Pravila privatnosti

This is a translation. In case of conflict, the German version prevails.

Privacy made simple – the 10 most important points

1. Who is responsible? Niklas Bergmann from Neustrelitz. We are not a company but a private individual. Contact: kontakt@bestmcserverlist.net.
2. You can vote without an account. All we need for that is your Minecraft name.
3. Your Minecraft name is sent to the server you vote for. That is the only way it can give you your reward. What the server does with it after that is up to its owner.
4. We use your IP address so that nobody cheats (1 vote per server per day). We never store it in plain text, only as a scrambled check value, and delete that after 48 hours. Server owners never see it.
5. Votes are public: Every server page shows the most recent Minecraft names that voted. Each name has a profile page with votes and streaks, showing days only, never times. We hide a profile on request.
6. You only need an account if you want to add a server. For that, we store your email address, your username and your password, but only in unreadable form (as a hash). If you sign in with Google, Google only gives us your name, email address and profile picture address. We then store no password at all.
7. No ads, no tracking, no cookies that spy on you. We do not use third-party analytics services like Google Analytics. We count page views with our own cookie-free statistics on our own server (section 3b). We only set one cookie ourselves, and it remembers your language. Our protection service Cloudflare may set a security cookie when it sees suspicious traffic (section 3a).
8. Your data is stored on our own server in the EU (at OVH), including sending emails. To protect against attacks, visits to the website pass through Cloudflare (section 3a). There are no marketing emails. You only get a daily vote reminder if you switch it on yourself, and you can unsubscribe with one click.
9. You can ask us at any time what we know about you and have everything deleted. You can delete your account yourself.
10. If something bothers you, write to us. You are also allowed to complain to the data protection authority.

Everything is explained in detail below.

1. Controller

Niklas Mario Bergmann
Friedrich-Ludwig-Jahn-Straße 14
17235 Neustrelitz, Germany
Email: kontakt@bestmcserverlist.net

We have not appointed a data protection officer because there is no legal obligation to do so (Art. 37 GDPR, § 38 BDSG (German Federal Data Protection Act)).

2. Overview: which data, for what, for how long

3. Visiting the website (server logs)

Each time you visit, your browser transmits technically necessary data to our server. We store the IP address, date and time, the requested address, the status code, the amount of data transferred, the previously visited page (referrer) and the browser identifier (user agent).

We need these logs to deliver the site, find errors and fend off attacks. This is our legitimate interest under Art. 6(1)(f) GDPR. The logs are deleted automatically after 14 days. We only keep individual entries longer if they belong to a specific security incident, and only until it has been resolved.

3a. Delivery through Cloudflare (protection and availability)

So that our website stays reachable during attacks and traffic peaks, all visits pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Your browser first connects to a Cloudflare data centre, usually close to you. Cloudflare forwards the request, encrypted, to our server and sends the response back to you. Cloudflare may cache frequently used files such as images, fonts and program code and deliver them directly. Pages with personal data, the login and all data from our database are not cached.

In doing so, Cloudflare processes the data that comes with every visit (section 3): your IP address, the requested address, date and time, the browser identifier and other technical details of the request. Because the connection is decrypted and re-encrypted at Cloudflare, Cloudflare could technically also see the content of the request; it may only use it for delivery and protection. If Cloudflare detects suspicious traffic, such as an attack, it may show a short check and set a security cookie (for example __cf_bm or cf_clearance, valid for 30 minutes up to a few hours). These cookies only serve to tell real visitors from attacks and are strictly necessary for that (§ 25(2) No. 2 TDDDG). Cloudflare does not do advertising or analysis of your behaviour for us.

The legal basis is Art. 6(1)(f) GDPR, our interest in a secure and reliably reachable website. Cloudflare acts as our processor (Art. 28 GDPR); the agreement for this is part of Cloudflare's terms. Cloudflare has data centres worldwide, so data may also be transferred to the USA. For this, Cloudflare is certified under the EU-US Data Privacy Framework. Cloudflare keeps the request data only briefly for security and troubleshooting. More: https://www.cloudflare.com/privacypolicy/

Our own server logs (section 3) still contain your real IP address, because Cloudflare passes it on to us.

