This is a translation for convenience only. The German version is legally binding: Datenschutzerklärung der Website.

Privacy Policy (Website)

This page describes the data processing on the Curvalia website. A separate policy applies to the app. Information pursuant to Art. 13 and 14 GDPR.

1. Controller

No data protection officer has been appointed: the requirements of § 38 BDSG (at least 20 persons permanently engaged in processing) and of Art. 37 GDPR are not met by a sole proprietorship.

2. Principle: this website collects nothing

The website is purely informational. It contains no tracking, no analytics tools, no advertising networks, no social media plugins and no embedded third-party content. No cookies are set. A consent prompt (“cookie banner”) is therefore not required and is deliberately not used. The only exception is the contact form (section 9): it processes only what you send yourself.

Everything the page displays — maps, routes, badges, sample values — is computed in the browser from fixed sample data. No server is queried, not even ours.

3. Accessing the website (server log files)

When the site is accessed, access data is processed automatically by the hosting provider. Without this transmission, a website cannot technically be delivered.

4. Storage on your device

On the home page, a single value is stored locally in your browser (localStorage):

5. Curvalia Plus

Nothing is sold on this website, and it does not accept any data for that purpose either. From the 2027 season, Curvalia Plus is purchased exclusively in the app, as a subscription via the App Store (Apple) or Google Play (Google).

Apple or Google respectively handle the purchase under their own responsibility, in accordance with their own privacy policies (apple.com/de/legal/privacy, policies.google.com/privacy). We do not receive payment data – neither names nor addresses nor means of payment. The app learns from the store which subscription has been taken out and until when it runs, together with an identifier of this purchase – but no name and no email address.

6. Fonts

The fonts used are delivered from our own server. There is no connection to Google Fonts or any other third-party service; no IP address is transmitted to third parties in the process.

7. Links to the app stores

The download buttons are simple links. No content is loaded from Apple or Google and no data is transmitted to them unless you click. After the click, the privacy policy of the respective store operator applies.

8. Contacting us

If you write to us by email, we process your address and the content of your message in order to reply to it. The legal basis is Art. 6(1)(b) GDPR for matters relating to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in replying). We delete the message once it has been dealt with and no retention obligations prevent this.

9. Contact form

If you write to us via the contact form (curvalia.app/en/kontakt.html), we process your email address, your message and – if provided – your name in order to answer your request. The message is stored in the storage service Cloudflare Workers KV (Cloudflare, Inc., USA – our processor; transfer on the basis of the EU-US Data Privacy Framework or the Standard Contractual Clauses) and deleted automatically after 12 months, earlier once the request has been dealt with.

To protect against abuse, we count how many messages come from an IP address; for this purpose we store the address only as a non-reversible hash value for one hour and never together with the message.

Legal basis: Art. 6(1)(b) GDPR (request relating to a contract or the app) or Art. 6(1)(f) GDPR (legitimate interest in answering requests and preventing abuse). Email address and message are mandatory – without them we cannot reply.

10. Your rights

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR) — here this concerns the server log files and the abuse protection of the contact form
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

An informal message to datenschutz@curvalia.app is sufficient.

Complaint to a supervisory authority

Pursuant to Art. 77 GDPR, you may lodge a complaint with a data protection supervisory authority, in particular in the country of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Maternistraße 17, 01067 Dresden.

In Austria: Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Wien. In Switzerland: Federal Data Protection and Information Commissioner (FDPIC/EDÖB), Feldeggweg 1, 3003 Bern.

11. No obligation to provide data, no automated decision-making

You do not have to provide any personal data to use this website — apart from the technically unavoidable transmission of your IP address (section 3). There is no automated decision-making and no profiling within the meaning of Art. 22 GDPR.

12. Notes for Austria and Switzerland

For users in Austria, the GDPR applies directly; in addition, the Austrian Data Protection Act (DSG) must be observed.

In Switzerland, the revised Federal Act on Data Protection applies (revDSG, in force since 1 September 2023). The information in this policy fulfils the duty to inform under Art. 19 revDSG. Data subjects in Switzerland have a right of access under Art. 25 revDSG and may contact the FDPIC (EDÖB).

13. Changes

We adapt this policy when the website or the legal situation changes. The version published here at any given time applies.