Privacy

The controller responsible for data processing on this website is Patric Pesch, Sülzgürtel 64, 50937 Köln, Germany, contact@gestura.eu. No data protection officer has been appointed; the statutory conditions requiring one are not met.

No cookies are set. Three items are kept in your browser's local storage so the site behaves the way you operate it:

All three are strictly necessary for the service you explicitly requested and therefore exempt from consent under § 25(2)(2) TDDDG — which is why there is no consent banner here. None of them contains an identifier that could recognise your device, none is transmitted to the server, and all can be deleted at any time through your browser settings. The language choice lives in the page address (/de, /en) and is not stored at all.

When you submit a menu or search engine you receive a secret edit token that is stored in your own browser only. The server keeps just a hash of it (Argon2id) — the token itself is never stored and cannot be derived from the hash. This lets you update or delete your entry later without creating an account, without an email address and without a password. The legal basis is performance of the usage relationship (Art. 6(1)(b) GDPR). If you lose the token you lose access to the entry; there is no recovery path, because we hold nothing that would let us identify you.

Downloads increment an anonymous, aggregated install counter per entry. This counter cannot be traced back to a person, a device or an IP address — it is a plain number, not a record of who downloaded what.

An account is not required to use the index; it is pure convenience. An account consists solely of a random access token — of which only a short selector and a hash (Argon2id) are stored, plus the times of creation and last access. There is no email address, no name, no password and no profile. The legal basis is Art. 6(1)(b) GDPR. Accounts unused for 365 days are deleted automatically along with all associated data.

If you want to synchronise your Gestura settings across several browsers, you can transfer them through this service. Synchronisation is a second switch, independent of the general integration and with a confirmation of its own — enabling the integration does not by itself synchronise anything. The data is encrypted on your device alone and reaches the server as ciphertext only; the key never leaves your device. We can neither read nor merge the contents — merging is done by the extension. Synchronisation is addressed via an identifier derived from your secret, which is stored server-side only as a SHA-256 hash; the identifier itself is not stored and request bodies are not logged. What is stored is the ciphertext, its checksum and size, and the times of last modification. The legal basis is Art. 6(1)(b) GDPR. States not accessed for 365 days are deleted automatically.

Moderation happens in a closed administration area. It stores the name and email address of the administrating persons, their passkeys (public keys, no biometric data) and a log of administrative actions — the latter to keep decisions accountable. A cookie is set only in this area: a strictly necessary session cookie that ends when the browser is closed and is never set for visitors. Invitations to the administration area are sent by email via the hosting provider's mail server. The legal bases are Art. 6(1)(b) and (f) GDPR.

No personal data is transferred to countries outside the European Union. Servers and processors are located in Germany.

Without prejudice to other remedies, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. You may also contact the supervisory authority where you habitually reside.