Privacy policy

Last updated: 20 October 2026 · Applies to stapelwerk.dev and app.stapelwerk.dev · Convenience translation; only the German version (Datenschutzerklärung) is legally binding.

1. Controller

Sebastian Schmidt, Zottenjochstr. 7b, 83661 Lenggries, Germany
Email: security@stapelwerk.dev · Phone: +49 (0) 89 24881281

2. The essentials

This website uses no analytics or tracking services, loads no content from third-party servers (no external fonts, scripts or embedded videos) and uses no cookies on the start page. The only thing stored locally in your browser is your language choice.

3. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by https:// and the padlock symbol in your browser's address bar. With encryption active, the data you send to us cannot be read by third parties.

No data protection officer has been appointed, as there is no legal obligation to do so.

4. Hosting and server log files

This website runs on our own infrastructure in Germany. When you access it, the server necessarily processes: IP address, date and time of access, requested URL, referrer URL, user agent (browser/operating system) and the HTTP status code. This data is required to deliver the website and to fend off attacks (Art. 6(1)(f) GDPR — legitimate interest in secure operation). Log data is not combined with other data sources and is deleted regularly, at the latest after 14 days, unless a security incident requires longer retention.

5. Cloudflare (DNS and www redirect)

The domain's DNS is managed by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Requests to www.stapelwerk.dev are answered through the Cloudflare network with a redirect to stapelwerk.dev; in doing so, Cloudflare processes technically necessary connection data (including the IP address) as a processor (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. Requests to the main domain itself do not pass through the Cloudflare network. More information: Cloudflare Privacy Policy.

6. Local storage (language choice)

The start page remembers your language choice (German/English) in your browser's localStorage. This information does not leave your device and is required for the function you asked for (§ 25(2) no. 2 TDDDG); no consent is needed for it. You can delete it at any time in your browser's site data settings.

7. Web app (app.stapelwerk.dev)

7.1 Account and sign-in

Composing, checking and exporting also work in the web app without an account; saving stacks and the other account features require a user account. When you sign up, you only enter your email address (and optionally a name); you then set your password via a confirmation link sent by email, and only then does the account become active. We process your email address, name (optional), a password hash, the time of confirmation and the content you create (e.g. stacks, configurations, deployments). The legal basis is Art. 6(1)(b) GDPR (performance of a contract or the user relationship). For sign-in, the app uses technically necessary session cookies, and for your language choice the cookie bms_locale (both § 25(2) no. 2 TDDDG); no tracking cookies are used. Account data is deleted when the account is deleted, unless statutory retention obligations apply.

7.2 Emails about your account

We send confirmation and password reset emails through our own mail server in Germany, without tracking (no tracking pixels, no link redirects). The links work once and expire after 24 hours (confirmation) or 1 hour (password); only a cryptographic hash of the link is stored. Unconfirmed sign-ups contain only the email address and are deleted automatically once they are older than seven days (at the latest at the next sign-up through the app). The legal basis is Art. 6(1)(b) GDPR.

7.3 Payment processing via Polar

Paid services (e.g. the one-time "Verified Deploy" report) are processed by Polar Software, Inc. as merchant of record. The purchase contract for the payment is concluded with Polar; Polar processes the data you enter at checkout (including email address, billing and payment data) under its own responsibility. We ourselves receive no payment data, only order metadata (including order number, product and your account ID), in order to provide the purchased service (Art. 6(1)(b) GDPR). Polar is a company based in the USA; processing at checkout takes place under Polar's own data protection responsibility, including a possible transfer to the USA. Details: Polar Privacy Policy.

7.4 Deploys to your own servers

The hosted web app does not deploy to your servers: the exported deploy.sh runs on your computer and connects with your own SSH key. We do not collect or store SSH keys or access credentials for your servers.

7.5 Storage in your browser

The web app stores in your browser only what its features need: your current stack draft and local copies of your stacks, display settings (colour scheme, accent colour, font size), the deploy target you last chose per stack, view settings of the service catalogue, recently used commands, and in the cookie sidebar_state whether the sidebar is collapsed (7 days). This information stays on your device unless you save a stack to your account (7.1), and it is required for the features you use (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser's site data settings.

7.6 Recommendations

When you are signed in, the app counts how often recommendations and templates are shown, clicked or applied — only as a total per recommendation or template, with no reference to you. If you rate or dismiss a recommendation, we store this feedback with your account ID to improve the recommendations (Art. 6(1)(f) GDPR) and delete it together with your account. Without signing in, we store nothing of this.

8. Contacting us

If you contact us by email, we process your details (email address, content) to handle your request (Art. 6(1)(b) or (f) GDPR). The data is deleted as soon as it is no longer needed to handle the request.

9. Your rights

Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20)
Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 — see the highlighted notice in section 10)
Complaint to a data protection supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany

An email to security@stapelwerk.dev is enough to exercise your rights.

10. Right to object and withdrawal of consent

NOTICE OF YOUR RIGHT TO OBJECT UNDER ART. 21 GDPR: Where we process personal data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Should we base processing on consent in the future, you can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of the processing carried out before the withdrawal remains unaffected.

11. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

12. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.