Privacy Policy

Michael Pietsch, LeapfroggerLabs
Zur Börse 40, 10247 Berlin, Germany
E-mail: michael.pietsch@gmail.com

This policy covers leapfroggerlabs.com including the portal. Other applications running under this domain have their own privacy notices.

• Without signing in, this site sets no cookies.
• There are no analytics, tracking or advertising services.
• Fonts are served from this site’s own server, not from Google.
• Each visit creates server logs at the hosting provider.
• The portal is only for people I have personally granted access to; for that I store first name, last name and e-mail address.

The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. On every visit, Vercel processes on my behalf the data your browser transmits technically: IP address, date and time, the address requested, the amount of data transferred, browser and operating system, and the page you came from. These logs serve the secure and stable operation of the site and are deleted by Vercel after a short period; I do not evaluate them on a personal basis.

The legal basis is my legitimate interest in operating the site securely (Art. 6 (1) (f) GDPR). A data processing agreement is in place with Vercel; for transfers to the USA, Vercel relies on its certification under the EU-US Data Privacy Framework and on the EU Commission’s standard contractual clauses.

Without signing in, this site sets no cookies. After signing in to the portal, your browser stores session cookies that keep you signed in. They are strictly necessary (§ 25 (2) no. 2 TDDDG) and are not used for any other purpose. They are deleted when you sign out, and at the latest 30 days after your last visit.

The fonts used (Inter, Space Grotesk, IBM Plex Mono, Sora) are stored on this site’s own server and loaded from there. Visiting the site does not establish a connection to Google Fonts or any other font provider.

The portal is not public. Access is granted only to people I have personally approved. For this I store the person’s first name, last name and e-mail address, together with the areas they may use. The legal basis is the agreement with that person about using the portal (Art. 6 (1) (b) GDPR). The data is deleted once access ends.

For sign-in I use Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992). The data is stored in a data centre in Frankfurt am Main, Germany. Supabase processes the e-mail address, the time of sign-in, the IP address and session data. When signing in with a sign-in link, Supabase sends an e-mail containing a link that is valid once. A data processing agreement is in place with Supabase.

You can also sign in with your e-mail address and a password that I set up for you. Supabase stores the password only in encrypted (hashed) form.

When a protected document in the portal is opened, I record who opened it, when, whether access was granted, and the browser identifier (browser and operating system). No IP address is stored. This allows me to trace who has seen confidential content. The legal basis is my legitimate interest in the traceability of access to confidential documents (Art. 6 (1) (f) GDPR). The entries are deleted once access ends.

If you sign in with a Google account, Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) learns that a sign-in to this site took place; I receive from Google the e-mail address, the name and, where available, the profile picture of the account. This sign-in is optional; the sign-in link by e-mail is available as an alternative. What Google processes is described in Google’s privacy policy.

If you write to me, I keep your details to handle the request and for possible follow-up questions (Art. 6 (1) (b) and (f) GDPR). I delete the messages once the matter is settled and no retention obligations apply.

You have the right to access the data stored about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21 GDPR). An e-mail to the address above is sufficient.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

If what this site does changes, I will update this policy. The version with the date shown above applies.