Privacy Policy

Hosting, server logs and firewall

When you open the website, our host processes technically necessary data, including your IP address, date and time, the requested page and your browser type. This is needed to deliver the site and protect it from abuse. To protect against abuse, such as brute-force attempts at sign-in, our host's firewall records suspicious requests together with the IP address. We write searches without results to the server logs without an IP address so we can spot missing yarns.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation and protection against abuse)

Mein Maschenhub account

If you create an account, we store your email address, your password (as a hash only), technical session data, the yarns in your stash and the yarns you mark as favourites. If you sign in with Google, we receive your email address and name from Google. We send confirmation and reset codes by email.

Legal basis: Art. 6(1)(b) GDPR (providing your account)

Maps (shop finder, price comparison)

When you view a map, your browser loads the map tiles directly from OpenStreetMap's servers. OpenStreetMap receives your IP address in the process. If you use "Locate me", your browser asks for your location. We use it only in your browser to centre the map and do not send it to us.

Legal basis: Art. 6(1)(f) GDPR (displaying the map); location only with your consent in the browser

Feedback and ratings

If you send us feedback, we store your message, the page you came from and, if you provide it, your email address. To prevent abuse we use a daily-rotating, pseudonymised hash of IP address and browser. We store the hash with the feedback, but not the IP address itself. For "Was this page helpful?" we store your vote, the page, an anonymous, signed visitor ID (cookie) and a hash of IP address and browser (the calculation changes every 15 minutes) to prevent repeat votes.

Legal basis: Art. 6(1)(f) GDPR (improving the service); the email address is optional

Enquiries from yarn shops (Garn Radar)

Via the enquiry form we store what you enter: email address, optionally name, shop, website, message, interest, purpose, buying intent and quantity. We use it to reply to you.

Legal basis: Art. 6(1)(b) or (f) GDPR (handling your enquiry)

MongoDB Atlas (MongoDB, Inc.)

Database: accounts, stash, feedback, enquiries

Vercel Inc.

Hosting and delivery of the website, server logs

Brevo (Sendinblue SAS, France)

Sending confirmation and reset codes by email

Hetzner Online GmbH

Server for the self-hosted analytics (Umami)

Google

If you sign in with Google, Google processes your data under its own responsibility. Google's privacy policy applies. We only receive your email address and name.

OpenStreetMap Foundation

Your browser loads map tiles from OpenStreetMap. The OpenStreetMap Foundation (United Kingdom) processes your IP address under its own responsibility. Its privacy policy applies.

Rights under the GDPR

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20). You can withdraw consent at any time with effect for the future. Just write to the address below.

Complaint to the supervisory authority

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wiesbaden.

Withdraw consent

You can withdraw your cookie consent at any time. Necessary cookies cannot be disabled.

Consent expiry

Your consent is valid for 180 days. After that we ask you again.

Effect of withdrawal

After you withdraw, we set no further cookies that need consent. The core functions of the website remain available.

Controller

Tower Ventures UG (haftungsbeschränkt), Habichtweg 31, 65719 Hofheim am Taunus (Amtsgericht Frankfurt am Main, HRB 142449), represented by the managing director Francesco La Torre. Email: info@maschenhub.de.

What data we process

• Invitation: the email address the invitation was sent to, with its status and validity.
• Account: email address, name (from your Google profile if you sign in with Google), whether the address is confirmed, and how you sign in. With email and password we store your password only as a hash, never in plain text. With Google we store your Google ID; we do not take over your profile picture.
• Your content: the yarns in your stash (catalogue link or your own details such as name, colour, quantity, dye lot and note) and your favourite yarns.
• Session: a sign-in token with an expiry time and technical details such as IP address and browser identifier.
• Verification and reset codes: a code is stored only as a hash, together with the email address it is valid for.
• Abuse protection: counters of how often an IP address called certain sign-in functions, and a counter per email address stored only as a keyed hash.
• Deletion receipt: when you delete your account, a pseudonymous receipt remains, without email address and without content (ID, timestamps, number of deleted entries).
• Usage measurement: simple events such as “yarn added to stash”, “signed in” or “export”. They contain no yarn names, quantities, IDs or email addresses.

Why and on what legal basis

• Account, stash, favourites, sign-in and codes by email, so you can use the service: Art. 6(1)(b) GDPR (contract of use).
• Session and abuse protection, so nobody gains access to other accounts and the service stays stable: Art. 6(1)(f) GDPR (legitimate interest in security). The session cookie is technically necessary.
• Keeping the deletion receipt and proof of the invitation: Art. 6(1)(f) GDPR (proof that we carried out deletions).

Recipients

We do not pass on your data to market it. To run the service we use providers:

• Vercel (website hosting) and MongoDB Atlas (database).
• Brevo (sending verification and reset emails). The emails contain only the code, no link.
• Google, if you sign in with Google. Google may transfer data to the USA; details are in Google’s privacy policy.
• Our self-hosted Umami instance for usage measurement (see above).

Cookies

For sign-in we set a session cookie (better-auth.session_token, with the prefix __Secure- in production). It is HttpOnly, lasts at most 7 days and is extended while you are active. It is technically necessary and used only for signing in.

Retention and deletion

We keep your account data as long as your account exists. You can delete your account in the account area at any time. From your deletion request your access is blocked; afterwards we remove stash, favourites, invitation, sign-in data, sessions, codes and your account in several steps.

We keep the deletion receipt for 12 months after completion; it contains neither your email address nor your content. Sessions expire after 7 days without activity at the latest, codes after 10 minutes.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). In the account area you can export your data as a JSON file and delete your account. For anything else write to info@maschenhub.de.

You can also complain to a data protection authority, for example the Hessian Commissioner for Data Protection and Freedom of Information (Wiesbaden).

Providing your data is required for an account. Without it we cannot provide you with one.