🔒 Privacy Policy

Privacy Policy (pursuant to GDPR & Austrian DSG)

#### 1. Data Controller

The controller within the meaning of the General Data Protection Regulation (Art. 4 point 7 GDPR) is the private operator specified in the Legal Notice (Part 1).

#### 2. Data Minimization, Profile Details & Encryption Status

No Master Data: No real names, precise residential addresses, telephone numbers, or official identification documents are collected.

Pseudonymous Account & Optional Regional Information: The user account is based exclusively on the chosen nickname and the hashed password (plus optional cryptographic 2FA tokens). Users may provide approximate regional orientation data on a purely voluntary basis: a country (country code) and a postal code (ZIP) (maximum 10 alphanumeric characters). No collection of street names, house numbers, or exact geo-coordinates takes place.

Encryption Status: Data transit can be transport-encrypted via HTTPS. Permanent storage of content data (titles, texts, attributes, images, direct messages) in the database occurs unencrypted in order to facilitate directory and messaging features. End-to-end encryption does not take place.

#### 3. Local Provisioning (No External CDNs or Google Fonts)

All fonts, scripts, and symbols (UTF-8 icons) are served locally from our server or by the user's operating system. No transmission of IP addresses to external Content Delivery Networks or US font services occurs upon page load.

#### 4. Image Metadata Sanitization (Two-Tier Protection)

To safeguard privacy, image files are protected through a two-tier process prior to storage: embedded metadata (in particular EXIF, camera, and GPS location data) are stripped locally within the browser or mobile app before transmission. On the server, renewed validation as well as scaling to under 0.5 MB file size takes place.

#### 5. WAF Security Logging & Cooldown (Art. 6(1)(f) GDPR)

To ensure system security, fend off attacks (DoS/DDoS), prevent message spam, and enforce temporary cooldown blocks, our WAF on the server in Germany ephemerally processes connection data (`waf_logs`: IP addresses, header information, timestamps). This processing is carried out on the basis of our overriding legitimate interest in securing our service pursuant to Art. 6(1)(f) GDPR.

#### 6. Cookies & Local App Storage (No Cookie Banner Required)

The platform uses exclusively strictly necessary storage methods to deliver the core functionalities expressly requested by the user (§ 165 para. 3 Austrian Telecommunications Act / TKG 2021):

Web Portal (First-Party Cookies):

`PHPSESSID`: Temporary session cookie to maintain the login session (expires when the browser is closed).

`language`: Stores the chosen display language.

`theme`: Stores display preferences (e.g., dark mode / light mode).

`view_mode`: Stores preferred layout and sorting views (e.g., grid or list view).

Android Application (APK):

The mobile application stores authentication tokens and local display settings (language, theme) exclusively in the device's local storage (`shared_preferences`).

No tracking, profiling, or advertising services and no third-party SDKs are utilized. A cookie consent banner is therefore legally not required.

#### 7. Account Deletion, Retention of Messages & Nickname Quarantine

Immediate Profile and Content Deletion: If an account is deleted by the user or the operator, the profile, profile picture, optional postal code information, watchlist, and all submitted catalog content are immediately and irrevocably deleted from the database.

Retention of Direct Messages ("Deleted User"): In order to maintain conversation integrity for active chat partners, direct messages sent by the deleted user remain in the mailbox of the respective recipient, provided they were not recalled within the 2-minute time window. The sender is permanently anonymized and displayed solely as "Deleted User" without a profile picture or link. As soon as the conversation partner also deletes the conversation or closes their account, the message thread is permanently expunged from the database.

Nickname Quarantine (90 Days): To prevent identity theft and protect legitimate security interests (Art. 6(1)(f) GDPR), the nickname of a deleted user is retained in an isolated blocklist (`reserved_nicknames`) for a duration of 90 days to block immediate re-registration by third parties. Following expiration of this period, the entry is permanently purged.

No Backup Archives: Since the platform maintains no data backups or recovery archives, reconstruction of deleted data after removal is technically impossible.

#### 8. No Data Disclosure

Data is neither sold nor disclosed to third parties without authorization. Transmission to law enforcement or supervisory authorities occurs exclusively in the presence of a binding judicial or regulatory order within the framework of legal obligations.

#### 9. Data Subject Rights Under GDPR

Users are entitled to the following rights under Articles 15 to 22 GDPR:

Right to Data Portability (Art. 20 GDPR): Self-service download of posted content via ZIP export is possible at any time (pure account master data such as nickname, profile picture, and postal code are excluded).

Right to Erasure (Art. 17 GDPR): Immediate and complete self-deletion via account settings ("Danger Zone").

Right of Access & Right to Lodge a Complaint: For questions regarding pseudonymous data processing, sending a message to the support address is sufficient. Furthermore, you have the right to lodge a complaint with the competent supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna (dsb@dsb.gv.at).