Privacy notice

This English text is a translation. The German version (Datenschutzerklärung) is the authoritative text if they differ.

Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Arne Kellmann Odenwaldstraße 134L 64372 Ober-Ramstadt Email: contact@sharedforest.com

General

We process personal data only for the purposes described here and on the basis of Art. 6 GDPR. For sign-in, we set the necessary cookies described below. We do not set cookies for advertising or analytics.

Server logs and provision of the website

When you visit this website, our CDN provider processes technically necessary data (IP address, user agent, time) to deliver the page and to defend against abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability and IT security).

Legal bases

We process personal data on the basis of Art. 6 GDPR (in particular point (a) consent, point (b) contract, point (f) legitimate interest) and on the basis of Section 25 TDDDG where information is read from or stored on your terminal device.

Forest visits and tree planting

On every page view, your browser sends an anonymous visit message to our server. In doing so, we process only whether the visit is from a human, an AI agent or an automated bot. We derive this classification from the user agent and, where available, from the bot score of Cloudflare. The visit message contains neither your IP address nor your user agent nor any other identifier. We only increase aggregated counters. The legal basis is our legitimate interest in anonymous, aggregated audience measurement and in displaying the shared forest (Art. 6(1)(f) GDPR).

When you click the "Plant your tree" button, you consent to us checking whether you have already planted a tree today. For this, we form a SHA-256 hash value from your IP address, your user agent and a random daily key. We store only this hash value, never the IP address or the user agent in plain text. The daily key is valid for one calendar day (UTC). Shortly after midnight (UTC), we automatically delete the old key and all hash values of the previous day. After that, nobody can assign the hash value to you or to your IP address. Storage period: at most 1 day. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future by no longer clicking the button. The planted tree contains no personal data.

For every visit message processed, our server stores the random identifier of that single request (`visitId`) with its result: the type of the result and, where applicable, the identifier of the tree or grove and the affected grid sections of the digital forest area. This lets us answer the same message again from the queue without counting growth or a planting twice. This result record contains no IP address, no user agent and no visitor hash value. It is not an identifier for a person across several days. Its retention does not extend the storage period of at most 1 day stated above for the visitor hash value. The result record becomes due for deletion after 15 days and is removed by the next daily alarm, on schedule after 16 days at the latest. If the alarm is delayed, the note under "Storage period" applies. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the reliable processing of visit messages).

After you click "Plant your tree", your browser stores three values in local storage (localStorage) under the key `wf-mine`: the date, the identifier of this visit (`visitId`) and the identifier of your tree (`treeId`). These values serve only to show your tree as "Your tree" on a later visit. The page does not send these values to our server again. Our server knows them only from the original visit. We set no cookie for this. The legal basis for storing on your terminal device is Section 25(2) no. 2 TDDDG, because the storage is strictly necessary for the function you requested. The legal basis for the processing is Art. 6(1)(f) GDPR (legitimate interest in showing you your tree again). You can delete the values at any time by deleting the website data for this website in your browser.

Real-time connection (WebSocket)

This website uses a WebSocket connection to our Cloudflare Worker to display live updates. In doing so, the hosting provider processes connection metadata (IP address, time of connection) (see the Cloudflare section).

Cloudflare (hosting, CDN, WAF)

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare provides the content delivery network, the Workers runtime environment and protection against attacks. In doing so, connection data (IP, request metadata) is processed. Legal basis: Art. 6(1)(f) GDPR. Transfer to a third country (the USA) takes place on the basis of the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023); in addition, a DPA with Cloudflare including standard contractual clauses (Art. 46(2) GDPR) is in place. Privacy information: https://www.cloudflare.com/privacypolicy/

Directory links

In the footer, we link to directories in which Shared Forest is listed (for example MakerMap and Findly). We deliver the images of these links from our own server. When you load the page, no directory receives your data. If you click a link, you open the provider's website. The provider is responsible for the processing there.

Bot protection (Cloudflare Turnstile)

On the order page and at sign-in, we load Cloudflare Turnstile from challenges.cloudflare.com. Turnstile checks whether a request comes from a human. For this, Cloudflare processes technical signals, for example IP address, TLS characteristics, user agent and the identifier of our website. For this, Cloudflare can use storage in your browser (cookies or local storage) to keep the state of the check. This access is strictly necessary for the order and sign-in that you requested (Section 25(2) no. 2 TDDDG). Cloudflare acts as our processor. The purpose is protection against abuse and automated requests. The legal basis is Art. 6(1)(f) GDPR. The transfer to a third country follows the section "Cloudflare (hosting, CDN, WAF)". Privacy information: https://www.cloudflare.com/turnstile-privacy-policy/

Load-time measurement (Web Vitals)

After the page view, your browser sends measured values for the load time and response time of the page to our server (`/api/_vitals`): the name and value of the metric (LCP, INP, CLS, TTFB, FCP), a random identifier of this one page view, the navigation type and the address visited. We log these values as a technical log entry in Cloudflare Workers. In doing so, we store no IP address, no user agent and no identifier that goes beyond the single page view. Purpose: detecting and fixing performance problems. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a fast, functioning website).

