Privacy policy

Controller

André Leifert
Unter dem Sonnenhang 7
34212 Melsungen
Deutschland
kontakt@cssettings.de

Purposes and legal bases

Account creation, login, profile and settings functions are processed to provide the requested service (Article 6(1)(b) GDPR). Security, abuse prevention and service integrity are based on legitimate interests (Article 6(1)(f) GDPR). Data is also processed where necessary to comply with legal obligations (Article 6(1)(c) GDPR).

Account and profile data

For your account, CSSettings.de processes your email address, username, password hash, verification status and, if enabled, an encrypted 2FA secret. Profile data, CS2 settings and notification preferences that you provide are also processed. Passwords are stored only as one-way hashes.

Public profiles

Profile information, optional external profile links, CS2 settings and comments you publish are visible to other visitors only where the relevant profile is public, the account email is verified and the profile has not been hidden by moderation. Private profiles remain hidden from other visitors.

Technical usage data

The server processes technically necessary connection data such as IP address, request time and requested resource to provide and secure the service. For rate limits and daily deduplication of profile views and settings copies, HMAC-based pseudonymous identifiers are derived from network and session characteristics; the raw values are not stored in the corresponding application tables.

Email verification and account recovery

The email address is used for account verification and password recovery. Verification links expire after 24 hours and password-reset links after one hour. Used or expired tokens are deleted during regular maintenance.

Content reports and moderation

When content is reported, CSSettings processes the reported URL, report reason, explanation, contact email where provided, account reference where applicable and the moderation decision. This is used to review reports, enforce the terms and meet applicable legal obligations.

Recipients

Data is processed by the hosting and technical service providers required to operate CSSettings. Email delivery infrastructure receives the data necessary to send verification and password-reset messages. Data is disclosed to authorities or other recipients only where legally required or otherwise permitted.

Cookies

CSSettings.de uses a technically necessary session cookie for login and security and a cookie for the selected language. Advertising or analytics cookies are not used.

Storage and deletion

Account, profile, settings and comment data is generally stored until you delete it or delete your account, unless legal obligations or legitimate reasons require longer retention. Email verification links expire after 24 hours and password reset links after one hour. Read notifications are removed after 180 days, metric deduplication data after 35 days and rate-limit data after one day by regular maintenance. Report and moderation records are retained for as long as necessary for handling reports, legal obligations or legal defence.

Your rights

Subject to the legal requirements, you may request access, rectification, deletion, restriction, data portability or object to processing. You may also lodge a complaint with a competent data protection authority.

Right to lodge a complaint

You may lodge a complaint with a competent data protection supervisory authority. For the controller in Hesse, the competent supervisory authority is the Hessian Commissioner for Data Protection and Freedom of Information.

Security

CSSettings.de protects account and profile data through encrypted transmission, protected sessions, access controls, input and upload validation and other appropriate technical and organizational measures.