Privacy
This notice covers bookpress.io, the site you are reading. The public demonstration at trybookpress.dev is a different machine that processes different things and has its own notice.
Who is responsible
The controller within the meaning of Art. 4(7) GDPR is:
| Name | TO BE SUPPLIED — the operator's full legal name |
|---|---|
| Address | TO BE SUPPLIED — a postal address |
| hello@bookpress.io |
We have not appointed a data protection officer; the thresholds in § 38 BDSG are not met. Questions about this notice go to the address above.
When you load a page
The site is a set of static files served by Uberspace (Uberspace.de, Germany), which keeps ordinary web-server logs: the IP address the request came from, the time, the page requested, the response status and size, and the browser's user-agent and referrer string. This happens for every website and is what makes it possible to run one and to investigate an attack on it.
- Why: to deliver the site and to keep it available and secure.
- Legal basis: our legitimate interest in operating and securing our own systems, Art. 6(1)(f) GDPR.
- Where: on servers in Germany. No transfer outside the EU is involved in serving the page itself.
- How long: for the period our host retains its logs. We do not analyse them and we build no profile from them.
Analytics, and only if you say yes
We use Google Analytics 4 to count visits. It is switched off until you accept it, and the site works exactly the same if you never do.
Concretely: Google Consent Mode is initialised with every storage type denied before the Google tag is loaded, so nothing is stored on your device and no analytics identifier is created unless and until you press Accept. If your browser sends a Do Not Track signal we record a refusal for you and never ask. IP anonymisation is enabled.
- Why: to see how many people read which page, so we can write better ones.
- Legal basis: your consent, Art. 6(1)(a) GDPR, and § 25(1) TDDDG for the storage on your device. You can withdraw it at any time — see below — and withdrawal does not affect processing that already happened.
- Recipient: Google Ireland Limited, and Google LLC in the United States. Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission found to provide an adequate level of protection in its decision of 10 July 2023; that decision is the basis for the transfer under Art. 45 GDPR.
- How long: per Google's retention setting for the property. We do not receive or store the raw data ourselves.
What is stored on your device
We set no cookies of our own. Three things may be written to your browser's local storage:
| Key | What it is for | Consent needed? |
|---|---|---|
| bp-theme | Remembers whether you chose the light or dark appearance. | No — it exists only because you clicked the toggle asking for it (§ 25(2) Nr. 2 TDDDG). |
| bp-consent | Remembers your answer to the analytics question, so you are not asked again. | No — storing a refusal is what makes the refusal work. |
| Google Analytics storage | An identifier that lets Google count you as one visitor rather than several. | Yes — written only after you accept. |
Changing your mind
Clearing this site's data in your browser (or just its local storage)
deletes bp-consent, after which the question is asked again and
nothing is loaded until you answer it. There is no account to close and no
list to be removed from.
If you email us
If you write to us, we keep the message and your address for as long as it takes to deal with what you wrote about, and afterwards for as long as any retention obligation requires. The legal basis is Art. 6(1)(b) GDPR where the message concerns a contract or steps before one, and Art. 6(1)(f) otherwise — our legitimate interest in answering our post.
Your rights
You have the right to obtain confirmation of whether we process personal data about you and to access it (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you may withdraw it at any time (Art. 7(3)).
You may also complain to a supervisory authority (Art. 77 GDPR). In Germany that is the authority for the federal state in which the controller is established, or the one where you live.
Changes
If we change what this site does, this notice changes with it. It carries no date because it is published from a version-controlled file and its history is the record.