Privacy policy

General

Scope and structure

This privacy policy covers the website www.gdc-world.net, the guides at docs.gdc-world.net, the GDC Tools Manager (manager.gdc-world.net) and every GDC World app. This general part is followed by one section per service, describing exactly which data that service processes. Each app links to its own section.

You use one shared GDC account for all apps. How we process your account, sign-in, households and access is described in the GDC Tools Manager section; each app’s section describes the data you enter in that app.

Principles

• We only process what each service needs.
• No advertising, no analytics or tracking services, no passing on of data for advertising.
• We serve fonts and images from our own servers, not from Google or other providers.
• Third-party content (such as YouTube) is only loaded when you explicitly click for it.

Hosting with Amazon Web Services

All services run on our behalf with Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (“AWS”). Data and program logic are in the AWS region Frankfurt am Main. The pages themselves are delivered through AWS’s worldwide delivery network (Amazon CloudFront), so your request may pass through a server outside the EU. Which logs this creates and how long we keep them is stated in each service’s section.

We have a data processing agreement with AWS (Art. 28 GDPR). Where data reaches the USA, the parent company Amazon.com, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); the Commission’s standard contractual clauses apply in addition. The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR), unless a section names another.

Protection against misuse (Cloudflare Turnstile)

On forms that programs (bots) could misuse at scale, we use Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: the contact form on this website, and registration and “Forgot password” in the GDC Tools Manager. Turnstile is loaded on these pages only. Cloudflare processes your IP address and information about your browser, device and your interaction with the page to tell whether a person is filling in the form. Our server checks the result with Cloudflare; we store nothing about it ourselves. These forms also contain a field people cannot see, and measure how long filling them in takes; both are only checked when the form is sent and are not stored.

The legal basis is our legitimate interest in protecting the services and others from misuse (Art. 6(1)(f) GDPR); the access to your device this involves is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). Cloudflare is certified under the EU-US Data Privacy Framework. More: Turnstile privacy addendum and Cloudflare privacy policy.

Your rights

You have the right to

• access to the data stored about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR), on grounds relating to your particular situation,
• withdraw consent with effect for the future (Art. 7(3) GDPR).

An informal message is enough, by email or through the contact form. You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us, the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

No automated decisions

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

Changes

We update this policy when a service changes. Each section states when it was last updated.

Last updated: 31 October 2026

Website and guides

This section covers www.gdc-world.net and the guides at docs.gdc-world.net.

Visiting the pages

Both sites are hosted with AWS (see Hosting) and delivered through Amazon CloudFront. With every request CloudFront logs your IP address, date and time, the address requested, the referrer, the amount of data transferred, the status code, and the identifier of your browser and operating system. We delete these logs automatically after 30 days. We do not analyse them and only look at them in case of faults or suspected misuse. The legal basis is Art. 6(1)(f) GDPR.

The sites set no cookies and store nothing in your browser.

Videos (YouTube)

On the “Media” page you can play the videos of our YouTube channel. We load the player only when you click “Play videos”; before that nothing is loaded from YouTube, and the preview images come from our own server. After the click your browser loads the player from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in its privacy-enhanced mode (youtube-nocookie.com). Google then receives your IP address and information about your browser; YouTube may store data in your browser and, once you play a video, collect further data, including in the USA. The parent company Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis is your consent by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG); it applies to that page visit only. More in Google’s privacy policy.

Links to YouTube and Instagram on our pages are plain links: only when you follow them do these providers process data under their own terms.

Contact form

When you write to us through the contact form, we process your email address, your message and, if given, your name and a subject. The form sends these to the GDC Tools Manager’s interface (AWS, Frankfurt), which turns them into an email to our mailbox dev@gdc-world.de, sent through Amazon Simple Email Service. We do not store the message in our systems at AWS. You get no confirmation email; that way nobody can use the form to send messages to other people’s addresses.

Our mailbox is run by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft 365), as processor. The parent company Microsoft Corporation is certified under the EU-US Data Privacy Framework.

The form is protected by Cloudflare Turnstile (see Protection against misuse). The legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), and Art. 6(1)(b) GDPR for enquiries about a contract or your account. We delete the message once your request is settled, unless a legal retention obligation applies.

Storage periods at a glance

Last updated: 31 October 2026

GDC Tools Manager (GDC account)

manager.gdc-world.net

The GDC Tools Manager is the shared GDC account: registration, signing in to every GDC World app, households and access. What a single app does with the data you enter there is described in that app’s section.

