Privacy Policy

Last updated: 2026-10-25

This privacy policy covers the jackpoll.org marketing website ("the Website") only. It does not cover survey and response data processed inside the Jackpoll application itself — that is covered by the app's separate privacy policy at app.jackpoll.org/privacy.

Controller

Quavon UG (haftungsbeschränkt)
Langbehnstraße 39, 83022 Rosenheim, Deutschland
Email: contact@quavon.de

Hosting & server logs

We run the Website, our backend (api.jackpoll.org) and our analytics software on servers provided by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The servers are located in Germany. netcup processes the data as our processor strictly on our instructions; a data processing agreement under Art. 28 GDPR is in place.

When you visit the Website, our servers automatically process technical data (IP address, date and time, requested page, referrer, browser type) in server log files. This data is used solely to operate the Website securely and reliably (Art. 6 (1)(f) GDPR) and is deleted automatically after 7 days.

Storage on your device (cookies & local storage)

We only store or read on your device what is strictly necessary for the features you use (§ 25 (2) no. 2 TDDDG); the subsequent processing rests on Art. 6 (1)(f) GDPR. We use no third-party advertising or social-media cookies. In detail:

• Cookie “lang”: your chosen language; kept for one year.
• Local storage “theme”: your chosen colour scheme (light/dark); kept until you clear it in your browser.
• Local storage “jackpoll:support-prompt-seen”: that and when the note about supporting was already shown to you, so it does not appear again; kept until you clear it.
• Local storage “disable-rybbit”: only if you opt out of analytics; the analytics script then sends nothing; kept until you allow analytics again or clear the entry.
• Session storage “jackpoll:manage-token”: access to your supporter management page when you open it through your management link; deleted as soon as you close the browser tab.

Analytics (Rybbit)

We use Rybbit, an open-source analytics tool that we, Quavon UG (haftungsbeschränkt), run ourselves at tracker.quavon.de on netcup GmbH servers in Germany. No third party receives the analytics data. Rybbit sets no cookies and stores nothing on your device.

The following is sent to tracker.quavon.de: the page you are on, the page you came from (referrer), coarse browser, operating system, device type and screen resolution details, your browser language, and your IP address. Rybbit uses the IP address only briefly to derive your approximate location (country and region) and to form a pseudonymous visitor ID hashed with a salt that changes daily; the IP address itself is not stored. Visits can thus be grouped within one day but not linked across days. The supporters page and the supporter management page are not tracked. The analytics data is deleted after 24 months at the latest.

The legal basis is our legitimate interest (Art. 6 (1)(f) GDPR) in evaluating the reach and use of the Website in aggregate so we can improve its content and features. We do not build profiles of individuals, and the data is not combined with other data. You can object to the analytics at any time (Art. 21 GDPR) with the switch below. If your browser sends a “Global Privacy Control” or “Do Not Track” signal, Rybbit is not loaded at all.

Supporters & payments

If you voluntarily become a supporter, we process your email address, display name, chosen tier and billing interval, amount, your declarations when ordering (acceptance of the terms and, where given, your request for an immediate start of the service, each with a timestamp), and optionally a profile picture, banner image, description and link (Art. 6 (1)(b) GDPR, contract). We store this data in our backend at api.jackpoll.org on netcup GmbH servers in Germany; uploaded images are kept in the self-hosted object storage of that infrastructure.

We send you management links, confirmation codes, payment and cancellation confirmations and invoices by email. We send email through our own mail server on netcup GmbH servers (Germany); no further service provider is involved.

While your support is active, we publicly show your display name and — depending on your tier and as far as you provide them — link, profile picture, banner image and description on jackpoll.org/supporters and on the home page. The recipient of this information is therefore the public. The public listing is the contractual consideration for your support (Art. 6 (1)(b) GDPR). You decide which details appear and can change or remove them at any time through your management link.

