Privacy Policy

Last updated: 8 July 2026

1. Data Controller

The controller within the meaning of the GDPR is:

Balane GmbH
Balanstraße 84, 81541 Munich, Germany

Email: contact@balane.tech
Managing Director: Jonas David Höttler

2. Data Protection Officer

We have not appointed a data protection officer, as the statutory requirements (Art. 37 GDPR, § 38 BDSG) do not apply. For any data protection matters, contact contact@balane.tech.

3. General Information

SSL/TLS encryption

This website uses SSL/TLS encryption (recognisable by „https://“ in the address bar).

Fonts

We use „Space Grotesk“ and „IBM Plex Mono“, embedded at build time and served exclusively from our hosting provider (self-hosting). No connection to Google servers is made when you visit.

Automated decision-making

Profiling within the meaning of Art. 22 GDPR does not take place.

4. Hosting & Server Logs (Vercel)

Hosting provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. On each visit, technical data is stored in server log files (IP address, date/time, retrieved file, referrer, browser/OS).

Purpose: technical provision, system security. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest). Storage: typically 7–30 days. Transfer to the USA under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) plus a data processing agreement (Art. 28 GDPR) with EU Standard Contractual Clauses.

5. User Account & Sign-in (GitHub, Supabase)

Sign in with GitHub

You can sign in via GitHub (OAuth 2.0). When you click „Continue with GitHub“ you are redirected to GitHub, which processes your data as its own controller (GitHub B.V. / GitHub, Inc. — their privacy policy applies). After a successful sign-in we receive the data required to run your account: GitHub user ID, email address, username and, where applicable, avatar.

Purpose: provision and administration of your account. Legal basis: Art. 6 (1) (b) GDPR (performance of the user relationship).

Auth & database (Supabase)

Authentication and our database run on Supabase Inc. (a US company; project infrastructure on Amazon Web Services). Your account data and — where you use them — your profile, vote and submission data are stored there. We have a data processing agreement with Supabase (Art. 28 GDPR); any transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46 GDPR).

Sign-in cookie

For sign-in we set a strictly necessary session cookie. Legal basis: § 25 (2) No. 2 TDDDG (strictly necessary). Sign-in is not possible without it; no consent is required.

Recording your consent

When you accept the Terms and this Privacy Policy during registration (or confirm the liability notice when connecting an API key), we record that consent: your user ID, the context (registration or API connection), the version of the accepted documents and the timestamp. Purpose: proof of consent. Legal basis: Art. 6 (1) (c) and (f) GDPR (legal accountability obligations and our legitimate interest in documentation). These records are deleted together with your account.

Public profile & deletion

In public we only ever show your chosen pseudonym — your email is never published. You can have your account and associated data deleted at any time via contact@balane.tech.

6. Reach Measurement (Umami)

We use Umami (privacy-friendly open-source analytics) on our own instance. Umami sets no cookies and does not access device information within the meaning of § 25 (1) TDDDG. It collects a hashed IP address, anonymised device/browser info, page viewed, referrer and timestamp. Legal basis: Art. 6 (1) (f) GDPR. Hosted on Railway Corp. (USA, servers in Amsterdam/EU) under a data processing agreement (Art. 28 GDPR) with SCCs.

7. Contact by Email

If you contact us by email, we store your details to handle the request. Legal basis: Art. 6 (1) (b) or (f) GDPR. Email provider: IONOS SE, Montabaur (servers in Germany), under a data processing agreement (Art. 28 GDPR).

8. Recipient Overview

Processors pursuant to Art. 28 GDPR: Vercel Inc. (USA) – hosting; Supabase Inc. (USA/AWS) – auth & database; Railway Corp. (USA, servers EU) – Umami analytics; IONOS SE (Germany) – email. No transfer to third parties for advertising takes place.

9. Your Rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), withdrawal of consent (Art. 7 (3)) and to lodge a complaint with a supervisory authority (Art. 77, see section 11). Exercise informally via contact@balane.tech.

10. Right to Object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR (legitimate interest). Contact: contact@balane.tech.

11. Competent Supervisory Authority

Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany · www.lda.bayern.de

12. Changes

We amend this policy as legal requirements or our services change. The version currently available applies. Last updated: 8 July 2026.