “My people” page, or delete everything by clearing this site’s data in your browser.

Live games. Unlike the other games, a live game (TV room or duel) needs a server to connect the players. While you play, the nickname you choose, your answers and the room code pass through our live game server, which runs on Cloudflare Workers, a service of Cloudflare, Inc. (USA). They are kept in memory only for as long as the game runs and are deleted when the room ends or empties; we store nothing in a database. To deliver the connection, Cloudflare also processes your IP address. Please don’t use your full name as a nickname. The legal basis is Art. 6(1)(b) GDPR (providing the game you chose to play). Cloudflare is certified under the EU-U.S. Data Privacy Framework, which covers the transfer to the USA.

5. Fonts

All fonts are served from our own server. There is no connection to Google or any other font provider.

6. Contact by e-mail

If you e-mail us, we process your address and message to handle your request (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer needed and no legal retention period applies.

7. Your rights

Under the GDPR you have the right to:

• access (Art. 15), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• lodge a complaint with a data protection supervisory authority (Art. 77), for example where you live

Because we don’t save your entries, we usually can’t link any data to you. For requests, contact TODO: contact e-mail.

8. No automated decisions

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Changes

We update this policy when the website or the law changes. The version published here applies.