Privacy Policy

1. Controller

The controller responsible for processing personal data on beastyrabbit.com is:

E-mail: datenschutz-beastyrabbit@heerlab.com

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

This policy explains which personal data is processed when you use BeastyPage, for what purposes, on which legal basis, and for how long. BeastyPage is a private, non-commercial project. Voluntary support via Ko-fi is possible; nothing is offered in return. BeastyPage offers generators, tools and small games about pixel cats (based on ClanGen sprites), including livestream tools, a file-sharing service (Quick Share) and a Discord bot.

Personal data is not sold and not used for advertising. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

3. Hosting and delivery

BeastyPage runs on the controller's own server infrastructure in Germany. Requests from the internet reach the application through a reverse proxy on a virtual server operated by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (data center in Nuremberg). netcup processes the data as a processor under a data processing agreement pursuant to Art. 28 GDPR. The connection is TLS-encrypted up to the reverse proxy and forwarded from there to the controller's infrastructure through an encrypted tunnel.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure and reliable provision of the website.

For data protection against loss, backup copies are created regularly within the controller's own infrastructure; they are overwritten once their retention period expires.

4. Server log files

For every request, the reverse proxy automatically stores the following data:

• IP address of the requesting device
• date and time of access
• requested address (path including parameters), HTTP method and protocol
• HTTP status code, amount of data transferred, and response time
• browser identifier (user agent)
• TLS version and cipher used
• target service

The Cookie and Authorization headers are redacted. URL paths and query parameters are logged.

This data is used to operate the site, analyse errors, and defend against attacks and abuse. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the stability and security of the service. Log files are deleted automatically after 14 days.

The reverse proxy, its security software and the application also keep technical logs containing connection, security and error data, which may include IP addresses and technical identifiers. They support operation, troubleshooting and attack defence under Art. 6(1)(f) GDPR; this is the legitimate interest. They are normally deleted after no more than 30 days.

5. Protection against attacks (CrowdSec)

To protect against attacks, the security software CrowdSec automatically analyses the server log files and blocks IP addresses that are clearly the source of attacks (for example mass login attempts or scanning for vulnerabilities). When CrowdSec detects an attack, the IP address, time and type of attack are sent to CrowdSec SAS, 20 rue Maurice Arnoux, 92120 Montrouge, France. CrowdSec uses these reports for a shared blocklist that protects many servers. No data is sent to CrowdSec during normal browsing.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is protecting the website and its users from attacks.

According to CrowdSec, the controller and CrowdSec are jointly responsible for this processing (Art. 26 GDPR): CrowdSec is responsible for operating its central services and blocklists, the controller for its use on this server. You can exercise your rights against either of them; CrowdSec can be reached at dpo@crowdsec.net. CrowdSec may pass the reported data on to members and partners of its network. According to CrowdSec, transfers to countries outside the EU are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Full IP addresses are generally retained for no more than three months and then progressively generalised. CrowdSec describes exceptions of up to one year before anonymisation for certain attack analyses and training purposes. Details: crowdsec.net/privacy-policy.

6. User account and content

User account

For your account, BeastyPage stores your Clerk ID and username, which may be derived from your name or e-mail address, along with settings and an API key for stream tools. Sign-in is provided by Clerk (see section 7).

Content you create

Stored content includes settings, cats, ancestry trees, Catdex entries, game and voting data, and stream sessions. Public or shared content is visible to others. Uploaded images are stored as uploaded, including their metadata.

Quick Share

Quick Share processes files, filenames and IP addresses for file sharing and abuse protection. Links expire after 1–30 days. Files and IP addresses are deleted after 30 days.

Discord bot

The Discord bot processes your Discord ID and preferences. Your display name is stored as the public creator name. The /palette command stores the selected image, including metadata, under a public link. The image or its metadata may relate to other people; the legal basis for this is Art. 6(1)(f) GDPR, with the legitimate interest of providing the requested palette. Section 8 covers Discord itself.

Data is stored on the controller's own infrastructure in Germany. The legal basis is Art. 6(1)(b) GDPR; moderation, abuse protection and third-party data are covered by Art. 6(1)(f) GDPR. The legitimate interests are secure operation and providing the requested features.

Otherwise, account and content data is stored until you delete it or request deletion, at most up to 10 years. Send deletion requests to datenschutz-beastyrabbit@heerlab.com.

7. Clerk (authentication)

Clerk, Inc., 660 King Street Unit 345, San Francisco, CA 94107, USA, is used as a processor for technically necessary sign-in and account management. Clerk processes sign-in, account and security data and receives IP addresses and browser data when public pages load. Processing takes place in the USA; Clerk is certified under the EU-US Data Privacy Framework, and its data processing agreement includes Standard Contractual Clauses. The legal basis is Art. 6(1)(b) GDPR for sign-in and accounts, and Art. 6(1)(f) GDPR for providing and securing sign-in.

The retention periods in section 6 apply to account data. You can request deletion at datenschutz-beastyrabbit@heerlab.com. Both the Clerk account and the data stored in BeastyPage are then deleted. Details: Clerk privacy policy.

During registration, Clerk may use Cloudflare Turnstile to prevent bots, processing IP addresses and browser data (Art. 6(1)(f) GDPR; Cloudflare privacy policy).

8. Sign-in with Discord, GitHub or Twitch

Only if you choose this sign-in option are you redirected to Discord, GitHub or Twitch. The provider processes your sign-in under its own responsibility and passes your account identity to Clerk. The legal basis for your chosen sign-in is Art. 6(1)(b) GDPR. Retention by each provider follows its privacy policy.

