Privacy Policy

Last updated: March 26, 2026

Applies to: keta.lol — operated by Nils Becker, Berlin, Germany

1. Data Controller (Art. 13(1)(a) GDPR)

The controller within the meaning of the General Data Protection Regulation (GDPR) and the German Telecommunications-Telemedia Data Protection Act (TTDSG) is:

Nils Becker
Berlin, Germany
Contact: via our Discord server
Website: https://keta.lol

As keta.lol is operated as a non-commercial hobby project with fewer than 20 employees, there is no statutory obligation to appoint a Data Protection Officer. For all privacy inquiries, please contact the controller directly.

2. Data Processing Principles (Art. 5 GDPR)

We process personal data only:

lawfully, fairly, and in a transparent manner
for specified, explicit, and legitimate purposes
in a data-minimised way — only what is necessary for the respective purpose
accurately and kept up to date
for no longer than is necessary
with appropriate technical and organisational security measures

3. What Data We Collect and Why

3.1 Account Data (at Registration)

Data Category	Purpose	Legal Basis	Retention
Username	Required	Display profile, login	Art. 6(1)(b) GDPR (contract)	Until account deletion
Email address	Required	Login, password reset, security notices	Art. 6(1)(b) GDPR	Until account deletion
Password (bcrypt hash, cost factor 12)	Required	Authentication	Art. 6(1)(b) GDPR	Until account deletion
Invite code (used by whom)	Required	Abuse prevention	Art. 6(1)(f) GDPR	Indefinitely (anonymised after 1 year)
Account creation date	Automatic	Display, badge eligibility	Art. 6(1)(b) GDPR	Until account deletion
Display name, bio, profile picture, background video	Voluntary	Public profile	Art. 6(1)(b) GDPR	Until account deletion or manual removal

3.2 IP Addresses and Access Logs

Every request to our service processes the following data server-side:

IP address: Before storage, the last octet (IPv4) or last 64 bits (IPv6) are set to zero (IP anonymisation). The full IP address is never stored.
Timestamp, HTTP method, requested path, HTTP status code, response time
User-agent string (browser/OS, truncated to 120 characters)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest: IT security, abuse detection, error diagnosis).
Retention: Access logs are automatically deleted after 30 days at most. Suspicious activity logs (attack detection) after 90 days.

3.3 Profile View Logs (profile_view_log)

When your public profile is visited, we store:

IP hash: HMAC-SHA256 of the anonymised IP address with a server-side salt. Not reversible, not portable across installations.
Visitor ID (only with consent — see §3.4)
Timestamp of the visit

This data is used exclusively to display the profile view count to the profile owner.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the profile owner in view statistics).
Retention: Profile view logs are deleted after 90 days at most.

3.4 Visitor ID (anonymous tracking — consent only)

With your consent, we store a randomly generated UUID (keta_vid) in your browser's local storage. This ID:

is fully random and contains no information about you personally
is used solely to deduplicate profile views within a 24-hour window (so one browser is not counted multiple times)
is not a cookie — it lives in your browser's localStorage
is not shared with any third-party website
is immediately deleted from your browser when you withdraw consent

Legal basis: §25(1) TTDSG in conjunction with Art. 6(1)(a) GDPR (consent).
Without consent: An ephemeral, non-stored one-time ID is generated. Deduplication uses IP hash only.
Withdraw consent: At any time via Privacy Settings below.

3.5 Uploaded Files

The following file types may be uploaded: profile pictures, background videos, background images, cursor graphics, OG images, audio files, custom button icons.

All uploaded images are re-encoded server-side by Sharp before storage. During this process:

EXIF metadata (GPS location, camera model etc.) is completely removed
hidden payloads (polyglot files) are neutralised by re-encoding
filenames are replaced with a random UUID

Legal basis: Art. 6(1)(b) GDPR.
Retention: Until account deletion or until the user replaces the file with a new one (old files are deleted immediately).