3b. Page view statistics

We count which pages are viewed, so that we can see what is used and what is not. For this we use GoatCounter, software that we run ourselves on our own server. There is no external provider, and the data does not leave our server.

What is counted: the page viewed (without parameters after the question mark), the page title, the size of your browser window, on the first visit the domain of the site you came from (the domain only, not the exact address), browser, operating system and the country. GoatCounter works out the country from your IP address. The IP address itself is not stored in the statistics. So that several page views by one person do not count as several visitors, GoatCounter forms a short-lived number from the IP address and the browser identifier, from which neither can be recovered.

What does not happen: no cookies are set and nothing is stored on your device. Areas with your account (sign-in, account, dashboard, admin) and the pages for editing a listing are not counted. If your browser sends “Do Not Track” or “Global Privacy Control”, we do not count your visit. We do not pass the statistics on to third parties.

The legal basis is Art. 6(1)(f) GDPR, our interest in understanding how the website is used and improving it. GoatCounter deletes the data after 12 months. You can object to the counting at any time: switch on “Do Not Track” in your browser or write to us (section 12).

4. Voting (votes)

What we collect: When you vote for a server, you enter your Minecraft name. We store the name, the server and the time. Your browser also solves a small computing puzzle that makes automated mass voting harder (proof of work). Nothing about you is stored in the process.

Protection against multiple votes: One vote per server is allowed every 24 hours, per Minecraft name and per internet connection. To enforce this, we use a secret key to create a check value (HMAC) from your IP address. We do not store the IP address itself. The check value is deleted after 48 hours.

Publicly visible: On every server page we show the most recently cast votes with Minecraft name and time. We count the votes for the ranking.

Passing data to the server: If the server owner has set up a Votifier connection or our plugin, we send your Minecraft name, the time and the name of our list to their game server. This lets them give you a reward in the game. We do not send your IP address. The server owner is solely responsible for everything that happens with your name after that. They can run their server anywhere in the world, including outside the EU. For servers outside the EU there is usually no adequacy decision. In that case, the transfer is permitted because it is necessary for the service you request with your vote, namely forwarding it to exactly this server (Art. 49(1)(b) GDPR). Whether a server gives rewards is stated on its page.

Legal basis: Our legitimate interest and your interest in a fair ranking and in the reward (Art. 6(1)(f) GDPR). Insofar as voting establishes a usage relationship with you, additionally Art. 6(1)(b) GDPR.

Retention period: After 90 days we replace the Minecraft name with a placeholder. After that, only the anonymous count remains for statistics.

We do not check whether a Minecraft name really belongs to you. If someone voted using your name and you do not want that, write to us.

4a. Player profiles and the vote chest

For every Minecraft name that has been used to vote, we show a public profile page (/player/Name). It shows the number of votes, the servers supported, the streak (days in a row), a calendar of the last 26 weeks and the items from the vote chest. The calendar shows days only, never times. The items are cosmetic titles and frames. Which item drops is calculated from the name, the server and the day. We store nothing extra for this.

Everything comes from the votes in section 4. Because anyone can type any name, a profile is no proof of who voted. The page says so as well.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to show players their support and to make the ranking traceable.

Hiding a profile: You can object at any time (Art. 21 GDPR). We then hide the profile for a name, and you do not have to give a reason. An email to kontakt@bestmcserverlist.net is enough. Once we replace a name in the votes after 90 days (section 4), those votes also disappear from the profile.

4b. Minecraft skins

When you enter a Minecraft name while voting or in our tools, our server fetches the matching skin from Mojang (Mojang AB, Söder Mälarstrand 43, 118 25 Stockholm, Sweden). This lets us show the real head instead of a placeholder. Mojang only learns the name, not your IP address. We keep the skin in a short-lived cache only. The legal basis is Art. 6(1)(f) GDPR.

