Privacy policy

This is a translation. The German version is legally binding.

As of November 8, 2026. This policy applies to the website wordspoiler.com, including visitors from Switzerland. The app has its own policy (section 10).

1. The key points

• This website sets no cookies and does not use your browser’s local storage.
• For anonymous visitor statistics we use Plausible Analytics on our own server in Germany, without cookies and without storing IP addresses (section 4).
• There are no ads and no ad trackers.
• No content from other providers is embedded: no videos, maps, fonts or scripts from third-party servers.
• There is an optional email box through which you sign up as a beta tester. I then send you the invitation to the test and a message when the app is released. For this, the address is stored on my own server (section 9). Apart from that there are no forms and no sign-up.
• For technical reasons, the web server logs requests for a short time (section 3).

2. Controller

You can find the email address in the legal notice.

3. Hosting and server logs

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner. The server hosting the website is located in Germany.

When you open a page, the web server (Caddy) processes the following data for technical reasons and writes it to an access log: your IP address, date and time, the requested address, the HTTP status code, the amount of data transferred, the previously visited page (referrer) and your browser’s identifier (user agent).

The purpose is to deliver the website, keep it secure (for example, to detect attacks) and find errors. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in operating the website securely and reliably. The logs are deleted after 14 days at the latest and are not combined with other data.

4. Visitor statistics with Plausible Analytics (self-hosted)

To see which pages are read and where visitors come from, we use Plausible Analytics. Plausible runs on our own server at Hetzner in Germany. The script and the measurement data go through this domain; no external provider is involved, and the data does not leave our infrastructure.

Plausible works

• without cookies and without local storage in your browser,
• without storing IP addresses,
• without personal or device profiles and without recognizing you across days or websites.

Only aggregated figures are collected: pages viewed, the previously visited page (referrer), the country (derived from the IP address, which is then discarded), device type, browser and operating system. This does not allow conclusions about individual people. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in improving the website based on anonymous usage figures.

5. Cookies and local storage

This website sets no cookies and writes nothing to your browser’s local storage. That is why there is no cookie banner.

6. Fonts and images

Fonts and images are stored on our own server. When you open the website, your browser does not connect to Google Fonts or any other provider.

7. Links to other websites

The website links to other services, for example to studies. You only leave this website when you click such a link; from then on, the privacy policy of the respective provider applies.

8. Contact by email

If you send me an email, I process your address and the content in order to reply. The legal basis is Art. 6 (1) (b) GDPR where a contract is concerned, otherwise Art. 6 (1) (f) GDPR (interest in replying). I delete the message once it has been dealt with and no statutory retention obligation applies.

9. Email box “Become a beta tester”

Purpose: invitation to the beta test (TestFlight/Google Play) and a message when the app is released. If you sign up, I send the invitation to the test to this address, on iPhone through TestFlight, on Android through Google Play, and an email when the app is released. Nothing else: no advertising, no regular newsletter.

Data: your email address, optionally the native language you choose in the box, the language of the page you sign up on, and the time of signup and of confirmation. To be able to prove your consent I also store your IP address at signup and at confirmation, your browser type (user agent) and the exact wording you agreed to. Signing up is voluntary.

The legal basis is your consent (Art. 6 (1) (a) GDPR). You confirm your address with a link in a confirmation email (double opt-in); only then are you signed up. If you do not click the link you get no further message, and the entry is deleted automatically after 30 days.

Recipients: I handle the sending myself. The address is stored on my own server and sent from there through the wordspoiler.com email account. No newsletter service is involved, and the address is not passed on to third parties. My emails are plain text without tracking pixels or tracked links. So that the data is not lost, the server sends a backup copy of the database to my mailbox at michael@wordspoiler.com every night. For requests through the box I also keep your IP address in memory for one hour at most to limit abuse.

Storage period: until you unsubscribe or withdraw your consent. After that only a note that you unsubscribed remains (so nobody signs you up again by mistake); I delete that too on request. Withdrawal: at any time through the unsubscribe link in every email or by writing to the address in the legal notice; the lawfulness of processing until then is not affected. There is no profiling and no automated decision-making.

10. The app

The app privacy policy applies to the Wordspoiler app. In short: an anonymous account with no name and no email address, a server in Germany, no ads. “Delete data” in the profile deletes everything that belongs to you.

11. Transfers to third countries

Merely visiting this website does not transfer any personal data to countries outside the EU. For the email box, section 9 applies.

12. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw a consent with effect for the future (Art. 7 (3) GDPR) and
• object to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

13. Changes

If the website changes in a way that makes this policy inaccurate, I will update it. The version published here applies.