3.6 Discord Presence Data

If you link your Discord account and enable the Discord presence display, our Discord bot receives and stores the following data from Discord:

Discord username and display name
Online status (online, idle, dnd, offline)
Avatar URL and avatar decoration
Currently played game (name, details, state)
Spotify activity (song title, artist, album, album art) — if publicly visible in Discord
Custom status text and emoji
Clan tag (if present)

This data is updated in real time and displayed on your public profile if you have enabled it in profile settings. You can disable the display at any time in your settings.
Legal basis: Art. 6(1)(a) GDPR (consent by activating the feature).
Retention: Until the feature is disabled or the account is deleted. Discord is an independent controller: discord.com/privacy.

3.7 Two-Factor Authentication (TOTP)

If you enable 2FA, a secret TOTP key (Base32-encoded) is stored in our database. This key never leaves our servers in plaintext.
Legal basis: Art. 6(1)(b) GDPR.
Retention: Until 2FA is disabled or account deleted.

3.8 Password Reset Tokens

During a password reset, a cryptographically secure token (SHA256 hash, 32 bytes of entropy) is stored in the database. The token expires after 1 hour and is deleted immediately upon use. Expired, unused tokens are automatically purged after 2 days.
Legal basis: Art. 6(1)(b) GDPR.

4. Cookies and Local Storage (TTDSG §25)

Name	Type	Purpose	Legal Basis	Retention
token	HttpOnly cookie	JWT authentication token. Keeps you logged in. Not accessible by JavaScript.	§25(2) TTDSG (technically necessary) — no consent required	30 days
keta_vid	localStorage entry	Random UUID to deduplicate profile views. No personal reference.	§25(1) TTDSG + Art. 6(1)(a) GDPR (consent)	Until consent is withdrawn
keta_consent	localStorage entry	Stores your cookie preferences including timestamp as proof of consent.	§25(2) TTDSG (technically necessary to implement your choice)	Until withdrawn or browser data cleared

You have not yet given consent, or your consent has already been withdrawn.

5. Third-Party Services and Data Processors

The following table provides an overview of all third-party services we use, their role under GDPR, applicable transfer mechanisms, and the status of Data Processing Agreements (Art. 28 GDPR).

Service	GDPR Role	Country	Transfer Basis (Art. 44–46)	DPA Required	DPA in Place
Cloudflare	Processor (Art. 28)	USA	EU–US DPF ✓ + SCCs Module 2	Yes	✅ Signed
Resend	Processor (Art. 28)	USA	EU–US DPF ✓ + SCCs	Yes	✅ Signed
Discord	Independent Controller (Art. 4(7))	USA	Discord's own DPF certification	No	N/A
Hetzner Online	Processor (Art. 28)	Germany 🇩🇪	No transfer — EU-only processing	Yes	✅ Signed

5.1 Cloudflare (CDN, DDoS Protection, WAF)

Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

Role: Data processor under Art. 28 GDPR. Cloudflare acts as a reverse proxy between the internet and our server. All visitor IP addresses and request data pass through Cloudflare before reaching our servers.

Data transmitted: Full IP addresses, HTTP request headers, requested URLs, response metadata. Cloudflare may set technically necessary cookies (e.g. __cf_bm, cf_clearance) for bot detection and DDoS mitigation — these are technically necessary under §25(2) TTDSG and do not require consent.

Legal basis for third-country transfer (Art. 44 GDPR):

EU–US Data Privacy Framework (DPF): Cloudflare is certified under the EU–US DPF (DPF registry entry). The European Commission issued its adequacy decision for the DPF on 10 July 2023 (Art. 45 GDPR).
Standard Contractual Clauses (SCCs): Cloudflare additionally offers SCCs (Module 2: Controller-to-Processor) as a supplementary safeguard under Art. 46(2)(c) GDPR.