5. User account

You only need an account to add and manage servers. We store your email address, your username, your password as a bcrypt hash (we do not know it), the time of registration and of your last login. If you sign in with Google or Apple, we store no password (sections 5a and 5c). We also remember whether you use the site in German or English so that our emails reach you in your language. For logged-in sessions, our login system stores the IP address and the browser identifier so that we can detect abuse. We log security-relevant actions such as logins or password changes for 90 days.

We need your email address to send you confirmations, password links and important notices about your account and your listing (section 8). We do not send newsletters or advertising.

Only what you write in your server listing is publicly visible. We never show your email address publicly.

Legal basis: Art. 6(1)(b) GDPR, the usage agreement under our Terms of Use. You cannot create an account without an email address.

Deletion: You can delete your account yourself at any time (Dashboard → Delete account). We then delete your account, your server listings, your banners and all votes for your servers. Data remains in backups for at most 30 days.

Minimum age: You may create an account from the age of 16. If you are 13 to 15 years old, you need your parents' permission. No account is allowed under the age of 13. If we find out that an account was created without the necessary permission, we delete it.

5a. Sign-in with Google

Instead of an email address and password, you can register and sign in with your Google account. When you click "Continue with Google", we send you to Google. There you sign in and allow Google to send us the following: your name, your email address, whether Google has confirmed the email address, the address of your profile picture and a Google identifier for your account. We get nothing more, in particular no contacts, no emails and not your Google password.

We use this data to create your account and to recognise you each time you sign in. We create your username from your name at Google or from your email address. We do not show the profile picture. We store no password for Google accounts. You accept the Terms of Use and state your age right after your first sign-in. Until then you cannot add a server.

Legal basis: Art. 6(1)(b) GDPR, because you choose this way of signing in.

Google: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google is itself responsible for what happens when you sign in at Google. Google learns that you are signing in to BestMCServerList. This may involve transfers to Google LLC in the USA; the basis is the adequacy decision on the EU-US Data Privacy Framework (see section 8). More information is in Google's privacy policy. You can remove the connection to our site at any time in your Google account under "Third-party apps and services". You delete your account with us as described in section 5.

5b. Vote reminder by email

On your account page you can switch on a vote reminder. It is off by default and only runs with your express consent. For it, you enter the Minecraft name you vote with. We then send you at most one email a day, not before 7 a.m. (German time), for the servers you have voted for in the last 30 days and not yet today. The email contains your own statistics for these servers: total votes and votes this month, your streak, your longest streak and your rank among the server's voters this month. We calculate these figures from the votes in section 4.

What we store: your Minecraft name, the time and version of your consent, where applicable the time of withdrawal, and the day of the last reminder. The email address comes from your account.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 7(2) No. 2 UWG (German Act against Unfair Competition)).

Withdrawal: You can withdraw your consent at any time, without giving a reason and without any disadvantage. Every reminder contains an unsubscribe link that works with one click and without signing in. You can also switch it off on your account page. After that we send no more reminders. We keep the time of consent and withdrawal as proof (Art. 7(1) GDPR) until you delete your account. We then also delete the Minecraft name.

5c. Sign in with Apple and the iPhone app

Our iPhone app (BestMCServerList on the App Store) uses the same interfaces as the website, and this privacy policy applies to it in the same way. The app contains no ads, no tracking and no components from other providers. Favourites, hidden servers, recently searched players and drafts in the tools stay on your device only. The app keeps your sign-in in the device's keychain.

In the app you can also sign in with your Apple ID ("Sign in with Apple"). Apple then sends us an Apple identifier for your account and your email address. If you choose "Hide My Email" at Apple, this is a random forwarding address from Apple (…@privaterelay.appleid.com) through which our emails reach you. The first time, Apple may also send your name. We do not store it; we only use it to suggest a username, which you can change. We store no password for Apple accounts. You accept the Terms of Use and state your age right after your first sign-in.

Legal basis: Art. 6(1)(b) GDPR, because you choose this way of signing in.

Apple: The provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple is itself responsible for what happens when you sign in with Apple; see Apple's privacy policy. You can remove the connection at any time in your iPhone's settings under "Apple Account" → "Sign in with Apple". You delete your account with us as described in section 5, in the app under Account → Delete account.

