Privacy Policy

Both properties are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Server functions run in Frankfurt am Main (region fra1); static content is delivered through Vercel's global network.

When you open a page, the hosting provider processes technically necessary connection data — IP address, time of access, the address requested, the amount of data transferred, and browser and operating system identifiers. This processing is required to deliver the page, keep it stable and defend against attacks.

Legal basis: Article 6 (1)(f) GDPR (legitimate interest in secure operation).
Transfer outside the EU: A data processing agreement including the EU Standard Contractual Clauses is in place with Vercel.

The typefaces used are served from our own servers. No connection is made to Google Fonts or any other external provider when you open the pages.

If you write to us, we process your email address, any name you provide and the contents of your message in order to handle your request. The mailbox is operated through Google Workspace (Google Ireland Limited, Dublin).

Legal basis: Article 6 (1)(b) GDPR where your enquiry concerns a contract, otherwise Article 6 (1)(f) GDPR.
Retention: until your request has been dealt with, and beyond that only where statutory retention periods apply.

System emails — your sign-in link, or confirmation of your beta sign-up — are sent through Plus Five Five, Inc. ("Resend"), 2261 Market Street #5039, San Francisco, CA 94114, USA. Delivery runs through the provider's European region. Your email address and the contents of the message are transmitted. Opens and clicks are not measured. Images in the emails, such as the logo, are loaded from our server when you open the message; this produces the connection data described in A1.

Legal basis: Article 6 (1)(b) GDPR.
Transfer outside the EU: A signed data processing agreement including the EU Standard Contractual Clauses is in place. Resend is additionally certified under the EU-US Data Privacy Framework.

To protect against data loss, backups of the database are created automatically. These contain the entire dataset, including manuscripts and account data.

Every backup is encrypted before it is transferred. The key required to decrypt it is held solely by us; the storage provider cannot read the contents.

Providers involved:

• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA — storage of the encrypted backups. The storage bucket is permanently set to the EU jurisdiction; the data does not leave the EU. A data processing agreement with Standard Contractual Clauses is in place, and Cloudflare is certified under the EU-US Data Privacy Framework.
• GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA — execution of the backup run. During this, the data sits unencrypted in the memory of the executing servers for a few seconds before it is encrypted. A data processing agreement with Standard Contractual Clauses is in place.

Legal basis: Article 6 (1)(f) GDPR (legitimate interest in availability and recoverability), in conjunction with Article 32 (1)(c) GDPR.
Retention: hourly snapshots for 48 hours, daily snapshots for 30 days, then automatic deletion.

We maintain profiles on Bluesky, X and Instagram. If you visit those profiles, the privacy terms of the respective provider apply; we have no influence over their processing. No social media buttons or embedded content that would send data to those providers on page load are used on our own pages — only ordinary links.

The website sets a single cookie, and only when you choose a language with the language switch in the footer. The cookie "opaopa_lang" stores the language you chose (de or en) so that the website is shown to you in that language on later visits. It contains no identifier, is not passed on to third parties and expires after one year. You can delete it in your browser at any time. The website uses no other cookies or browser storage.

Without this cookie we choose the language based on the country your request comes from. To do so, our host Vercel (address under A1) evaluates the IP address and passes on only the country; it is not stored.

Legal basis: storing the cookie is strictly necessary under Section 25 (2) No. 2 TDDDG to provide the language you explicitly chose, so no consent is required. Choosing the language by country is based on Article 6 (1)(f) GDPR (legitimate interest in showing the website in a suitable language). A consent banner is not required.

To measure visitor numbers we use Vercel Web Analytics (Vercel Inc., address under A1). The method works without cookies and without identifiers that would recognise you across websites. It records pages viewed, approximate region of origin, device type and referring page. Attribution to a specific person is not possible.

Legal basis: Article 6 (1)(f) GDPR (legitimate interest in understanding reach). As no information is stored on or read from your device, no consent under Section 25 TDDDG is required.

You can sign up to take part in the beta with your email address. When you sign up, you tell us what stage your novel is at (planning, first draft, revising or published).

The sign-up uses a double opt-in: after you submit it you receive an email with a confirmation link. Your sign-up only counts as confirmed once you confirm it through that link. Stored are your email address, the stage of your novel, the language of the website when you signed up (so we write to you in that language), the time of the sign-up, a confirmation code, the confirmation status and the time of confirmation. No IP address is stored.

These details are used solely to select participants and invite them to the beta, never for advertising. There is no entitlement to take part.

Legal basis: Article 6 (1)(a) GDPR (consent).
Withdrawal: at any time, informally, by email to contact@opaopa.app.
Retention: until beta invitations are complete, or until you withdraw. Unconfirmed sign-ups are deleted after 30 days.
Location: database hosted with Supabase, Inc., 970 Toa Payoh North, Singapore; the database is located in Ireland. A data processing agreement with Standard Contractual Clauses is in place with Supabase.

You can read the blog without signing in. There is no comment function. No videos, maps, fonts or other third-party content are embedded.