Data Privacy

Hosting

rascher.online is served by a Go application on Fly.io in the Frankfurt region (fra). Fly.io processes technical request data needed to deliver the site and operate the service. The app uses a local Fly volume in Frankfurt; the volume is not replicated to other Fly regions.

Fly.io is operated by a US company. Data transfers are covered by Fly.io's data processing agreement and standard contractual clauses. See the Fly.io Privacy Policy and Fly.io Data Processing Addendum.

Authentication

Member and admin sign-in is handled by WorkOS AuthKit. When you use the sign-in flow, WorkOS may process data such as your email address, name, authentication events, session data, device and security metadata. The app stores a sealed WorkOS session cookie so logged-in users can access protected pages.

The legal basis is the operation and protection of requested account functionality, Art. 6(1)(f) GDPR. WorkOS is a US provider. Transfers are covered by WorkOS's data processing addendum and standard contractual clauses. See the WorkOS Privacy Policy and WorkOS Data Processing Addendum.

Newsletter

Newsletter subscription and delivery are handled by beehiiv. When you submit the newsletter form, rascher.online sends your email address to beehiiv, where the double-opt-in email, subscriber record, mailing list management, delivery and unsubscribe handling are processed. rascher.online does not keep a separate local subscriber database.

The legal basis for the newsletter is your consent, Art. 6(1)(a) GDPR. You can withdraw that consent at any time by using the unsubscribe link in a beehiiv email. beehiiv may also process email analytics such as opens and clicks in newsletters sent through beehiiv.

beehiiv is a US provider. Transfers are covered by beehiiv's data processing agreement and standard contractual clauses. See the beehiiv Privacy Policy and beehiiv Data Processing Addendum.

Cookies

rascher.online does not use tracking cookies, tag managers or advertising third parties. The app sets short-lived flash cookies named __Host-rascher_flash in production and rascher_flash in development for status messages such as logout or newsletter confirmation prompts. These cookies expire after about 10 seconds.

For logged-in users, the app sets a sealed WorkOS session cookie so protected member and admin pages can be accessed. Session cookies are used only for authentication and app security.

Server Logs and Security

Server and platform logs may include technical data such as request time, requested path, response status and network metadata. The request IP address is evaluated for security and abuse prevention, including the newsletter rate limit. This data is not used to build personal profiles.

Logs are used for security, debugging and reliable operation of the site. They are kept only as long as needed for those operational purposes or as required by law.

Your Rights

You can request access, correction, deletion, restriction of processing, data portability and objection where the GDPR grants these rights. You can also lodge a complaint with a competent data protection authority. For privacy requests, contact contact@rascher.online.

For newsletter data, the fastest way to stop future emails is the unsubscribe link in each beehiiv email. Requests for access, deletion or export can also be sent to the contact address above and may be handled through beehiiv where the subscriber record is stored.

International Transfers

rascher.online intentionally uses US providers for hosting support, identity and newsletter infrastructure. Where personal data is transferred outside the European Economic Area, the transfer is covered through the providers' data processing agreements and standard contractual clauses or equivalent transfer safeguards.

Scope

This notice describes the actual processing on rascher.online to the best of the operator's knowledge. It is not legal advice.