1. Data controller
Maximilian Kirschberg (Spanish tax ID 79112292C), who signs on the site under the alias "Kraslich", operating from Fuengirola (Málaga), Spain. Email: [email protected].
There is no Data Protection Officer because the thresholds that require one are not met: the controller handles privacy questions directly.
2. What data we process
If you browse without an account: server logs (IP address, browser, requested page and referrer) and, to stop abuse of the forms, an encrypted fingerprint of the IP that cannot be turned back into it.
If you create an account: username, email, password (stored with scrypt: never in plain text), sign-up and last-login dates, and what you save or publish: favourites, collections, profiles you follow, comments and ratings, resource submissions and your notifications.
If you add a picture, a banner or a bio: the image you upload (we shrink it and store it without the hidden data photos carry, such as location) or the one you pick from ours, and your bio text. It is public: anyone who opens your profile sees it, and your picture also shows next to your comments.
If you write to us or report something: your name, your email and the text of the message or report.
3. Purposes & legal basis
Running your account (login, favourites, comments, submissions, notifications): performance of the terms you accept when signing up (Art. 6.1.b GDPR).
Answering messages and reports, moderating content and keeping the site secure: legitimate interest (Art. 6.1.f GDPR).
Aggregated visit statistics without cookies: legitimate interest (Art. 6.1.f GDPR), with processing that identifies no one.
We only send two kinds of email: account confirmation and password reset. No advertising.
4. How long
Server logs: 14 days. IP fingerprint for rate limiting: 1 day. Sessions: up to 30 days. Confirmation links: 48 hours; password reset links: 1 hour.
Account and content: while the account exists. If you ask us to delete it, your sessions, favourites, collections, follows, comments, notifications and submissions are deleted with it.
Picture, banner and bio: until you remove them or delete the account. When you remove them they are deleted from our server.
Messages and reports: as long as needed to handle them and at most one year.
5. Who else sees them
We do not sell or share data with anyone. The site is served through Cloudflare (proxy and protection), which sees each visit's IP address; Cloudflare applies the European Commission's standard contractual clauses to transfers outside the EEA. Everything else (database, email and statistics) runs on our own server.
Only what you publish is public: your username, sign-up date, picture, banner and bio (if you add them), comments and ratings, and approved resources. Your email is never shown.
6. Statistics (Umami)
We count visits with Umami, installed on our own server (it is not a third-party service). It uses no cookies, stores nothing on your device, does not store your IP and respects the "Do Not Track" signal. It records the page viewed and a few clicks (download, open source, search), always without personal data.
You can turn it off on the cookie policy.
7. Your rights
You can request access, rectification, erasure, objection, restriction and portability of your data by writing to [email protected] from your account email. We reply within one month at most.
If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).
8. Minors
You must be at least 14 to create an account (Art. 7 of Spain's LOPDGDD).