Visiting and logs

The site and its interface run with AWS in Frankfurt (see Hosting). AWS processes technically necessary data: your IP address, date and time, the address requested, the amount of data transferred, the status code, and the identifier of your browser and operating system. Error and operation logs of the interface may also contain your email address; they are deleted after 14 days.

Registration and your account

For an account we store:

• your email address (also your sign-in name),
• your password, only as an irreversible hash (scrypt), never in plain text,
• your role (user, tester or administrator), the creation date, and whether your address is confirmed,
• your household (name and ID) and your role in it.

After registering, we send a link to confirm your address. If you do not confirm it within 48 hours, we delete the account and all its data automatically. Registration and “Forgot password” are protected by Cloudflare Turnstile (see Protection against misuse).

The legal basis is providing the account you asked for (Art. 6(1)(b) GDPR). Without an email address and password we cannot create an account. We keep your data until your account is deleted; you can ask us to delete it at any time.

Signing in, sessions and browser storage

When you sign in, you get a short-lived access token (valid for 15 minutes) and a session token that keeps you signed in. We store the session only as a hash; it expires after 30 days without use and ends when you sign out.

We set no cookies. In your browser’s local storage we keep only the two tokens, so you stay signed in, plus your chosen language, colour scheme (light/dark) and whether the help panel is open. These entries are strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). Signing out deletes the tokens.

Signing in to the GDC World apps

You request access to an app in the Tools Manager; an administrator grants or declines it. For this we store, per app, whether you requested access, whether it was granted or declined, when, and by which administrator. A person always decides on your access.

If you create your account from an app’s sign-in screen, we note that app with your account. Once you have confirmed your address, we request access to it for you and remove the note.

When you sign in to an app, the Tools Manager checks your password and your access and passes the app your email address, your role, and your household’s name and ID. The app needs the household to show you your household’s data. The legal basis is Art. 6(1)(b) GDPR.

Households and invitations

Members of a household see the email addresses of the other members; household admins also see open invitations into their household. Whoever invites someone enters their email address; we store the invitation (invited address, who invited, household, role) and send the invited person an email. An unanswered invitation is deleted after 30 days. The legal basis is Art. 6(1)(b) GDPR for members, and for invited people without an account our and the inviting person’s legitimate interest in informing them (Art. 6(1)(f) GDPR).

Emails, notices and history

We send emails that are part of the service: confirming your address, resetting your password, household invitations, new access requests to administrators, decisions about your access to you, and a confirmation when your account has been deleted. We send no advertising. Sending is done by Amazon Simple Email Service in the AWS region Frankfurt. Links for confirming or resetting are valid for 24 hours and 1 hour respectively, invitation links for 30 days.

We also tell you about changes to your access in the app; these notices are deleted after 90 days.

For each account we keep a history that only administrators can see: the account’s creation, address confirmation, changes of password, role and household, invitations, access requests and decisions on them, each with time and acting person, plus a copy of every email sent to your address (recipient, subject, content, delivery status). The history serves traceability, helping with problems and preventing misuse (Art. 6(1)(f) GDPR). It is deleted with your account.

Recipients

• the administrators of the GDC Tools Manager, as far as they manage accounts, access and the history,
• the members of your household (see above),
• the apps you sign in to,
• AWS as processor (hosting, database, email sending),
• Cloudflare for the check at registration and “Forgot password”.

Storage periods at a glance

Last updated: 1 November 2026

Cat's Health

cat.gdc-world.net

Cat’s Health is your household’s shared health log for your cats: feedings, food, weight, vomiting, vet documents, medication, vaccinations and elimination diets. Sign-in, account and household are managed by the GDC Tools Manager (see GDC Tools Manager); this section covers the data you enter in Cat’s Health itself.

Access and logs

Cat’s Health runs on AWS in Frankfurt am Main (see Hosting). On every request, AWS processes technically necessary data: your IP address, date and time, the address requested, the amount of data transferred, the status code and the identifier of your browser and operating system. Error and operating logs of the API are deleted after 14 days.

