Privacy notice

Last updated: 02 November 2026

1. Controller

Robin Vierheller
c/o COCENTER
Koppoldstr. 1, 86551 Aichach
E-Mail: Robin.Vierheller@gmail.com

See also the legal notice.

2. Hosting and recipients

Matchday Lab runs on a server of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe. A data processing agreement exists with the host.

To send emails (codes to confirm your address and to reset the password, invitations) we use the service Brevo (Sendinblue SAS, Paris, France) as a processor; a data processing agreement exists. Only your email address and the text of the respective message (with the code) are sent there. Legal basis is Art. 6(1)(b) GDPR (use of the access).

There are no other recipients of your data; we use no third-party analytics, advertising or tracking services and load no fonts, images or scripts from external servers.

3. Visiting the public pages

When you open a page, the web server stores in log files: IP address, date and time, requested address, status code, amount of data transferred and information about your browser (e.g. browser identifier, language). The purpose is secure and stable operation and defence against attacks. We also derive daily reach figures from these logs (visitors per day, page visited, where the visit came from, country): for this, the IP address together with the day and the browser identifier is pseudonymised into an identifier (hashed with a secret key that is stored only on the server); it changes every day and cannot be traced back to you; no cookies are set and no third-party services are used for this. Legal basis is Art. 6(1)(f) GDPR (legitimate interest). Logs and daily figures are deleted after 90 days. Anyone repeatedly entering wrong credentials is automatically blocked for a short time (one hour) based on the IP address.

4. Members area (account)

Access uses a login page with email address (or user name) and password; the password is stored only as a hash. After logging in your browser stores a technically necessary session cookie (and a short-lived security cookie when forms are submitted); the session cookie ends when you log out, after 14 days without use or after 30 days at the latest. Your email address belongs to the account: you log in with it and it is used to reset the password. We confirm it with a 6-digit code that we send you by email (sent through Brevo, see section 2); the code is valid for 15 minutes (7 days for invitations) and deleted as soon as it has been used or expires. The address is kept for as long as the account exists. If the password or the address of an account changes, we send a notice email to the confirmed address for security (on an address change to the previous one; Art. 6(1)(f) GDPR). If you use "forgot password", we record the request with time, IP address and the email address entered (protection against misuse, Art. 6(1)(f) GDPR). When you use your account we additionally record: time of each login, user name, IP address, session duration, areas viewed, selected settings (day, filters, sorting, view, search term, language), type of device and browser, and the approximate location (city and country) derived locally from the IP address; no IP address is sent to third parties. Failed logins are recorded with the login identifier entered (email address or user name), IP address and time. As proof of your agreement to the terms of use we store account, time, IP address and version of the terms; likewise if you decline (an event without further data).

Purposes are providing and securing access, detecting misuse (in particular passing the account on to others) and improving the service. Legal basis is Art. 6(1)(b) GDPR (use of the access) and (f) (security, protection against misuse, improvement). Data is deleted after 90 days; accounts are blocked and deleted when access ends. An exception is the proof of your agreement to the terms of use: its legal basis is Art. 6(1)(f) GDPR (legitimate interest in having proof); we keep it for as long as the account exists and for three years at most afterwards, then delete it.

Providing this data is not required by law. Without it (email address, login, logging of use and confirmation of the terms of use), however, the account cannot be used.

The application only uses technically necessary storage in your browser: the session cookie (and, briefly, the security cookie on forms) and the language you chose, kept in your browser's local storage; it is not passed on to third parties. No cookies for advertising or analytics are set and no third-party services are embedded.

5. Selecting testers

Applying for test access works through a comment on X (X's terms apply there). We use your comment, your X name and later the email address for the invitation only to select the testers and set up the access (Art. 6(1)(b) GDPR); afterwards we use the email address for the account (see section 4). From applicants who are not selected we store nothing beyond the comment on X.

6. External links

The links to our Discord server and to our profile on X lead to Discord (Discord Inc.) and X (X Corp.), whose privacy policies apply there; data is only transmitted once you click a link. Applying for test access happens on X (see section 5); X's terms apply there.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests (Art. 15–21 GDPR). Write to the email address above. You can also lodge a complaint with a data protection supervisory authority, e.g.: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, lda.bayern.de.

8. Attribution

Location data: IP Geolocation by DB-IP (db-ip.com), licence CC BY 4.0.