Privacy notice

Datenschutzerklärung nach Art. 13 DSGVO.

1. Controller

Eike Niehs
Hagenring 87, 38106 Braunschweig, Germany
E-Mail: info@eikeniehs.de

2. What this app does

Timer shows shared countdown timers. Anyone with a timer link can view it without an account. Administrators (invited users) can create and control timers.

3. Data processed when you view a timer

• Server logs. Like every website, our web server records your IP address, the requested URL, time, browser type and referrer. Purpose: operating the service and preventing abuse. Legal basis: Art. 6 (1) (f) GDPR. Retention: up to 90 days (log rotation).
• Device identifier. Your browser stores a random identifier in its local storage (no cookie). It is sent to the server when you open a timer so that optional features (e.g. group assignment) can recognise your device. It is not linked to your name or account. Legal basis: Art. 6 (1) (f) GDPR. You can delete it by clearing your browser's site data.
• Group assignment (only if the timer has the Groups feature enabled). The device identifier is stored together with the assigned group number for that timer. Deleted when the timer is deleted or an admin resets the groups.
• Poll votes (only if the timer has the Polls feature enabled and you answer a poll). Your device identifier is stored together with the answers you picked, so that you can change your mind and cannot vote twice. The app never shows who voted for what, to administrators or to anyone else — only the total per answer. Legal basis: Art. 6 (1) (f) GDPR. Deleted when the poll or the timer is deleted, and, if the administrator set it up that way, when the timer is stopped.
• Push notifications (only if you tap "Notify me" and grant permission). Your browser creates a push subscription (an endpoint URL and encryption keys) that we store together with the timer and your device identifier. Notifications are delivered through your browser vendor's push service (e.g. Apple, Google, Mozilla), which receives the encrypted message. Legal basis: your consent, Art. 6 (1) (a) GDPR; withdraw at any time by disabling notifications in the app or in your browser settings, which deletes the subscription. Subscriptions are also deleted when the timer is deleted or when the push service reports them as expired.
• Sound and screen settings are stored only in your browser's local storage and never sent to us.

4. Data processed for administrators

Administrators register via an invitation link with name, e-mail address and a password (stored as a salted hash). A session cookie (session, HttpOnly, valid 30 days) keeps you logged in. Legal basis: Art. 6 (1) (b) GDPR. Accounts are deleted on request to the controller.

5. Account requests

If you ask for an account through the request form, we store the name, e-mail address and reason you enter until the request has been decided, and keep the decision (approved or rejected) with the address as a record. Legal basis: Art. 6 (1) (b) GDPR (steps prior to entering into a contract of use) together with Art. 6 (1) (f) GDPR. You may withdraw a request at any time by writing to the controller, and it is then deleted.

6. Spam protection (Cloudflare Turnstile)

The account request and password reset forms are protected by Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open one of these forms, your browser loads a script from challenges.cloudflare.com, and Cloudflare processes your IP address, browser and device characteristics and interaction data to tell people from bots. Purpose and legal basis: our legitimate interest in keeping the forms free of automated abuse, Art. 6 (1) (f) GDPR. Transfer to the USA is covered by the EU standard contractual clauses and Cloudflare's certification under the EU–US Data Privacy Framework. Cloudflare's privacy notice: cloudflare.com/privacypolicy. No other page of this app loads anything from Cloudflare.

7. E-mail

We send e-mail for three purposes: invitation links, confirmation and notification of account requests, and password reset links. Reset links are stored only as a hash and expire after one hour. Mail is dispatched through our mail provider (STRATO AG, Pascalstraße 10, 10587 Berlin) as a processor. Legal basis: Art. 6 (1) (b) and (f) GDPR.

8. Hosting

The app runs on a server operated by us and hosted at Realtoxmedia, Felix Gassan, Talweg 4s, 21149 Hamburg. No data is shared with third parties beyond the push services mentioned above and the hosting provider as a processor.

9. No tracking

This app uses no analytics, no advertising and no third-party fonts. The only third-party script is the Turnstile captcha described in section 6, and it is loaded on the two public forms only.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object (Art. 15–21 GDPR), and to lodge a complaint with a supervisory authority. Contact: info@eikeniehs.de.

Last updated: 15.09.2026