Data you enter in the app

In Cat’s Health you store:

• cats with name, sex, whether neutered, date of birth, breed, coat and eye colour, photo, microchip or transponder number, whether and under which number they are registered with TASSO, and, if they have died, the date of death,
• food with brand, name, barcode, pack size, calories, protein sources, photo and, if you archive it, the reason,
• feedings with date, time, meal, food and the portions per cat with amount and a rating of how much was eaten,
• weighings with date, time and weight, and vomiting with date, time, colour, whether food or hair was in it, and a remark,
• medication with name, dose, times, period and notes, and the doses given, and vaccinations with vaccine, date, next due date, vet practice, batch and notes,
• elimination diets with their phases, the allowed foods and the outcome, and per cat and food a status (suspected, cleared, intolerant) with a reason,
• documents with title, kind, date, note and file name (for the files, see below),
• your household’s settings: meals, rating scale, vomit colours, document kinds, vaccines, protein sources and whether AI assistants may access the data.

You can also take over a feeding log from an Excel file. Your browser reads the file itself; only the entries you take over are sent to us.

This data belongs to your household, not to you personally: all members of your household can see and edit it, and we do not store who created an entry. If you leave a household, the data stays with the household. The legal basis is providing the app (Art. 6(1)(b) GDPR). We keep the data until you delete it in the app; if you delete a cat, we also delete its weighings, vomiting entries, documents, portions, vaccinations and medication. We also back up the database against accidental loss; deleted entries remain in this backup for up to 35 days. If your household is dissolved, we delete its data in Cat’s Health on request via the contact form.

Photos and documents

You can add a photo to a cat and to a food; your browser makes it smaller before uploading. You can also file documents for a cat, such as test results, vet invoices or vaccination records (PDFs and images, up to 20 MB per file). Your browser uploads the files directly to our storage at AWS in Frankfurt. They are not public there: only a signed-in member of your household can open them, through a link the app creates for that purpose, which expires after five minutes (documents) or one hour (photos). An uploaded file that is not saved (for example because you close the dialog) is deleted after one day.

If you delete a photo or document, replace it, or delete the cat or food, we delete the file too. To protect against accidental deletion, a deleted or replaced file then remains in an inaccessible backup copy for 90 days before it is removed for good.

Vet invoices and test results often contain your name, your address and details of the vet practice; please upload only what you need for your cat’s health. The legal basis is Art. 6(1)(b) GDPR.

Barcode scanner and identifying by photo

To log a feeding, you can scan the barcode of a food tin with your device’s camera. Your browser asks you for permission to use the camera. Your browser reads the barcode itself; the camera image does not leave your device.

If the barcode cannot be read, the app can identify the pack from a photo. As soon as you hold a pack still in front of the camera while the scanner is open, or when you tap Identify by photo, the app takes a single frame (at most 1024 pixels wide) and sends it, together with the list of your household’s foods (brand and name), to our server. Our server has the image analysed through AWS’s Amazon Bedrock service by the AI model Claude Sonnet 4.6 (Anthropic), which reports which food from your list is shown. Processing takes place only in AWS data centres in the EU. AWS acts as our processor, as for hosting (see Hosting); Anthropic receives neither the image nor the list. AWS does not store the content and does not use it to train models. We do not store the image; it is discarded after the answer.

Please hold only the pack in the frame, no people. The legal basis is Art. 6(1)(b) GDPR.

Connecting AI assistants

You can connect an AI assistant such as Claude or ChatGPT to Cat’s Health and ask it questions about your household’s entries. This is off until a member of your household switches it on in the settings; the setting applies to the whole household, and the app shows since when it has been on.

A connected assistant can read your household’s cats, feedings, food, vomiting, weighings, medication, vaccinations and elimination diets, but not photos and documents. It cannot change anything unless you explicitly allow it: then it may mark a food as suspected for a cat, with a reason, and fill in a food’s missing protein sources.

When you ask a question, the assistant sends the entries it reads for it to its provider (for example Anthropic for Claude or OpenAI for ChatGPT). You initiate this transfer yourself by connecting the assistant; the provider is responsible for the processing on its side, and its privacy terms apply. Connect only an assistant you trust with your household’s data.

To connect, you sign in on a Cat’s Health page with your GDC account; your password is checked by the GDC Tools Manager, and the assistant never receives it. For this we store the assistant’s name and return addresses (for up to 180 days), the connection itself, which expires after 30 days without use, and, after failed attempts, their number for 15 minutes under a non-reversible hash of your email address, to prevent password guessing. If a member switches access off, none of the household’s connections works any more. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the protection against password guessing.