For audience measurement, we write a data point to Cloudflare Workers Analytics Engine for every page view, every visit message and every click on "Plant your tree": the classification (human, AI agent or bot), the type of request, for AI agents and bots the program name from the user agent (for example "GPTBot"), and, for a page view through a link on another website, only its host name (for example "news.ycombinator.com"), without path and parameters. The data point contains no IP address, no full user agent and no identifier. Cloudflare deletes these data points after 90 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in anonymous, aggregated audience measurement).

In addition, our servers write technical metrics about the forest (for example the size of the stored forest and the number of trees) to Cloudflare Workers Analytics Engine. These metrics contain no personal data.

For usage measurement, we also record whether the forest was displayed in the browser, whether the browser received a response to a planting request, the request failed or no response arrived after one minute, whether a link was copied successfully or handed over through the share function, whether a shared link displayed the forest, whether you opened your saved tree again and whether you opened the sponsorship page. For load and planting requests, we measure the time until display or response. Our servers record the result of a processed planting request separately from these browser reports. The data points contain only the classification as human, AI agent or bot, the type of event, a test marker, one of the fixed origin values "none", "community pilot" or "shared tree link" and, where applicable, a duration. They contain no IP address, no full user agent, no path, no URL parameters and no visitor or session identifier. The test marker and origin value from a correspondingly marked link remain only in the session storage of your browser tab (sessionStorage); they contain no identifier. To limit browser reports, the server processes the IP address only transiently in the working memory of the running server process; it is not stored with the events. Cloudflare deletes the data points after 90 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in checking the function of the forest and measuring its use in aggregate).

Sentry (error monitoring)

Our server components for the real-time connection and for the processing of visits report program errors to Sentry. Provider: Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, as processor. The error message, the stack trace and technical context (program version, environment, runtime) are sent. We configured Sentry so that no IP addresses, user data, HTTP headers, cookies, URL parameters, request contents or queue contents are transmitted. Your browser does not connect to Sentry. Purpose: detecting and fixing errors. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable operation). Transfer to a third country (the USA) takes place on the basis of the EU-US Data Privacy Framework. Storage period: 90 days (Sentry default). Privacy information: https://sentry.io/privacy/

Tree sponsorships

If you order a tree sponsorship, we process this data:

The display name and tree design are publicly visible during the term. The link address, link text and short description appear only after our manual approval: in the forest, in our API and MCP interface and in data exports. The link address that you provide stays complete on click, including URL parameters. The linked website can process these parameters and connection data. The respective provider is responsible for that processing. Therefore, provide only data that may be public.

The purpose is the performance of the contract, including billing, renewal, cancellation and refund. The legal basis is Art. 6(1)(b) GDPR. The retention of invoices and accounting records is based on Art. 6(1)(c) GDPR in conjunction with Section 147 German Fiscal Code (AO) and Section 14b German VAT Act (UStG). The limit on drafts is based on our legitimate interest in limiting abuse and cost (Art. 6(1)(f) GDPR).

If an AI agent prepares the order for you, we receive the same data from the agent. You conclude the contract yourself on our confirmation page.

User account

For a tree sponsorship, you need a user account. Sign-in works without a password: we send you a sign-in link and a code by email. The first sign-in creates the account and confirms your email address. Optionally, you sign in with a passkey.

We process:

The purpose is to provide the account and to perform the contract. The legal basis is Art. 6(1)(b) GDPR. The limit on sign-in emails is based on our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

Cookie. After sign-in, we set the cookie `__Host-sf_session`. It contains a random session identifier, is valid only for our website (HttpOnly, Secure, SameSite=Lax) and ends after 30 days without use, at the latest 90 days after sign-in, or when you sign out. During email sign-in, we set the cookie `__Host-sf_login` for at most 15 minutes, which binds the code to your browser. During passkey sign-in, the cookie `__Host-sf_passkey_flow` binds the one-time sign-in check to your browser for at most 5 minutes (HttpOnly, Secure, SameSite=Strict). These cookies are strictly necessary for the service that you requested (Section 25(2) no. 2 TDDDG). We do not set cookies for advertising or analytics.

Your rights in the account. Under "Your account", you download a JSON overview of your account, your recent orders, trees and cancellation declarations, change your name and email address (Art. 16 GDPR), sign out devices and delete the account (Art. 17 GDPR). For complete access under Art. 15 GDPR, write to the contact address stated above. On deletion, we remove the account, all sessions and passkeys immediately and end active subscriptions so that no further charges occur. Your trees stay in the forest without display name and link. We cancel open orders. A payment can still arrive afterwards; in that case, we arrange a refund. Because of Section 147 AO and Section 14b UStG, we keep order records for 8 years in pseudonymised form: without account identifier, display name and link, but with email hash value and Stripe payment references. This remaining data can be assigned to a person again and remains personal data.

