Privacy Policy

Last updated: 30 October 2026

In short: this website sets no cookies and makes no requests to third parties — fonts and all other files come from our own server. We do run a privacy-friendly audience measurement on our own server (section 3): it stores nothing on your device, reads nothing from it beyond what the page itself needs to report the visit, and involves no third parties. There are no user accounts, no contact form and no newsletter. The little data that does arise is listed below.

1. Who is responsible

[FULL NAME OR COMPANY NAME]
[STREET AND NUMBER], [POSTCODE AND CITY], Germany
Email: [EMAIL]

For any privacy question or to exercise your rights, a short email is enough. We have not appointed a data protection officer because the legal requirements for doing so are not met (§ 38(1) BDSG).

2. Visiting this website

The website is hosted and delivered by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, through its global network, exclusively over encrypted HTTPS. When you load a page, Cloudflare automatically processes:

your IP address
date and time of the request
the page requested
the referring page, if your browser sends it
your browser and operating system

Purpose: delivering pages to your device, and detecting and fending off attacks and faults. Legal basis: Art. 6(1)(f) GDPR — without your IP address no page can reach your device, and we have a legitimate interest in running the site securely and reliably. Retention: Cloudflare keeps this data only as long as needed for delivery and security under its data processing terms. We do not use this data for audience measurement or advertising and do not combine it with other data. Recipient: Cloudflare processes this data on our behalf as a processor (Art. 28 GDPR). Third-country transfer:data may be processed in the USA and other countries; the transfer relies on Cloudflare's participation in the EU-U.S. Data Privacy Framework and, as a fallback, on the EU standard contractual clauses (Art. 45, 46 GDPR). Our domain and email remain with IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

3. Audience measurement

A small script from our own server (/besuch.js) reports each page view to our own analytics server (the Content Hub). The Content Hub is hosted in Nuremberg by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which acts as our processor (Art. 28 GDPR). The measurement uses no cookies, no localStorage and no fingerprinting. We do not sell or share the data, do not use it for advertising and do not build profiles.

For each page view we store:

date and time
the page address — the path only; of the query string we keep only theutm_source, utm_medium and utm_campaign parameters
the domain of the referring website (not its full address)
device class, browser and operating system, derived from the user-agent header your browser sends anyway
your browser language, from the Accept-Language header
how long the page was visible and how far you scrolled
loading-performance timings (LCP, INP, CLS, TTFB, FCP)
for clicks on links to other websites: the target address (domain and path) and which button or placement was clicked

When a page does not exist (404), we note that too.

Visitor code valid for one day only: it is a hash of your IP address, your user agent and a random value that changes daily and is deleted after the day. It lets us count visitors per day, but it cannot be linked across days or traced back to your IP address. The IP address itself is processed only in memory — to form this code and to fend off abuse (rate limiting) — and is not written to our database or logs.

Requests from known bots are discarded. Browsers with Global Privacy Control enabled send nothing at all.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding which content is used and in keeping the site fast. No information is stored on your device, and nothing is read from it beyond what the page itself needs to report the visit. Retention: 400 days, then deleted. Your right to object: enable Global Privacy Control in your browser, block /besuch.js, or email us at [EMAIL].

4. Storage on your device

We set no cookies. Two small entries are stored in your browser:

Install hint (localStorage): on iPhone and iPad, a short hint shows how to add the site to your home screen. If you close it, that choice is remembered so the hint doesn't come back.
Offline support (service worker): you can add the site to your home screen as an app. Your browser then keeps an offline page and copies of our fonts and design files. Page content and results data are deliberately not cached, so the published track record is never shown out of date.

Neither entry contains information about you, neither leaves your device, and we never read them. They require no consent under § 25(2) no. 2 TDDDG because they are needed to provide the service you asked for. You can delete them at any time in your browser's site data settings.

5. Calculators

Our calculators run entirely in your browser. What you type in is never sent anywhere or stored, and it disappears when you leave the page.

The calculators can also be embedded on other websites. If you use one there, the same log data as described in section 2 is created, because your browser contacts our server.

6. Contacting us by email

If you email us, we process your email address and your message to handle your request. Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the correspondence once it is no longer needed, unless statutory retention obligations apply.

7. Player profiles

We publish analysis pages on professional tennis players. They contain only names, match results and statistics calculated from them — no photos and no private information. The data comes from publicly available sports data sources (Art. 14 GDPR). Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in statistical sports reporting on athletes in their public sporting role. Players can object at [EMAIL]; we assess every objection individually.

8. Our Discord server

Our community runs on Discord (Discord Inc., USA). Discord is responsible for its own processing under its own privacy policy. Our own Discord bot runs on our server at Hetzner Online GmbH in Germany (see section 3), which acts as our processor. We are responsible for the following:

Referral programme: if you take part, or join through someone's invite, we store your Discord user ID, when you joined, who invited you, and the number of your messages and active days — never the content of your messages. This is how we check whether a referral qualifies. Legal basis: Art. 6(1)(b) GDPR for taking part in the programme; Art. 6(1)(f) GDPR for checking referrals and preventing abuse such as multiple accounts. Retention: for as long as the programme relationship and any open reward claims exist.
Reward payouts: if you receive a reward, we process the payment details you give us (for example a PayPal address or crypto wallet) to pay you. Legal basis: Art. 6(1)(b) GDPR. Payout records are kept for as long as tax law requires (generally up to ten years).
Spam and scam protection: incoming messages are automatically checked for advertising and scam patterns. For ordinary messages, the text is analysed only in memory and not stored. If a message looks like spam or a scam, a copy of it (author, text, time) is posted to a staff-only channel so a moderator can review it, and it is kept there as evidence for appeals and repeat cases. Legal basis: Art. 6(1)(f) GDPR — protecting members from scams. To recognise repeat attempts, the text of messages that a moderator confirmed as a scam by banning the sender is kept in memory (and re-read from the staff channel when the bot restarts) and compared with new messages.
Automatic quarantine: if a message from a recently joined member scores as a likely scam, or is almost identical to a message that moderators already banned as a scam, the bot deletes it and moves the member into quarantine: their roles are paused and they can only see an appeal channel. Pressing the appeal button opens a private ticket with our moderators, and a person then decides. Only if no appeal is made within 48 hours is the member banned automatically. You can still contact us afterwards (see section 1) and we will review the case.
Visibility within the programme: the /leaderboard command publicly shows a ranking of the most successful referrers. Whoever invited you can use /invites to see when you joined and whether you meet the programme requirements.

9. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You also have the right to lodge a complaint with a supervisory authority (Art. 77) — for us that is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (LDI NRW), or the authority where you live.

Your right to object (Art. 21 GDPR)

Where we process data based on a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to that processing at any time on grounds relating to your particular situation. We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests. An informal email to [EMAIL] is enough.

10. No automated decisions

We do not build profiles. The only automated decision is the scam quarantine on our Discord server described in section 8. It does not have legal or similarly significant effects for you, and you can always have a person review it by appealing or by emailing us.

11. Changes

We update this policy when our processing changes. The version published here always applies.