Privacy policy for this website

1.In short

This website sets no cookies, stores nothing permanently on your device and uses no analytics. That is why there is no consent banner: there would be nothing to consent to.

The fonts are served from our own server. Loading this page makes no connection to Google Fonts. The separate email confirmation page connects to our sign-in service Supabase, as described below.

The privacy policy for the app is a different document and lives on its own page.

2.Controller

3.Visiting the site (server logs)

This website is hosted by Vercel Inc. When you open a page, the host processes technically necessary connection data: IP address, time of the request, the address requested, the amount of data transferred, the referring address, and details about your browser and operating system.

This is technically unavoidable when serving a website. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the site. The logs are used to fend off attacks and to find faults, not to analyse your behaviour, and we do not combine them with other data.

The site itself is static, so no application of ours runs on the server. A data processing agreement under Article 28 GDPR is in place with the host. Where transfers to the United States occur, they rely on the European Commission’s standard contractual clauses.

4.Storage on your device

Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) requires consent where information is stored on, or read from, your device.

There is exactly one case on this site: if you switch the appearance between dark and light at the top of the page, the browser remembers that choice for the session in sessionStorage. It disappears when you close the tab. Under section 25(2) no. 2 TDDDG no consent is required, because the storage is strictly necessary to provide the service you expressly requested.

There is no identifier that makes you recognisable, and nothing that outlives the tab.

5.Confirming an email for your Babu account

When you open a Babu confirmation link, the confirmation page processes its one-time code and sends it directly to Supabase Auth after you confirm. For older links, it checks an already confirmed sign-in there. Supabase also receives the necessary connection data, including your IP address. The page stores neither link codes nor sign-in tokens in cookies or browser storage and removes them from the displayed address. Account processing is described in the app privacy policy.

The legal basis is Article 6(1)(b) GDPR: confirming your email address is necessary to provide the account you asked for. Supabase acts as a processor; a data processing agreement under Article 28 GDPR is in place. The project is configured for a region in the European Union; under Supabase’s data processing agreement, data is stored and primarily processed in the region the customer selects. Where transfers cannot be avoided technically, the European Commission’s standard contractual clauses apply.

6.Contacting us

If you write to us by email, we process your address and the content of your message in order to reply. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) otherwise. We delete correspondence once it is dealt with and no retention obligations apply. There is deliberately no contact form: a form would have to send your input somewhere, whereas an email goes directly from your own program to us.

7.Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on a legitimate interest (Article 21).

Please send requests to support@babusleep.app.

You may also lodge a complaint with a supervisory authority (Article 77 GDPR). The authority responsible for us is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Postfach 1349, 91504 Ansbach.