Privacy Policy

The controller under the EU General Data Protection Regulation (GDPR) is:

Write to this address for any question about your data or to use your rights (see section 10).

When you open burntlemon.app, your browser sends technical data to our server: IP address, date and time, the page requested, referrer, browser and operating system. We need this to deliver the site and keep it secure (Art. 6(1)(f) GDPR). These server logs are kept for a short period and then deleted; they are not combined with other data.

The server is operated for us by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres within the EU.

We only use cookies and browser storage that are strictly necessary: when you sign in, a session cookie keeps you signed in. Without it the sign-in can't work (§ 25(2) TDDDG, Art. 6(1)(b) GDPR). We don't use advertising or tracking cookies and no analytics tools.

You can create an account on the sign-in page with an email link, with Google or with Apple. We store your email address, the sign-in method, when the account was created and when you last signed in. If you sign in with Google or Apple, that provider also sends us the name and profile picture linked to your account there; we don't receive your password.

We use this data to provide your account (Art. 6(1)(b) GDPR). When you sign in with Google or Apple, their own privacy policies apply to what happens on their side.

When you sign up we store that you accepted this privacy policy and whether you opted in to the newsletter, each with a timestamp. We keep this to be able to prove your consent (Art. 6(1)(c) and Art. 7(1) GDPR).

If you opt in, we email you when a new app goes live, using the address you gave us. The basis is your consent (Art. 6(1)(a) GDPR). You confirm your address by clicking the link we send you (double opt-in).

You can withdraw your consent at any time, without giving a reason, under Settings or by writing to us. Withdrawing doesn't affect anything we sent before.

We use these providers, each bound by a data processing agreement where required:

• Supabase (Supabase Inc., USA) runs our database and sign-in. Our data is stored in the EU (Ireland). Because Supabase is a US company, access from the USA can't be ruled out; transfers are covered by the EU Standard Contractual Clauses.
• Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg) delivers our sign-in, confirmation and newsletter emails from servers in the EU (Stockholm). It processes your email address and the email content. Amazon is part of a US group; transfers are covered by the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.
• OpenFreeMap: the map in the Berlin app loads map tiles from OpenFreeMap's servers, which receive your IP address (Art. 6(1)(f) GDPR, to show the map).
• Google Maps Platform (Google Ireland Ltd.): some apps use Google Maps to look up places and addresses. Only then does your browser contact Google, which receives your IP address and the search (Art. 6(1)(f) GDPR).

We link to our Instagram profile. It's a plain link: nothing is loaded from Instagram until you click it. After that, Meta's privacy policy applies.

Account and consent data is kept as long as your account exists. When you ask us to delete your account, we delete it together with your consent record, unless the law requires us to keep something longer. Newsletter data is removed when you unsubscribe, except the record that you did, which we keep as proof.

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

You can also complain to a data protection authority, for example the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

We update this policy when we change what we do with data. The date at the top shows the current version.