The payment is processed by Mollie B.V., Amsterdam, Netherlands, as an independent controller. We pass Mollie the details required for the payment; you enter your payment details (e.g. card or account data) directly with Mollie, and we never see or store them. We only store the payment, customer and subscription reference IDs and payment status returned by Mollie (Art. 6 (1)(b) GDPR). Processing at Mollie is governed by its own privacy policy: https://www.mollie.com/privacy. According to Mollie, it also uses service providers outside the EU and safeguards transfers to third countries with standard contractual clauses or the EU-US Data Privacy Framework.

Invoice data

We issue an invoice for every payment. For that we additionally process your legal first and last name, your billing address and — if you order as a business — the company name and a voluntarily supplied VAT identification number. This data is kept separate from your public display name and never appears on the supporters page. The legal basis is Art. 6 (1)(b) GDPR (contract) and, from the moment the invoice is issued, Art. 6 (1)(c) GDPR together with our tax and commercial law obligations.

Management link

So that you can edit your supporter profile and cancel without an account, we generate a random token and email it to you as a link. Anyone holding that link can see your profile, which is why you can have it replaced at any time. When you open it, we remove the token from the address bar immediately and keep it only in the session storage of that browser tab; the management page passes no address on as a referrer. To cancel through the management link we additionally email a single-use, short-lived numeric code to your address. The legal basis is Art. 6 (1)(b) GDPR.

Cancellation and withdrawal forms

If you cancel at jackpoll.org/kuendigung, we process the type of cancellation, the reason where given, your email address, your name (if provided), the requested cancellation date and the time of receipt. We use this information to match the cancellation to your contract, carry it out and confirm receipt to you (Art. 6 (1)(b) and (c) GDPR in conjunction with § 312k BGB). Likewise, when you withdraw at jackpoll.org/widerrufen we process your name, email address, an optional contract reference and the time of receipt to match, carry out and confirm the withdrawal (Art. 6 (1)(b) and (c) GDPR in conjunction with § 356a BGB). A withdrawal received after the 14-day withdrawal period is treated as an ordinary cancellation. If the email address belongs to a supporter contract, we store the declaration with your supporter record. If it belongs to no contract, we do not store the declaration in our database but forward it to our contact mailbox as the record of receipt.

How long we keep things

We delete server log files after 7 days. The analytics data is deleted after 24 months at the latest. Your public supporter profile is shown while your support is active; after that the listing ends. We delete your link, profile picture, banner image and description 12 months after your support ends, or earlier at your request. We have to keep invoices and payment records for eight years (§ 147 (3) AO, § 257 (4) HGB, § 14b (1) UStG). We therefore delete your supporter record with your name, email address and billing address, together with the related payment records, eight years after the end of the calendar year of your last payment, provided your support is no longer active by then; until that point this data is blocked for any other purpose once your support has ended. We store cancellation and withdrawal declarations (for a cancellation: type, reason, requested date; for a withdrawal: name and contract reference; each with the time of receipt) with your supporter record as proof of receipt and delete them three years after the end of the year in which the contract ended (§§ 195, 199 BGB). Declarations for an email address without a contract are kept in our contact mailbox for three years and deleted afterwards. Management links remain valid until you have them replaced; confirmation codes can be used only once and expire after a short time.

Contact

If you contact us by email, we process the details you provide solely to handle your request (Art. 6 (1)(b) or (f) GDPR). Contact: contact@quavon.de.

External links

The Website links to external services such as GitHub and the Jackpoll app (app.jackpoll.org). Data processing on those external sites is governed by their own privacy policies.

Obligation to provide data & automated decisions

You do not have to provide any data to visit the Website. To conclude and perform a supporter contract, your email address, name, billing address and payment details are required; without them we cannot enter into a supporter contract with you. Profile picture, banner image, description, link and VAT ID are voluntary. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Data protection officer

No data protection officer has been appointed. Fewer than twenty persons here are permanently engaged in the automated processing of personal data (§ 38 (1) BDSG), and none of the conditions of Art. 37 (1) GDPR is met. We answer data protection enquiries directly.

Your rights

You have the right to access, rectify and erase your data, to restrict its processing and to data portability (Art. 15–20 GDPR). Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR); this does not affect the lawfulness of processing before the withdrawal. To exercise these rights, contact contact@quavon.de.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.