• Discord: Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands, and Discord Inc., 444 De Haro Street #200, San Francisco, CA 94107, USA. Discord Inc. is certified under the EU-US Data Privacy Framework. Details: Discord privacy policy.
• GitHub: GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA. GitHub is certified under the EU-US Data Privacy Framework. Details: GitHub privacy statement.
• Twitch: Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA. Twitch processes data in the USA. No adequacy decision or DPF certification for Twitch could be verified. You decide whether to use this provider by choosing this sign-in option. Details: Twitch privacy notice.

9. Umami (analytics) and GlitchTip (error tracking)

The controller self-hosts Umami (umami.heerlab.com) and GlitchTip (glitchtip.heerlab.com) in their own homelab in Germany. No external processor is used for these services.

Umami loads only after your consent. It records page views and usage events (which tools and functions are used, clicks on external links and loading speed), technical device and browser information, and an approximate location derived from the IP address. The IP address is not stored; a pseudonymous session identifier is used instead. We send no user identifier. URL parameters and fragments are removed, and paths granting access or editing rights are cleaned.

Session replay and heatmaps are recorded for a sample of visits only. All text and inputs are masked, and sign-in areas and pages of signed-in visitors are excluded from recording. Umami, replay and heatmaps are inactive on OBS overlay pages. Umami sets no cookies.

The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw consent at any time through "Cookie settings" in the footer, with effect for the future. Withdrawal reloads the page to stop recording. Section 15 describes cookies and browser storage.

Umami analytics data (pageviews and events) is deleted after 25 months. Umami session replays and heatmap recordings are deleted after 30 days. GlitchTip error events are deleted after 90 days.

GlitchTip collects technical errors without consent. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is keeping the website working and secure. Error tracking uses no cookies or browser storage. Error reports contain technical details: the error and where it occurred, browser and operating system, the cleaned page address, and the app version. Personal data such as user IDs, email addresses, cookies and form contents are removed before sending. This covers the website and its backend services.

The IP address is transmitted for technical reasons, and GlitchTip stores it only in shortened, anonymised form.

You can object to this processing under Art. 21 GDPR through the controller contact details in section 1.

10. Optional features with external requests

Wikimedia Commons

The optional random-image feature of the colour-palette creator loads data from Wikimedia Commons. The Wikimedia Foundation, Inc., 1 Sansome Street, Suite 1895, San Francisco, CA 94104, USA, receives your IP address and browser data as an independent controller, including in the USA. A specific transfer mechanism could not be verified. Retention follows the Wikimedia privacy policy.

Images from addresses you enter

If you enter an image URL, your browser loads the image from that server. Its operator receives your IP address and browser data. The recipient, processing location and retention depend on the address you choose and the operator's privacy policy.

The Color API

The palette generator and the colour-palette creator send colour values (hex codes) from your browser to The Color API (thecolorapi.com) to look up colour names and schemes. Your IP address and browser data reach the provider. Further details on the operator and transfer safeguards are not currently available.

The legal basis for these external requests is Art. 6(1)(f) GDPR; the legitimate interest is providing the feature you use.

11. Nine Lives

The /nine-lives page loads the separate game from ninelives.beastyrabbit.com only after you start it. Its processing is covered by the separate Nine Lives privacy policy. The embedded game shows no consent banner of its own and follows your analytics choice in BeastyPage's "Cookie settings", where you can change or withdraw it.

12. Links to other websites

Links to Ko-fi, Twitch, GitHub, YouTube, X, Bluesky and other websites are plain links. Data is transmitted to the linked destination only when you click. The respective provider's privacy policy then applies.

13. Contact form

If you use the contact form, the details you enter (name, e-mail address, message) and the time of the request are sent to the controller's mailbox so your request can be answered. They are not stored in a database on the server. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is being able to answer requests. To prevent spam, a hidden field and a limit on requests per IP address are used; the IP address is held only in memory until 10 minutes after your last request.

If you arrive from another website through the ?from= parameter, only that site's permitted short name is added to the subject. The form is available at beastyrabbit.com/kontakt.

Messages are sent through the e-mail service Resend, operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, as a processor (a data processing agreement under Art. 28 GDPR forms part of the terms of service). Resend stores message content and metadata (sender, recipient, subject, text) and log data in the USA and deletes them after 30 days; Resend backups are deleted after 7 days. Transfers to the USA are based on the EU-US Data Privacy Framework, under which the provider is certified, and the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Details: Resend privacy policy.

The mailbox is hosted by Fastmail (see next section), where the deletion information also applies.

14. Contact by e-mail

If you contact us by e-mail, your e-mail address, the content of your message and the technical details of the e-mail are processed to answer your request. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is being able to answer requests.

The mailboxes are hosted by Fastmail Pty Ltd, PO Box 234, Collins Street West, VIC 8007, Australia, as a processor. Data may be transferred to countries outside the EU, in particular Australia, the USA and India. For these transfers, Fastmail uses the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Details: Fastmail privacy policy, data processing agreement and Standard Contractual Clauses. You can obtain a copy of the safeguards by writing to datenschutz-beastyrabbit@heerlab.com.

The controller deletes messages after dealing with the request unless retention remains necessary. Fastmail may subsequently retain backup and log data under its published deletion rules.

15. Cookies and local storage

The following table groups cookies and browser storage by purpose.

You can change or withdraw your analytics consent at any time through "Cookie settings" in the footer (see section 9).

16. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent (Art. 7(3) GDPR): you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to object (Art. 21 GDPR): Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

To exercise your rights, simply send a message to datenschutz-beastyrabbit@heerlab.com.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

17. Obligation to provide data

You are not obliged to provide personal data. However, the website cannot be delivered without the technically necessary connection data, and account features cannot be used without signing in.

18. Changes

This privacy policy is updated when the website or the legal situation changes. The version published here applies.