External services

Cat’s Health does not embed services of other providers. Fonts and the barcode reader come from our own servers; your browser contacts only Cat’s Health and the GDC Tools Manager.

Browser storage

We set cookies only on the sign-in page for AI assistants: a security cookie that protects the sign-in against misuse by other websites; it is valid for ten minutes and deleted after sign-in.

In your browser’s local storage we keep only: the sign-in tokens, so that you stay signed in, the name and id of your household for display, a copy of your household’s cats, food and settings, so that the app starts faster (at most seven days old), and your chosen language, your colour scheme, whether the menu is collapsed and the help panel open, and whether the screen should stay awake. So that the app also starts without a connection, your browser also caches the program files and the help images. These entries are strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). Signing out deletes the tokens, the household and the copy of the data.

Recipients

• the members of your household (see above),
• AWS as processor (hosting, database, file storage, identifying by photo),
• the provider of an AI assistant, only if your household switches access on and you or another member connect an assistant.

Retention at a glance

Last updated: 1 November 2026

The Recipe Book

mealplanner.gdc-world.net

The Recipe Book is your household’s shared recipe book, with a meal planner and a shopping list. Signing in, your account and your household are managed by the GDC Tools Manager (see GDC Tools Manager); this section is about the data you enter in The Recipe Book itself.

Visiting and logs

The Recipe Book runs with AWS in Frankfurt am Main (see Hosting). On every visit AWS processes technically necessary data: your IP address, date and time, the address requested, the amount of data transferred, the status code, and the identifier of your browser and operating system. Error and operation logs of the interface may also contain the address of an imported recipe and error details; they are deleted after 14 days.

Data you enter in the app

In The Recipe Book you store:

• recipes with title, ingredients, steps, notes, categories, tags, kitchen equipment needed, time, servings, source (name and address), picture, rating, favourite and status (testing, active, archived),
• the meal plan: which recipe is planned for which day,
• your household’s settings: categories, tags and kitchen equipment, language and units, your shopping day and moved shopping days, and locked days and excluded tags for the planning assistant,
• the shopping list: your corrections to what counts as a staple, and what you have already ticked off on the current shop.

This data belongs to your household, not to you personally: all members of your household can see and edit it, and we do not store who created an entry. If you leave a household, the data stays with the household. The legal basis is providing the app (Art. 6(1)(b) GDPR). We keep the data until you delete it in the app. Recipes and the meal plan are also backed up against accidental loss; deleted entries remain in that backup for up to 35 days. If your household is dissolved, we delete its data in The Recipe Book on request through the contact form.

Importing recipes and uploaded files

You can bring in a recipe from a link (a website or a public Instagram post), a photo or a PDF.

• Links: our server fetches the page, not your browser, so the site’s operator receives our server’s IP address, not yours. If the direct request fails, our server opens the page in its own browser at AWS; for some sites we use a fetching service (see “External services” below).
• Photos and PDFs are uploaded by your browser directly to our storage at AWS in Frankfurt. They are not public there and are deleted automatically after 7 days.
• The import job (its kind, the address or file, and the result read from it) is deleted after about a day.

Recipe pictures are stored, resized, at AWS in Frankfurt: the source page’s picture, a photo you import, or a picture you upload to the recipe yourself. So that the app can show them quickly, recipe pictures can be loaded without signing in, but only through a random address that cannot be guessed and that only the app knows. Please therefore do not upload photos that show people. When a recipe is deleted or its picture replaced, we delete the picture.

The legal basis is Art. 6(1)(b) GDPR.

AI features

To read imported recipes, to translate a recipe and convert its units, and to sort the shopping list, we use the AI model Claude by Anthropic through AWS’s Amazon Bedrock service. For this we send Amazon Bedrock the text of the imported page, the uploaded photo or the text of the PDF, the recipe’s content when translating, and the ingredients for the shopping list, together with your household’s categories and tags so that the result fits them.

Processing takes place in AWS data centres within the EU. The provider is AWS, with whom a data processing agreement is already in place (see Hosting); Anthropic does not receive the content. Amazon Bedrock does not store the inputs and responses and does not use them to train AI models. We store the results (the recipe read, translations, how the ingredients are sorted) with the recipe. Please do not upload documents containing other people’s data. The legal basis is Art. 6(1)(b) GDPR.

