Privacy policy

Controller

Christian Götze

Rathenaustr. 3, 16761 Hennigsdorf, Deutschland

Email: kontakt@wochentopf.de

No cookies

This website sets no cookies. No consent banner is required because no consent-requiring technologies are used.

Data that stays on your device

Everything you enter into Wochentopf is stored solely in your browser (IndexedDB, localStorage and sessionStorage). This data is never transmitted and the operator cannot see it. In the settings you can save it as a file, import it and delete it entirely — “Delete all data” removes every entry listed below — or through your browser settings. After the first save the site asks your browser not to discard this data even when storage runs low; nothing further is stored or transmitted by that.

This storage is strictly necessary for the app to work (§ 25 (2) no. 2 TDDDG): a weekly plan that does not remember what you planned would not be one.

• IndexedDB “wochentopf” — your weekly plans, your own dishes and the state of your shopping lists
• wochentopf-settings — household size, shown meals, eating style, preferences, restrictions, pantry list, the names and settings of extra plans, when you last downloaded a backup and which notices you have closed, and – only if you enter it voluntarily – an energy-requirement profile of sex, age, height, weight and activity (one for the main plan and one per extra plan, say for the person a plan is cooked for). That is health data within the meaning of Art. 9 GDPR; it is used solely on the device for the reference line in the week chart, never transmitted, and can be deleted in the settings at any time
• wochentopf-theme — your choice between light and dark theme
• wochentopf-shopping-filter:<calendar week> (sessionStorage) — the selection currently chosen on the shopping list (“until Wednesday”, single dishes); valid for the current session only and discarded when the tab is closed

Hosting and server log files

The site runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A processing agreement under Art. 28 GDPR is in place with Hetzner. Server location: Germany.

Every request passes through a front-end web server (Traefik) that writes an access log on the same machine. It contains: the full IP address of your connection — it is neither truncated nor anonymised at this point — date and time, the requested address including its parameters (such as the calendar week shown), the HTTP method, the status code, the amount of data transferred, the processing time, and the headers your browser sends, in particular the user agent and the referring page. Credentials and cookie headers are explicitly not written.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is secure, reliable operation and troubleshooting. The log stays on the same server in Germany and is not passed to any external service provider; the only exception is the reporting of attacker addresses described in the next section.

Storage period: the log is rotated daily and at most 30 older generations are kept, so an entry is deleted after 31 days at the latest. Further application log output is deleted after 30 days. If a specific security incident is being investigated, the entries concerned may be kept until it is resolved.

Backups: every night a backup is taken that contains the daily totals of the audience measurement (without IP addresses and without daily identifiers) and the database of the attack detection (with the IP addresses of detected attackers). It is held on a separate storage volume in the same data centre in Germany, kept for 14 days and then deleted automatically; it is restored only in the event of a fault. A record already deleted may therefore still sit in a backup for up to 14 days, and for the audience measurement up to 16 days, because it makes a copy of its database for the backup every night and keeps the last three. The server access log and the application log output are not backed up.

Defence against attacks and abuse

The same access log is evaluated automatically by the open-source security software CrowdSec on the same server. It recognises patterns such as mass login attempts or probing for known vulnerabilities, and it decides on the basis of the IP address: a conspicuous address is blocked for 96 hours, a conspicuous address range for 24 hours. This IP-based evaluation is a purpose of its own alongside providing the site.

IP addresses that attacks originate from are additionally reported to CrowdSec SAS (France) and feed a shared block list there. Only addresses that stood out as attackers are reported; ordinary use of this site is not reported.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in IT security). A block expires by itself; if you consider one unjustified, write to the address above.

Audience measurement with tally

To see how many people visit and which pages are read, this site uses tally, analytics software written by the site's operator and run on self-operated infrastructure, on a server of Hetzner Online GmbH in Germany (address t.cgoetze.de). No third-party service is involved, and the audience-measurement data is not passed on to any third party. Hetzner provides the server as a processor (see "Hosting and server log files").