6. Server listings and server status

Whatever you write or upload in a server listing, we publish. This includes the name, address, texts, banner, website, Discord link, languages and country. This is the service you use with us (Art. 6(1)(b) GDPR). We never show the Votifier credentials or your API key publicly.

Our server regularly queries all listed Minecraft servers (status ping). This tells us whether the server is reachable, and we read out the version, player count, description (MOTD) and server icon. The server itself publishes this information to anyone who queries it. We do not store or show the names of individual players that some servers include. For an internal check for faked player counts we only store figures about this list: how many entries it has, how many of them look like Minecraft names, and a short check value that shows us whether the list changes. No names can be recovered from the check value. Only administrators see the result of this check; it does not lead to any action automatically. We delete measurements after 30 days. The legal basis is our legitimate interest in showing up-to-date and honest status information (Art. 6(1)(f) GDPR).

Status checker and Votifier tester: With these tools you can query any Minecraft server or send a test vote to a Votifier port without an account. The address you enter goes to our server, which contacts the Minecraft server itself; the queried server only sees the address of our server, not yours. With the Votifier tester you also send the token or public key of your server. We use it only for this one test vote (always for the player name "TestVote") and do not store it. We keep results of the status checker in memory for one minute so the same address is not queried again and again. To keep the tools from being misused to scan other networks, we limit the number of requests. For this we store, for 24 hours, the requested address and a check value of your IP address formed with a secret key (HMAC), not the IP address itself. The legal basis is our legitimate interest in offering these tools and protecting them from misuse (Art. 6(1)(f) GDPR).

Gallery and trailer: Owners can upload up to eight screenshots and link a YouTube trailer. We scale uploaded pictures down on our server and save them again, removing all metadata such as camera data or location (EXIF). The original is deleted immediately. An administrator reviews new pictures and trailers before they appear publicly. Of the trailer we only store the ID of the YouTube video. The legal basis is Art. 6(1)(b) GDPR.

Offline alert: If you switch it on for your server, we keep track of whether the server was reachable at the last check and when we last notified you, and we send you an email and/or a message to your Discord webhook when it stops answering and when it is reachable again. The legal basis is Art. 6(1)(b) GDPR, because you request this service. You can switch it off in the dashboard, and the emails also with one click via the link in every email.

Listings created by us: We added some well-known servers ourselves based on publicly available information. They are marked as "not added by the owner". If such a server belongs to you, you can take over the listing or have it deleted. Write to us or use "This is my server" on the server page. Insofar as personal data is affected, for example because a server runs under the name of a private individual, our legal basis is Art. 6(1)(f) GDPR, and this policy serves as the information required under Art. 14 GDPR.

Protection against dangerous links: To keep visitors away from phishing and malware sites, we check the links and domains in server listings and their news (website, Discord link, description, server address). We compare them with public blocklists that we download, and we also query the Google Safe Browsing service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We only send these links to Google, no information about visitors or account holders. We no longer show suspicious links as clickable links and review them by hand. The legal basis is our legitimate interest in the safety of our visitors (Art. 6(1)(f) GDPR). Google is certified under the EU-US Data Privacy Framework.

6a. YouTube trailers on server pages

If a server has a trailer, we first only show an area with a play button. Until then nothing is loaded from YouTube, not even a preview image. Only when you click "Play trailer" does your browser load the video from YouTube's privacy-enhanced mode (youtube-nocookie.com). YouTube then receives your IP address and the usual browser data and may store or read data on your device. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. By clicking you consent to this transfer (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The consent applies only to this one video; on your next page view the trailer is not loaded again. More in Google's privacy policy.

7. Reports

Using "Report", you can point out unlawful or rule-breaking listings to us. We store the reason, your description, the listing concerned and, if you provide them, your name and email address. We need these to confirm receipt and to tell you our decision. To prevent multiple reports, we create a check value with a secret key (HMAC) from your IP address, which is deleted after 24 hours.