External services

Fetching service for hard-to-reach pages (ScrapingAnt). Some websites and Instagram block requests from data centres. For such pages our server asks the ScrapingAnt service of DATAANT sp. z o.o., Poland (KRS 0000848755), which fetches the page through its own connections and returns its content to us. We send only the recipe’s public address, no data about you or your household: not your IP address, not your account, and nothing that shows who started the import. According to ScrapingAnt, it stores its data on Amazon servers in the USA. The provider’s privacy notice: scrapingant.com/legal/privacy-policy.

Pictures from other websites. If a picture could not be taken over during the import, the recipe points to the picture on the source page. Your browser then loads it from there, and that site’s operator receives your IP address. You can replace the picture with your own in the recipe at any time.

Browser storage

We do not set cookies. In your browser’s local storage we keep only: the sign-in tokens, so that you stay signed in, your household’s name for display, your chosen language, and whether the help panel is open. For the length of the session the app also remembers which new version it last loaded, so that it does not reload again after an update. These entries are strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). Signing out deletes the tokens and the household name.

Recipients

• the members of your household (see above),
• AWS as processor (hosting, database, file storage, AI through Amazon Bedrock),
• DATAANT sp. z o.o. (ScrapingAnt) for fetching hard-to-reach pages, with the recipe’s public address only.

Storage periods at a glance

Last updated: 31 October 2026

Travel Planner

travel.gdc-world.net

Travel Planner is your household’s shared trip planner: stops and nights, flights, lodging, hire cars, day plans, to-dos and budget. Signing in, your account and your household are managed by the GDC Tools Manager (see GDC Tools Manager); this section is about the data you enter in Travel Planner itself.

Visiting and logs

Travel Planner runs at AWS in Frankfurt am Main (see Hosting). On every visit AWS processes technically necessary data: your IP address, date and time, the address requested, the amount of data transferred, the status code, and the identifier of your browser and operating system. Error and operation logs of the interface are deleted after 14 days.

Data you enter in the app

In Travel Planner you store:

• trips with name, start date, status, currency, notes, and the trip’s stops with their number of nights and their position on the map,
• options per stop, each with a label, price, link, picture, attached documents, whether it is booked, a price history and, if you archive it, a note on why: travel (airline, flight number, class, departure and arrival place and time, miles), lodging (room, rating, address), hire cars (company, vehicle, pick-up), events and dining (address, day, time),
• to-dos with category, due date, link and the people responsible; these are members of your household and are stored by their e-mail address,
• a trip’s fixed dates, such as school holidays, and the budget with price, down payment and amount paid,
• your household’s settings: usual starting point, currency, number of travellers, to-do categories and your own colours for fixed dates.

This data belongs to your household, not to you personally: all members of your household can see and edit it, and we do not store who created an entry. If you leave a household, the data stays with the household; a to-do keeps your e-mail address as responsible until a member reassigns or deletes it. The legal basis is providing the app (Art. 6(1)(b) GDPR). We keep the data until you delete it in the app. The database is also backed up against accidental loss; deleted entries remain in that backup for up to 35 days. If your household is dissolved, we delete its data in Travel Planner on request through the contact form.

Pictures and documents

You can attach a picture (up to 4 MB) to an option, and documents such as tickets, vouchers or booking confirmations (PDFs and pictures, up to 15 MB each). Your browser uploads them directly to our storage at AWS in Frankfurt. They are not public there: only a signed-in member of your household can retrieve them, through a link the app creates for the purpose that stops working after an hour. An uploaded file that is never saved (for example because you close the dialog) is deleted after a day.

When you delete a picture or document, replace a picture, or delete the option, its stop or the whole trip, we delete the files too. To guard against accidental deletion, a deleted file then remains in an inaccessible backup copy for 90 days before it is removed for good.

Tickets and confirmations often contain the names and booking details of the people you travel with; please upload only what you need for the trip. The legal basis is Art. 6(1)(b) GDPR.

External services

Finding places (OpenStreetMap Nominatim). To put a place on the map, our server, not your browser, asks the Nominatim service of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, for its position. This happens once, when you name a stop or enter a lodging’s address. Only the name of the place or the lodging’s address is sent, not your IP address, your account or your household; we store the position found with the trip. The United Kingdom is covered by an adequacy decision of the EU Commission (Art. 45 GDPR). The legal basis is Art. 6(1)(b) GDPR. The provider’s privacy notice: osmfoundation.org/wiki/Privacy_Policy.

