Privacy
In short
No account, no email address, no ads, no analytics, no tracking cookies. The only things stored are what you write into a calendar and any pictures you put in it — and they are deleted automatically 90 days after the last door. Your browser shrinks a picture before uploading it and strips metadata such as where it was taken; a picture only becomes visible when its door opens.
Controller
Daniel Metzner, 8010 Graz, Austria. Email: legal@metzner.uk
What is stored
When you make a calendar: its title, the optional “from” name, the texts of the doors and their dates, the chosen look, the start date, your device's time zone (so doors open at your midnight), which template you started from, and when it was created, last changed and first opened through its share link. Your edit link is stored only as a hash. No IP address is stored, and no recipient's name unless you write it into the calendar yourself. Purpose: providing the calendar (Art. 6(1)(b) GDPR).
Who sees the calendar
Anyone holding the link you give away sees the doors that are already open. You decide who gets it. Please don't put data into a calendar that does not belong there (e.g. health data, passwords).
How long
A calendar is deleted automatically 90 days after the day of its last door — or after 7 days if it was never edited after creation and never opened through its link. You can delete it yourself at any time: edit page → “Delete calendar”. A calendar reported through “Report” is unreachable for everyone at once and deleted 30 days later; only the chosen reason is stored, not who reported it.
On your device
Your browser's local storage remembers which calendars you edited on this device and which doors you have opened. It stays on your device, is never sent to us, and is needed for the site to work (§ 165(3) TKG). This website sets no cookies of its own. Our host Cloudflare sets one strictly necessary security cookie (“cf_clearance”) that tells bots from people; it is not used for advertising or tracking and therefore needs no consent (§ 165(3) TKG).
Service providers
Hosting: Cloudflare, Inc. (Cloudflare Workers), which adds a small script of its own to every page to tell bots from browsers, and which processes technically necessary access data — including your IP address, the page requested and your browser's user agent — to deliver the site and protect it from abuse (e.g. a limit on how many calendars can be made per minute; Art. 6(1)(f) GDPR). Protection from automated abuse: only on the page that creates a calendar, Cloudflare Turnstile (Cloudflare, Inc.) checks that a human is submitting the form, processing technical browser data and your IP address (Art. 6(1)(f) GDPR). Turnstile sets no advertising or tracking cookies; it may briefly store technical data in the browser for the check. Cloudflare also uses these check signals as an independent controller to improve its bot detection (legitimate interests, Art. 6(1)(f) GDPR); Cloudflare's Turnstile privacy policy applies to that (cloudflare.com/turnstile-privacy-policy). Database: Supabase, Inc., servers in Ireland (EU). New or changed texts are checked for illegal content by a safety filter on Cloudflare Workers AI (model Llama Guard) when saved; Cloudflare does not store them or train on them. Apart from that, Cloudflare and Supabase process data on our behalf; transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses. The “Buy me a coffee” link leads to Buy Me a Coffee; their privacy policy applies only once you follow it. The “Open in ChatGPT” and “Open in Claude” links on the prompts page send the prompt you filled in there to OpenAI or Anthropic; their privacy policies apply only once you follow them. The “Subscribe in Google Calendar” link gives Google the address of the reminder file, which contains the link to the calendar; Google's privacy policy applies only once you follow it.
Android app
The app on Google Play opens this website in Chrome (Trusted Web Activity). It collects no data itself and asks for no permissions; everything above applies.
Your rights
You have the right to access, rectification, erasure, restriction, portability and objection. Because there are no accounts, we can only find a calendar if you send us its link: legal@metzner.uk. You can also complain to the Austrian data protection authority (dsb.gv.at).