The legal basis is our obligation to process reports (Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA), and otherwise our legitimate interest in a clean platform ((f)). We only pass on the name of the reporting person to the reported server owner if this is necessary for the review, for example in the case of copyright infringements, and we tell you beforehand. We delete reports 6 months after the case is closed, or, if a dispute is ongoing, after it has ended. If we suspect a criminal offence threatening people's life or safety, we inform the authorities (Art. 18 DSA).

8. Email contact and emails from us

If you write to us, we process your email address and the content in order to reply to you (Art. 6(1)(b) GDPR, otherwise (f)). The same applies to the contact form: the message reaches us as an email, and we keep a copy for 12 months at most. Our mailbox is hosted by Google (Gmail, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This may involve transfers to Google LLC in the USA. The basis for this is the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023. Google is certified under it.

We send emails from us through our own mail server on our server at OVH (section 11). These are:

• messages that belong to your account: confirming your email address, password links, confirming a new email address,
• security notices when your password or email address was changed or a sign-in method such as Google was linked or removed. We send the notice about a changed email address to the previous address so that you notice if someone takes over your account,
• messages about your server listings: listing created, approved, offline for a longer time, hidden or deleted,
• the offline alert, but only if you switched it on for a server (section 6),
• messages about deletion requests, reports and moderation decisions (section 7),
• the vote reminder, but only if you switched it on (section 5b).

The legal basis is Art. 6(1)(b) GDPR, for security notices our and your legitimate interest in protecting your account ((f)), for reports Art. 6(1)(c) GDPR in conjunction with Art. 16 and 17 DSA. You can switch off the notices about servers that have been offline for a longer time on your account page. We keep a sending log with recipient, type and content of the message and sending status for 90 days so that we can resolve delivery problems. The mail server's logs are continuously overwritten.

Our emails contain no tracking pixels and no links that track whether and when you open them. Your email program loads the logo at the top of the email from our server. This only generates the log data described in section 3, which we do not analyse. If you do not want this, switch off loading images in your email program.

Replies to our emails: Our emails come from noreply@bestmcserverlist.net. Cloudflare forwards replies to this address to our mailbox (section 11). For messages you are meant to reply to, for example about a report or a deletion request, the reply address is our mailbox directly.

9. Storage on your device (cookies, localStorage)

We do not use any third-party analytics or advertising services. Our own statistics (section 3b) work without cookies and without storing anything on your device. We set exactly one cookie ourselves: bms_lang remembers which language you want to see the site in. The site is available in 35 languages: English, German, Polish, Spanish, Croatian, Serbian, Bosnian, Bulgarian, Czech, Danish, Dutch, Estonian, Finnish, French, Greek, Hungarian, Irish, Italian, Latvian, Lithuanian, Maltese, Portuguese, Romanian, Slovak, Slovenian, Swedish, Norwegian, Icelandic, Ukrainian, Albanian, Macedonian, Turkish, Russian, Catalan and Luxembourgish. The cookie is only created when you choose a language yourself with the language selector at the top or bottom of the page. If your browser reports one of these languages before English as its preferred language, we send you from an English page to the matching version; no cookie is set for that. The cookie only contains the two-letter language code (for example de, en, fr or nb), lasts one year and is not analysed. It stores your explicit choice and is necessary for that (§ 25(2) No. 2 TDDDG). You can delete it in your browser at any time.

When you log in, your browser stores a login key in local storage (localStorage, key sb-…-auth-token). It contains your session and your email address and remains until you log out. Without it you cannot stay logged in. This storage is strictly necessary for the service you have requested and does not require consent (§ 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)). If you are not logged in, we only store what you create in our tools yourself, so that it is still there on your next visit: drafts in Banner Studio, the icon, rank and GUI designers, the Text Studio and the start script and server.properties helpers (banner-studio:…, bms:…), and whether you hid the Glowling. This data stays in your browser and is not sent to us. You can delete it at any time in your browser settings (§ 25(2) No. 2 TDDDG).

We load fonts, images and scripts exclusively from our own server. There are no connections to Google Fonts, CDNs or other third-party providers. Banners and screenshots uploaded by server owners are stored on our own server as well. The only exception is a YouTube trailer, and it is only loaded after your click (section 6a).