When you open a page, your browser loads a small script from t.cgoetze.de and then sends a short report there, plus one more for every page change within this site. The report contains only: the short name of this site; the path of the page you opened, without parameters or anchor (for example "/impressum", never the part after "?" or "#"); the address of the site you came from, without any path (for example "https://www.google.com"), and only as far as your browser discloses it; and, only if the address you opened contains them, the campaign values "utm_source" and "utm_campaign". The script sets no cookies, stores nothing in your browser's storage, reads nothing from it and queries no features of your device, such as screen size, fonts or extensions.

As with every request, your IP address and your browser identification (user agent) reach the server along with the report. The audience measurement uses the IP address in memory only, and only for three purposes, described below: the country, the daily identifier and protection against overload. The audience measurement itself never writes the IP address, the browser identification or the daily identifier to disk and never logs them; for the server's access log, see below.

The country is determined from the IP address with a country database ("IP to Country Lite" by DB-IP) that is kept as a file on the same server. No request goes to DB-IP or any other third party in the process, and only the country is derived, neither region nor town.

From the IP address, the browser identification and the site's short name, the audience measurement forms a daily identifier. This identifier is a keyed hash, built with a secret random value; the random value exists only in memory and is replaced by a new one every night when the day changes (midnight German time) and whenever the service restarts. Through this identifier, a visit therefore cannot be linked to a visit on another day, and without the random value, which never leaves memory, the identifier does not lead back to your IP address. The daily identifier serves only to avoid counting you twice within a day, whether for the whole site or for a single page, to tell which page views belong to the same visit (a visit ends after 30 minutes without a page view), and to show the number of visitors in the last five minutes, a number that is never stored. For this, the audience measurement holds in memory the daily identifier, the time of your last page view, the number of page views in the current visit and, for each page you open, a further keyed hash of the daily identifier and the page; all of it is discarded together with the random value.

To protect the service against overload, it accepts on average no more than 120 reports per minute per internet connection. This limit, too, works in memory only and only with a keyed hash of the IP address (for IPv6 addresses, of their front part, which identifies the connection), formed with the same random value and discarded with it, never with the address itself.

The browser identification is reduced to coarse classes (browser family such as Firefox, operating-system family such as Android, and device type: computer, smartphone or tablet) and checked for whether a program rather than a person is making the request; reports from such programs are discarded. Of the previous page's address only the domain name remains (for example "google.com"); if it is this site itself, it is discarded entirely.

Only daily totals are stored: for the whole site, the number of page views, visitors, visits and visits with a single page, plus breakdowns by page, entry page, referring domain, kind of origin (direct, search engine, social network, other website, campaign), campaign value, country, browser family, operating-system family and device type. Parts of a page address that look like an automatically generated identifier (such as a long string of digits and letters) are replaced by a placeholder before counting. There are no individual records, no row per visitor, no IP addresses, no daily identifiers and no times of day; the smallest unit is the calendar day. Someone who comes on two days therefore counts as two visitors: the audience measurement forms no identifier that lasts beyond the day. On days with very few visits, however, a daily total can describe a single visit; someone who knows that you were here on that day could, for example, read from it which pages you opened.

If your browser sends "Do Not Track" or "Global Privacy Control", the script sends no report (it is still loaded; see the access log below); should a report with one of these signals arrive anyway, the server discards it. In local development and on hosts other than the production addresses, the script is not loaded.

Not every browser offers these signals. You can also switch the measurement off by blocking the address t.cgoetze.de, for example with a content or ad blocker; the site keeps working unchanged.

Right to object: you may object to the audience measurement at any time under Art. 21(1) GDPR, informally, by email or by post to the contact details given in the imprint. Because the audience measurement forms no identifier that lasts beyond the day, an objection cannot be recorded for your browser; the measurement is reliably switched off by the signals mentioned above or by blocking t.cgoetze.de. The daily totals already stored contain no identifier, so it cannot be determined which figures stem from your visits (Art. 11 GDPR).

Loading the script and each report are ordinary requests to this server and therefore appear in the server's access log like any other request, with IP address, browser identification and time (see "Hosting and server log files"). In these entries the referring page is only this site's address, without a path, and the path of the page you opened does not appear.

