Privacy Policy

1. Data Controller

Responsible party within the meaning of the GDPR:
André Weiers, Stresemannstraße 86, 22769 Hamburg, Germany
Email: boomnodes@raumtaucher.de

2. Data We Process

When you visit this website, technical access logs are processed by our web infrastructure. During beta registration and account usage, we process account and feedback data that you submit, including email address, display name, password hash, verification state, and feedback content.

When you use the in-app Beta Test Center, we store the test status, an optional duration, and any notes you submit, linked to your account, solely to evaluate the closed beta.

We also process security-related metadata required to protect the service against abuse (for example request timestamps, rate-limit events, and security checks).

3. Cookies and Security Controls

We use technically required cookies for authentication and security:

• __Host-session (required): keeps you signed in after successful login.
• __Host-csrf (required): protects state-changing requests against CSRF attacks.

We use Cloudflare Turnstile as a bot-protection control for sign-up security. We do not use advertising trackers or analytics profiles for marketing purposes.

4. Legal Bases (GDPR)

• Art. 6 para. 1 lit. b GDPR: account creation, login, and beta feedback functionality.
• Art. 6 para. 1 lit. f GDPR: service security, abuse prevention, and platform integrity.
• Art. 6 para. 1 lit. c GDPR: statutory retention and compliance obligations (where applicable).

5. Service Providers (Processors)

To operate this service, data can be processed by selected providers strictly as needed:

• IONOS SE (hosting infrastructure, Germany/EU).
• Cloudflare (DNS/reverse proxy and Turnstile bot protection).
• Brevo (transactional email delivery, e.g. verification emails).
• Gitea (feedback issue tracking used for product triage).

Data processing agreements and technical safeguards are maintained where required.

6. Storage and Deletion

We store personal data only for as long as necessary for beta operations, security, and legal duties. You can request deletion at any time. If your account is deleted, account-linked data is removed unless legal obligations require temporary retention.

7. Your Rights

You have the right to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)

To exercise your rights, please contact: the data controller via email.

You also have the right to lodge a complaint with the competent data protection authority: The Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit).

8. Changes

We reserve the right to update this privacy policy as needed. Last updated: May 2026.