10. Embeddable status graphics and Discord

Server owners can embed a status graphic from us on their own website. When someone visits that website, their browser loads the graphic from our server. This generates the log data mentioned in section 3. We do not set any cookies in the process and do not analyse the requests. The owner of the respective website is responsible for the embedding and for informing their own visitors.

Discord notifications: Server owners can add a Discord webhook address. We then send the Minecraft name, the server name and the time of every vote for their server to that Discord channel, as well as the server's news and, if switched on, the offline alert. The recipient is Discord (Discord Netherlands B.V. or Discord Inc., USA). Only the owner decides whether and where this is sent. The owner is responsible for further processing in their Discord. The legal basis is Art. 6(1)(f) GDPR: the owner's interest in telling their players about votes. For transfers to the USA, Discord relies on the EU-US Data Privacy Framework and standard contractual clauses.

11. Recipients and processors

• Hosting: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. Our server is located in a data centre in the EU. We have a data processing agreement with OVH (Art. 28 GDPR). We run the database, login, file storage, background services and the mail server (Supabase, our own worker, our own mail server) ourselves on this server.
• Email: Our mailbox is hosted by Google (Gmail), see section 8. We send emails through our own mail server.
• Cloudflare: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, manages the DNS records of our domain. That is the address book that translates names like bestmcserverlist.net into the address of our server. All visits to our website also pass through Cloudflare's network (section 3a). Cloudflare also forwards emails that someone sends to an address at our domain, such as replies to noreply@, to our mailbox (section 8). In doing so, Cloudflare processes the sender, recipient and content of these emails but does not store them permanently. Cloudflare acts as our processor; the agreement for this is part of Cloudflare's terms. For transfers to the USA, Cloudflare is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR, our interest in being reliably reachable.
• Google (sign-in): only if you sign in with Google (section 5a).
• Apple (sign-in): only if you sign in with Apple in the app (section 5c).
• Mojang: only receives the Minecraft name when a skin is fetched (section 4b).
• Discord: only if a server owner has set this up (section 10).
• Google (link check): receives the links from server listings to check them for phishing and malware (section 6).
• Google (YouTube): only if you play a trailer on a server page (section 6a).
• Queried Minecraft servers: with the status checker and Votifier tester our server contacts the server whose address you enter; it only sees our server (section 6).
• We do not use any other service providers.
• Server owners: receive your Minecraft name when you vote for their server (section 4).
• The public: server listings, the latest votes and the player profiles (sections 4, 4a and 6).
• Authorities: only if we are legally required to.
• Development: A helper who co-develops the site has technical access to the server. He works according to our instructions and is bound to confidentiality in writing (Art. 29, Art. 32(4) GDPR).

We do not sell any data.

12. Your rights

You have the right to:

• access to your data (Art. 15 GDPR),
• rectification of incorrect data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object (Art. 21, see below).

To do so, write to kontakt@bestmcserverlist.net. We reply within one month. Because anyone can type in any Minecraft name, for requests about votes we may ask how we can verify that the name belongs to you.

Right to object: Insofar as we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data, unless we have compelling legitimate grounds or need it to establish, exercise or defend legal claims.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern (State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Western Pomerania)
Lennéstraße 1 (Schloss), 19053 Schwerin
Phone 0385 59494-0 · info@datenschutz-mv.de · www.datenschutz-mv.de

13. Automated decisions

We do not make automated decisions within the meaning of Art. 22 GDPR. The ranking is calculated automatically from votes and listing data (see How the ranking works). Votes that break the 24-hour rule are automatically not counted. Moderation decisions, i.e. blocking or removing a listing, are always made by a human.

14. Security

The connection is encrypted via TLS. We only store passwords as a hash. Our emails are signed with DKIM so that forgeries in our name stand out. Access to the database and server is limited to two people and is only possible with a personal key. We keep the software up to date.

15. Changes

If the site changes, we update this policy. The version published here at any given time applies. We inform account holders of significant changes by email.