Privacy policy
Controller
The controller responsible for data processing on this website is Ferhat Eren, c/o Autorenglück #76028, Albert-Einstein-Straße 47, 02977 Hoyerswerda, email: hello@circkool.com. You can contact this address with any question about data protection.
At a glance
This website presents the novel Circkool. It shows no advertising, sells no data and loads no content from third-party servers: fonts, images and scripts are served from our own server. We do not use Google Fonts, Google Analytics or any other services from Google or advertising networks. We only process what a feature actually needs and delete it as soon as it is no longer needed. Every connection is encrypted via HTTPS.
Visiting the website
Whenever you visit, our hosting provider processes technically necessary connection data: IP address, time, page requested and browser identifier. This data is kept in server log files and is used to deliver the website and protect it against attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The hosting provider processes this data only on our behalf and on our instructions (Art. 28 GDPR).
Cookies
The website sets only cookies that are strictly necessary for a feature you use, and analyses none of them: a security cookie against forged form requests (until you close the browser), a cookie storing your choice of light or dark if you switch the theme (one year), a sign-in cookie while you are signed in to your account (see »Account«), a random identifier once you vote in an open poll, so that everyone votes only once (one year, see “Polls”), and a cookie storing your decision on audience measurement so that we do not ask again on every visit (one year). The legal basis is § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.
Audience measurement with Umami
Only if you agree do we count visits with Umami. This open-source software runs on our own server (tracking.erenware.com); the data is not passed on to anyone else. Umami sets no cookies and stores no IP addresses. It records the page visited without search parameters, the page you came from, browser, operating system, device type, screen size and language, as well as country and region derived from the IP address. To count visits, Umami derives an identifier from the IP address, browser identifier and a random value that changes every month; we cannot link this identifier to a person. Because the script reads information from your browser for this, it only runs with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time under »Privacy settings« below. If your browser sends »Do Not Track«, Umami does not count you even with consent. We delete the statistics after 24 months.
Newsletter
For the newsletter we store your email address, your chosen language, the times of sign-up and confirmation and how far the welcome has got (after confirmation three emails over the first two weeks, then only at full moon). Your sign-up only takes effect once you click the link in the confirmation email (double opt-in); unconfirmed addresses are deleted after seven days. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every email; your address is then deleted. We send the newsletter ourselves through our email provider and measure neither opens nor clicks. Sent emails remain in the delivery log for 14 days. To prevent abuse, sign-up attempts per IP address and email address are counted only in pseudonymised form, as a hash with a secret key, and these counters are deleted after two days.
Contact form
If you write to us via the contact form, we process your name, email address and message in order to reply. The legal basis is Art. 6(1)(b) GDPR if your request concerns a collaboration, otherwise our legitimate interest in answering your message (Art. 6(1)(f) GDPR). The message is delivered as an email to contact@circkool.com, with your address as the reply address. On the server it only sits in the sending queue and is deleted 14 days after sending; in the mailbox it stays until your request is settled. To prevent abuse, requests per IP address are counted only in pseudonymised form, as a hash, and these counters are deleted after two days.
Polls
If you vote in a poll, we store the answers you chose and the time. For members-only polls we link the vote to your account so that each account votes only once. For open polls we set a cookie with a random identifier when you vote (one year); the server keeps only a hash of it made with a secret key, different for each poll, so your votes in different polls cannot be linked. To prevent repeated voting, we also count votes without sign-in per IP address, only pseudonymised as a hash, and delete these counters after two days. The admin area shows only totals; we do not analyse individual votes. 30 days after a poll ends we remove account and identifier from the votes; only the counted answers remain, with no link to you. If you delete your account before then, your vote likewise remains only as a number. The legal basis is our legitimate interest in an unmanipulated poll (Art. 6(1)(f) GDPR), and for the cookie § 25(2) no. 2 TDDDG.
Review copies
If you request a review copy, we process your name, email address, where you review, the chosen format, your message and the language of the page in order to decide on the request and send you the download link. The legal basis is Art. 6(1)(b) GDPR. We also store when the decision was made and the number of downloads; of the link itself only an irreversible check value. We delete the request 180 days after it was received, or immediately on request.