Art. 28 DPA: A Data Processing Agreement has been concluded with Cloudflare via the Cloudflare Customer DPA.

5.2 Resend (Transactional Email)

Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.

Role: Data processor under Art. 28 GDPR. Resend processes personal data solely on our behalf and under our instructions.

Data transmitted: Email address of the recipient and the content of transactional emails (password reset links, email verification links, security alert notifications). No marketing emails are sent.

Legal basis for processing: Art. 6(1)(b) GDPR (password reset / email verification — necessary for contract performance); Art. 6(1)(f) GDPR (security notifications — legitimate interest in account security).

Legal basis for third-country transfer (Art. 44 GDPR):

EU–US Data Privacy Framework (DPF): Resend is certified under the EU–US DPF (DPF registry entry).
Standard Contractual Clauses (SCCs): SCCs (Module 2: Controller-to-Processor) are incorporated into the Resend DPA as an additional transfer safeguard under Art. 46(2)(c) GDPR.

Art. 28 DPA: A Data Processing Agreement has been concluded with Resend. The DPA is available at resend.com/legal/dpa.

5.3 Discord (Presence Widget, optional account linking)

Discord Inc., 444 De Haro Street, San Francisco, CA 94107, USA.

Role: Independent data controller under Art. 4(7) GDPR. Discord determines the purposes and means of its own data processing independently. Discord is not our processor — no Art. 28 DPA is required or applicable.

When Discord is involved: Only if you voluntarily link your Discord account and/or enable the presence display widget in your profile settings. If you do not use this feature, no data is exchanged with Discord.

Data involved: Discord username, display name, avatar, online status, activity (game, Spotify), custom status. This data is received from Discord via our bot and displayed on your public profile while the feature is enabled.

Legal basis: Art. 6(1)(a) GDPR (your explicit consent by activating the feature). You can withdraw consent at any time by disabling the presence display in your profile settings.

Third-country transfer: Discord is certified under the EU–US Data Privacy Framework (DPF) for its own processing. See Discord DPF entry.

Discord privacy policy: discord.com/privacy

5.4 Hetzner Online (Server Hosting)

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. (EU/EEA entity)

Role: Data processor under Art. 28 GDPR. Hetzner provides the physical and virtual server infrastructure on which our application and database run.

Data processed: All personal data stored in our database and on our servers (account data, profile content, uploaded files, log files) resides on Hetzner infrastructure.

Third-country transfer: None. All servers are located in Germany (Nuremberg data centre). Processing remains entirely within the EU/EEA. No Art. 44–46 transfer mechanism is required.

Art. 28 DPA: A Data Processing Agreement has been concluded with Hetzner Online GmbH. Hetzner's GDPR documentation and DPA are available at hetzner.com/legal/gdpr.

6. Retention Periods at a Glance

Data Category	Retention Period	Automated Deletion
Account data (email, username, password hash)	Until account deletion	No — triggered by user action
Profile content (bio, images, videos, social links)	Until account deletion or manual removal	Partial — replaced files deleted immediately
Profile view logs (profile_view_log)	Maximum 90 days	Yes — nightly batch job
Access logs (access.log)	Maximum 30 days	Yes — nightly batch job
Suspicious activity logs (suspicious.log)	Maximum 90 days	Yes — nightly batch job
Security incident log (security_incidents)	Maximum 90 days after resolution	Yes — nightly batch job
Password reset tokens	Maximum 2 days after expiry	Yes — nightly batch job
Email verification codes	Maximum 3 days after expiry	Yes — nightly batch job
Visitor ID (keta_vid)	Until consent is withdrawn (client-side in localStorage)	No — deleted on consent withdrawal
Discord presence data	Until feature is disabled or account deleted	No — triggered by user action
TOTP key (2FA)	Until 2FA is disabled or account deleted	No — triggered by user action

7. Your Rights (Art. 15–22 GDPR)

You have the following rights against us as the controller at any time:

Right of access (Art. 15 GDPR): You can request a complete copy of all data stored about you.→ Feature: GET /api/auth/export — available after login in the dashboard (once per 24 hours). Downloads a structured JSON file.
Right to rectification (Art. 16 GDPR): You can correct inaccurate data directly in your profile (username, bio, email, etc.).
Right to erasure / right to be forgotten (Art. 17 GDPR): You can permanently and irreversibly delete your account and all associated data.→ Feature: DELETE /api/auth/account — password confirmation required. Deletes all database entries and uploaded files.
Right to restriction of processing (Art. 18 GDPR): In certain situations you may request that we restrict processing. Please contact us directly.
Right to data portability (Art. 20 GDPR, EU Data Act): You can download your data in a structured, machine-readable JSON format.→ Feature: GET /api/auth/export — returns complete JSON with all account, profile, and analytics data.
Right to object (Art. 21 GDPR): You may object at any time to processing based on Art. 6(1)(f) GDPR (legitimate interest).
Right to withdraw consent (Art. 7(3) GDPR): Consent (in particular for analytics/Visitor ID) may be withdrawn at any time, without affecting the lawfulness of processing prior to withdrawal.→ Feature: Withdraw button in Section 4 of this page, or via the cookie banner.
Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with the competent supervisory authority:
Berlin Commissioner for Data Protection and Freedom of Information — datenschutz-berlin.de

To exercise your rights, contact us via our Discord server. We respond within 30 days (Art. 12(3) GDPR).

8. Technical and Organisational Security Measures (Art. 32 GDPR)

We implement the following measures to protect your data:

Transport encryption: All connections use TLS 1.2/1.3 exclusively (HTTPS). HTTP is redirected to HTTPS.
Password storage: Passwords are stored exclusively as bcrypt hashes with cost factor 12. Plaintext passwords never leave our servers.
JWT security: Auth tokens are transmitted as HttpOnly, Secure, SameSite=Strict cookies and are not accessible to JavaScript. Session invalidation via token versioning on password change and logout.
Two-factor authentication: TOTP (RFC 6238) is voluntarily available to all users.
IP anonymisation: Before any logging or database storage, the last byte (IPv4) or last 64 bits (IPv6) of the IP address are set to zero.
File upload security: All uploads are validated by magic byte inspection, re-encoded by Sharp (metadata stripping, polyglot protection) and stored under a random UUID. The upload path is protected by Content-Security-Policy (CSP).
Rate limiting: All API endpoints are protected against brute-force and abuse by multi-tier rate limiting.
Web Application Firewall: Cloudflare WAF with custom rules protects against path traversal, SQL injection, and known scanners.
Content Security Policy: Strict CSP headers prevent execution of scripts from unauthorised sources, especially on the upload path.
EU hosting: All servers are located in German data centres (Hetzner, Nuremberg). No third-country transfer of server data.

9. Data Breaches (Art. 33–34 GDPR)

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

notify the competent supervisory authority without undue delay, and where feasible within 72 hours (Art. 33 GDPR)
notify affected users without undue delay where the breach is likely to result in a high risk (Art. 34 GDPR)
document the nature, scope, and effects of the breach and the remedial measures taken

10. Minors

Keta.lol is not intended for persons under the age of 16. We do not knowingly collect personal data from persons under 16. If you are aware that a child has submitted data to us, please contact us via our Discord server so we can delete the data without delay.

11. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes to our services or legal requirements. Material changes will be announced via a notice on the website. The date of the last update is shown at the top of this page. Your continued use of the service after a change constitutes acceptance of the revised Privacy Policy.

12. Contact and Complaints

Nils Becker — Operator of keta.lol
Contact: Discord server
Response time: maximum 30 days (Art. 12(3) GDPR)

Competent supervisory authority (right to lodge a complaint under Art. 77 GDPR):
Berlin Commissioner for Data Protection and Freedom of Information

← Back to Keta.lol