Storage period: the audience measurement uses the IP address and the browser identification only while it processes a report. The daily identifier, the hashes and the time of the last page view are discarded when the day changes, a few seconds after midnight at the latest. The breakdowns (by page, entry page, referring domain, kind of origin, campaign value, country, browser family, operating-system family and device type) are deleted after 25 months: every day, all entries for a day more than 25 months back are removed. The daily totals for the whole site (page views, visitors, visits and visits with a single page) are kept for as long as the site is operated, so that its use can be compared over the years; if the site is discontinued, they are deleted too. These totals contain nothing about pages, origin, country or device. The entries in the server's access log (IP address, browser identification, time, this site's address) are deleted after 31 days at the latest; only entries needed to investigate a specific security incident may be kept longer, until it is resolved.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly statistics on the use of the site and in protecting this measurement against overload and distortion; for the access log, the legitimate interest in secure and trouble-free operation, see "Hosting and server log files"). No consent under § 25(1) TDDDG is asked for, because it is not considered necessary here: the script stores nothing on your device. It reads only what your browser transmits with the page request anyway (the address requested, the previous page and, where set, the "Do Not Track" and "Global Privacy Control" signals); apart from that, it checks whether the page is being preloaded in the background, so that it is counted once you actually open it. That information does not leave your device.

Until 21 October 2026, Matomo was used for audience measurement. From the data recorded with it, daily totals and breakdowns of the kind described above, covering up to twelve months before the switch, were transferred to tally (no IP addresses, no visitor identifiers and no individual visits). Since then, the storage periods above apply to the transferred figures. This departs from the earlier statement that after twelve months only monthly and yearly figures of the daily reports would have been kept; the figures were transferred so that the statistics stay comparable across the switch. The Matomo data itself was deleted on 30 October 2026 at the latest: the individual visits with truncated IP address, daily changing visitor identifier, time, pages viewed with their address and title, approximate location, browser and device type, language setting, referring domain and campaign values; the recorded clicks on outbound links and downloads; and the reports derived from them. Backup copies that still contain it will be deleted by 14 November 2026 at the latest. Older copies of this site still cached in a browser may go on sending reports to the former Matomo address (matomo.cgoetze.de) for a while; they are discarded there unevaluated and appear only in the server's logs (see "Hosting and server log files").

Technical usage counters

To keep an eye on operations the server counts anonymous, content-free events — such as how often a week was rolled or a list printed. These counters contain no personal data, no IP addresses and nothing about any individual’s dishes or plans. “Do Not Track” is respected here too.

The report itself is an ordinary request to this server and therefore appears in the access log like any other (see “Hosting and server log files”). Legal basis: Art. 6(1)(f) GDPR.

Contacting us and the contact form

If you write to kontakt@wochentopf.de or use the contact form, the information you provide is processed in order to handle your enquiry (Art. 6(1)(f) GDPR — legitimate interest in answering enquiries). Via the form that is your name, your email address and the text of your message. Messages are deleted once they are no longer needed, and at the latest six months after the enquiry has been dealt with.

Delivery: messages from the contact form are delivered via the email service rapidmail GmbH (Augustinerplatz 2, 79098 Freiburg im Breisgau, Germany), acting as a processor, and arrive in a mailbox operated by Proton AG (Geneva, Switzerland). Switzerland is covered by an adequacy decision of the EU Commission (Art. 45 GDPR). No further transfer to third countries outside the EEA takes place.

Spam protection (ALTCHA): so that the form cannot be abused by machines, your browser solves a small computation in the background (proof of work). The software for this runs on the same server as this site. No cookies are set, no data is passed to third parties, and nothing is stored on or read from your device.

Your weekly plan and your recipes reach none of these providers — they stay exclusively in your browser. No newsletter is sent.

Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You also have the right to lodge a complaint with a supervisory authority.

Because your data is stored only locally, the operator generally holds no data about an individual that could be the subject of an access request.