Data privacy
This explains which personal data this notefeed instance processes and why, as required by the GDPR (DSGVO). Last updated: 14 October 2026.
Controller (Verantwortlicher)
Marcel Bruckner, Germany; the postal address is in the legal notice. Email: privacy@notefeed.me. No data protection officer is appointed, as none is required.
Hosting
The instance runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. Hetzner stores the data on my behalf under a data processing agreement (Art. 28 GDPR) and is the only processor of what you post. Requests reach the server directly, with no other company in between. Notes, feeds, images, logs and e-mail are not transferred to third countries.
The domain notefeed.me is registered with Cloudflare, Inc. (USA), which also answers DNS queries for it. That is the lookup of the server's address; Cloudflare sees the address of the resolver that asks, not yours, and no request to the site passes through Cloudflare.
Notes, feeds and images
What: what you post is stored as you sent it: the notes, the feed name, the optional feed title, description and title image, and uploaded images.
Why and legal basis: to provide the feed you asked for (Art. 6 (1) (b) GDPR).
Retention: until you delete the feed. Deleting a feed deletes everything in it at once. Backups keep it a little longer, see below.
Backups: so that a failure does not lose your notes, copies are made of what is stored:
- every hour a copy of the database (feeds, notes and their metadata, without the images), kept on the same server for 1 day;
- every day a copy of the database and a copy of the images, kept on the same server for 30 days; the licenses are in the copies of the database;
- every day a backup of the whole server, made and kept by Hetzner for 7 days.
A backup is not changed after it is made, so a feed or note you delete is still in the backups made before. It is gone from the last of them after 31 days at most: 30 days of daily copies, the last of which was made up to a day after you deleted. Backups are stored in Germany, are read only to bring the service back after a failure or a mistake, and are not searched, not used for anything else, and never used to bring back a feed on request: what you delete stays deleted. The legal basis is my legitimate interest, and my duty, to keep the service and your data available (Art. 6 (1) (f), Art. 32 GDPR).
Careful with images: metadata such as the GPS position is left in uploaded images. Anyone who can read the feed can see it. Remove it before uploading if you do not want to share it.
Feeds have no accounts. Anyone who knows a feed's name can read and post to it, and anyone with its read link can read it, images included. Do not post personal data of other people without a reason to.
Licenses and payment
What: a license for a feed is paid for through Creem (creem.io), which is the seller of record and collects your payment and contact data (name, e-mail address, country, payment details) itself, under its own privacy policy. I receive from Creem only what the license needs: that a subscription exists, whether it is paid and until when. After payment a license key is shown to you; notefeed stores only a one-way fingerprint (hash) of it, the subscription's reference at Creem, its status and the feed it is entered on. I do not learn who you are from this, and a lost key cannot be recovered.
Why and legal basis: to provide the license you bought (Art. 6 (1) (b) GDPR) and to keep the records the law requires, which Creem keeps as the seller.
Retention: the license record stays as long as the license exists, so that a lapsed license can be renewed or entered again. On request I delete it. It is part of the backups described above.
Recipients: Creem, which processes your payment as its own controller and as a merchant of record. Please read its privacy policy on creem.io too.
Reports about content
What: every note carries a Report link that opens the form at notefeed.me/report. A report holds the feed's read id and the note's id (what the link fills in), the reason you choose, what you write, and your e-mail address if you give one. The form sends it to an inbox I run myself (noticebox, on a server of mine at the same hosting provider), not to a third party; the operator only gets a notification that says that a new report arrived, with a link to it.
Why and legal basis: to find and remove content that should not be here, and to answer you if you gave an address (Art. 6 (1) (f) GDPR, legitimate interest; where the report is about unlawful content, also my legal duties as a hosting provider).
Retention: when a report has been dealt with, what you wrote and your address are deleted the day after. The anonymised record (time, the reason category, the ids of the note, what was decided and why) is kept for audit purposes, as the proof that reports are handled; it names nobody.
Server logs and IP addresses
What: for every request the web server logs the time, the kind of request (for example "a post to a feed", never which feed or note), the status code and a shortened IP address: its last part is removed before the line is written, so it names a network of many connections, not yours. Your full IP address, your browser's user agent, cookies and the names of feeds are not logged.
Why and legal basis: to keep the service secure and to find and stop abuse (Art. 6 (1) (f) GDPR, legitimate interest).
Retention: 14 days, then the logs are deleted.
Separately, notefeed uses your IP address to rate-limit posting and failed password attempts (same legal basis). That is kept in memory only, for about a minute, and is never written to disk.
What: if you write to an address at notefeed.me, your message with your address is received and stored in my mailbox at Hetzner Online GmbH (web hosting, Germany), the same provider as above, under the same data processing agreement. Mail I send from the domain goes out from the same mailbox.
Why and legal basis: to read and answer what you wrote (Art. 6 (1) (f) GDPR, legitimate interest; Art. 6 (1) (b) if it is about a contract).
Retention: until the matter is settled, and longer only where the law requires keeping business mail.
Cookies and storage in your browser
If the instance or a feed is password-protected, a cookie keeps you logged in. It is strictly necessary to provide the service you requested (§ 25 (2) no. 2 TDDDG), so no consent is needed. It holds no personal data and carries no tracking. There are no analytics, advertising or third-party requests, and nothing is loaded from external servers.
The feeds you open are remembered in your browser's local storage, so that they are listed under "Your feeds": the feed's name, its title and the address of its title image. This list stays on your device and is never sent to the server or anyone else. You can remove a feed from it with "Forget on this device", or remove the whole list by clearing the site's data in your browser. Storing it is strictly necessary for the list you use (§ 25 (2) no. 2 TDDDG).
Recipients and automated decisions
Your data is not passed on to anyone except the hosting provider named above, which stores it on my behalf (including e-mail you send me), and, if you buy a license, Creem (see above). The notification that a report arrived goes through ntfy.sh (Philipp C. Heckel, Germany) and carries no part of the report. There is no automated decision-making or profiling.
Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21 GDPR). You can delete a feed and its notes yourself. For anything else, write to privacy@notefeed.me. I will answer within one month.
You also have the right to lodge a complaint with a supervisory authority. For me that is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, www.lda.bayern.de.