Account
For an account we store your email address, your name, your chosen language, the times of creation and confirmation and your password, only as an Argon2id hash and never in plain text. While you are signed in, we set a cookie with a random identifier (30 days, after seven days without a visit or until you sign out); the server only keeps a hash of it and the time of your last access. If you set up a passkey, we store only its public key, a device identifier, the name you chose and the times of setup and last use; your fingerprint, face or PIN never leave your device. While you sign in with a passkey, we set a further cookie with a signed one-time challenge for at most five minutes. When you set a password, we check whether it appears in known data breaches. To do so, our server queries the Have I Been Pwned service and sends only the first five characters of the SHA-1 hash, never the password and never your IP address. As with the newsletter, sign-in attempts are counted only in pseudonymised form. The legal basis is the use of your account (Art. 6(1)(b) GDPR). Unconfirmed accounts are deleted after seven days. A confirmed account remains until you delete it in your profile; we then delete all its data immediately.
Signing in with Discord
If you sign in with Discord or link Discord in your profile, the website forwards you to Discord. If you agree there, Discord sends us your Discord ID, your name, your profile picture, your email address and whether you are a member of the Circkool server, including nickname and picture on the server. We store the ID, name, membership and picture on our server and serve the picture ourselves; we do not store any Discord credentials. For the redirect we set a cookie that secures the return from Discord and expires after ten minutes. The legal basis is your consent (Art. 6(1)(a) GDPR). If you unlink Discord in your profile, we delete this data. Discord's privacy policy applies to processing at Discord.
Discord bots Pepper and Kies
The bots »Pepper« and »Kies« work on the Circkool server at Discord. They run on our own server, use no AI and pass nothing on to other services. Pepper welcomes new members, answers commands such as /mond or /zitat and assigns roles at your request. Kies protects the server against spam: it reads messages in the channels it has access to and deletes invitations to other servers, messages with five or more mentions and the third identical message within 30 seconds. It also removes messages containing terms from later chapters than the channel allows and sends your text back to you by direct message. It notes each deletion in the moderation channel with person, channel and reason, without the content. If you report a message via „An die Wache melden“, the moderators receive a link, the first 300 characters of the message, its author and you as the reporting person in the non-public moderation channel. If a very large number of members join within a short time, Kies temporarily switches on slow mode. If you have linked your Discord account on the website and confirmed your newsletter subscription, Pepper gives you the role „Mondpost“ and removes it as soon as either ends; for this, the website only tells the bot the Discord IDs of these accounts. The role is visible to other members. If you do not want this, unlink Discord in your profile or unsubscribe from the newsletter. In doing so, the bots process Discord ID, name, roles and messages, but store no messages; to detect repetitions, Kies keeps recent messages in memory only. The legal basis is our legitimate interest in a safe and well-looked-after community (Art. 6(1)(f) GDPR). Discord's privacy policy applies to Discord itself.
External links
The buy buttons lead to Amazon, the links to Instagram, TikTok and Discord to the respective platforms. The website embeds nothing from them; merely visiting our pages tells these providers nothing. This also applies to the share links (for example to WhatsApp, Bluesky or Facebook): they are ordinary links and load nothing before you click. “Share via an app” opens your device’s share menu and “Copy link” puts the address on your clipboard; both happen only on your device, and we learn nothing about it. Only when you follow such a link does the privacy policy of the respective provider apply.
Disclosure and required data
We sell no data and only pass it on as described above: to our hosting provider and our email provider, who work on our behalf, and to Discord if you use Discord. We make no automated decisions and create no profiles. You are not obliged to give us any data; without an email address, however, we cannot send you the newsletter, reply to you or create an account.
Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw any consent at any time with effect for the future; processing carried out until then remains lawful. You can also lodge a complaint with a data protection supervisory authority, for example in the country where you live. To do so, write to the address given above.
Right to object
Where we base processing on our legitimate interest (Art. 6(1)(f) GDPR), you can object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
Privacy settings
You have not decided yet. Until then, none of your visits are counted.
Apart from this, the website sets only cookies that a feature you use needs, such as protection against forged forms, signing in or the identifier against double votes in open polls. They cannot be switched off here because the feature would not work otherwise; which ones they are is listed above under “Cookies”.
Page ii