Maps (Amazon Location Service). Your browser loads the map of your trip from Amazon Location Service, an AWS service in Frankfurt am Main. AWS receives your IP address and the part of the map shown, as a processor just as for hosting (see Hosting). Your browser contacts no other map provider.

Links. You can open the address of a lodging, event or restaurant in Google Maps, and options and to-dos can link to other websites. Those pages are loaded only when you click the link; only then does their operator receive your IP address.

Browser storage

We do not set cookies. In your browser’s local storage we keep only: the sign-in tokens, so that you stay signed in, your household’s name and identifier for display, your chosen language and colour scheme, and whether the help panel is open. These entries are strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). Signing out deletes the tokens and the household.

Recipients

• the members of your household (see above),
• AWS as processor (hosting, database, file storage, maps),
• the OpenStreetMap Foundation, with place names and lodging addresses only.

Storage periods at a glance

Last updated: 1 November 2026

Season Planner

season.gdc-world.net

Season Planner shows NFL and college football games in German time, says where they are on in Germany, and reminds you before kickoff. Signing in, your account and your household are managed by the GDC Tools Manager (see GDC Tools Manager); this section is about the data you enter in Season Planner itself.

Visiting and logs

Season Planner runs with AWS in Frankfurt am Main (see Hosting). On every visit AWS processes technically necessary data: your IP address, date and time, the address requested, the amount of data transferred, the status code, and the identifier of your browser and operating system. Error and operation logs of the interface and of sending reminders and emails may also contain your email address, the identifier of a game and error details; they are deleted after 14 days.

Data you enter in the app

In Season Planner you store:

• your watchlist: which games you have starred, which reminders a game sends (an hour before, at kickoff), whether it may remind you during quiet hours, when you starred it, and whether and when you watched it,
• the teams you follow,
• your settings: which reminders a newly starred game gets, your quiet hours, whether you want push notifications and the email digest, which scores are hidden, which streaming services you have, your time zone and your language.

This data belongs to you personally: it is stored with your household, but the other members of your household do not see it. If you leave a household, the data stays stored there but is no longer visible to anyone. The legal basis is providing the app (Art. 6(1)(b) GDPR). You remove a game from the watchlist by unstarring it, and a team by unfollowing it; we keep the settings for as long as you use the app. The watchlist, teams and settings are also backed up against accidental loss; deleted entries remain in that backup for up to 35 days. We delete all your data in Season Planner on request through the contact form.

Push notifications

When you switch on notifications, we store the push address your browser creates for them, with its keys, together with your email address and when you switched them on; one per device. The messages are delivered through the push service of your browser’s maker (for example Google for Chrome, Mozilla for Firefox, Apple for Safari), which receives the encrypted message and the push address. The messages contain the kickoff, the matchup, the stadium and the broadcaster. So that notifications arrive, the app sets up a service worker in your browser; it stores no data.

You can switch notifications off at any time in the app or in the browser. If you switch them off in the app, we delete that device’s push address immediately; if you switch them off only in the browser, we delete it as soon as the push service reports it as invalid. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give by switching them on and can withdraw at any time.

Email digest

If you switch on the email digest (it is off at first), we send you an email on Fridays with the weekend’s games you have starred: kickoff, matchup, stadium and broadcaster. It goes to the email address you sign in with and is sent through AWS’s Amazon Simple Email Service in Frankfurt. The legal basis is Art. 6(1)(b) GDPR; you can switch the digest off in the settings at any time.

Game data and broadcast information

Our server fetches schedules, scores, standings and team logos from ESPN, and the TV listings from MagentaTV. We send no data about you or your household. Team logos are served from our own storage at AWS, so your browser contacts only Season Planner and the GDC Tools Manager.

Browser storage

We do not set cookies. In your browser’s local storage we keep only: the sign-in token, so that you stay signed in, your household’s identifier, so that the app notices a change of household, your chosen language and colour scheme, whether the help panel is open, and whether and until when the question about notifications is put off on this device. For the length of the session the app also remembers which new version it last loaded, so that it does not reload again after an update. These entries are strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). Signing out deletes the sign-in token and the household identifier.

Recipients

• AWS as processor (hosting, database, sending email through Amazon Simple Email Service),
• the push service of your browser’s maker, if you have switched on notifications.

Storage periods at a glance

Last updated: 31 October 2026