Changes to tree links

If you request a new link, link text or short description for a tree in your account, we store the identifier of the tree and of your account, the requested details and the time of the request. This also applies if the link address is unchanged. We check the details and the linked page automatically; a human decides on approval. We store the review result, the time of the decision and, in case of rejection, the reason. Requested details are not public until approval. Until then, details that are already approved stay visible. In case of rejection, they stay in place.

The purpose is the performance of the tree sponsorship and the review of content. The legal basis is Art. 6(1)(b) GDPR; for the defence against illegal or harmful links, our legitimate interest under Art. 6(1)(f) GDPR also applies. The recipients of the automatic review are stated in the section "Review of content". On account deletion, we delete open link requests. We delete rejected link candidates and texts, and the decisions with their reasons, at the latest 1 year after the end of the term. Where we still need data for an objection or for legal claims, the same maximum period applies.

Review of content (moderation)

We review display names, design requests, link texts, short descriptions and the pages behind links before they appear in the forest. A human additionally reviews links and their texts. For the automatic review, we send the text of the display name, the design request, link text, short description and the text of the linked page to TypeSafe (model "Jev"). For the design of the tree, we send the design request to Cloudflare Workers AI. In doing so, we send no email address and no IP address. If our server cannot classify a program with certainty as human, AI agent or bot, we send only its user agent identifier to TypeSafe, without IP address.

The automatic review can reject a display name or design request. This decision is necessary for the conclusion of the contract (Art. 22(2)(a) GDPR). You can request that a human reviews the decision, state your point of view and contest the decision: write to contact@sharedforest.com.

We store review results under a hash value of the reviewed text so that we do not have to review the same text again: names and requests 90 days, results for a link domain 7 days, user agent identifiers 30 days, decisions of a human about a link domain 180 days. We store moderation decisions about an order, with their reasons, until 1 year after the end of the term, so that we can handle objections and defend against legal claims. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in a lawful, safe forest (Art. 6(1)(f) GDPR) as well as Art. 6(1)(c) GDPR in conjunction with Art. 17 of Regulation (EU) 2022/2065.

TypeSafe: TypeSafe AI, Inc., USA, processes the data as our processor. The basis is a data processing agreement (Data Processing Addendum). TypeSafe does not use the inputs to train AI models. The transfer to the USA is based on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR, module 2). Privacy information: https://typesafe.ai/legal/privacy-policy

Cloudflare Workers AI: Cloudflare (see below) operates the AI model as our processor. Cloudflare does not use the inputs to train AI models.

Payment through Stripe

Stripe handles the payment: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. On the Stripe payment page, you enter payment data, name, billing address, email address and, where applicable, your VAT ID. For the payment data, Stripe is a controller in its own right. Stripe also processes it for fraud prevention and to fulfil its own legal obligations. The legal basis for the disclosure to Stripe is Art. 6(1)(b) GDPR. Stripe can transfer data to Stripe, Inc. in the USA. The basis is the EU-US Data Privacy Framework and standard contractual clauses. Privacy information: https://stripe.com/de/privacy

For subscriptions, Stripe also processes the payment plan, the status of the subscription, the time of the next charge, cancellations and refunds. In the Stripe customer portal, you can manage your payment method and invoices. You cancel the contract through our cancellation function or your account.

For the invoice and the calculation of VAT (Stripe Invoicing, Stripe Tax), Stripe processes data on our behalf. We receive from Stripe name, email address, billing address, VAT ID, amount, payment and subscription status, but no complete card data. We keep invoices and accounting records for 8 years (Section 147(3) AO, Section 14b UStG). The period begins at the end of the calendar year of the invoice.

Growth emails

If you switch on "Email me when my trees grow" in your account, we send you at most one email per week. The email names your trees that reached a new growth stage, new groves near your trees, newly unlocked regions and the size of the forest. If there is no news about your trees, groves or regions, we send no email. The setting is off until you switch it on.

For this, we process your email address, the identifier of your account, the time of your consent, the time of the last email and the number of regions that the last email considered. We calculate the content of the email from your tree sponsorships. We do not evaluate whether you open the email or click a link.

The purpose is to inform you about your trees and the forest. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future: in the account, with the unsubscribe link in every email or with the unsubscribe function of your email program. We then delete the setting and the times immediately. If you delete the account, we delete them as well.

Emails

We send sign-in links, messages about your account, growth emails (only with your consent), order confirmations, subscription and cancellation confirmations, acknowledgements of receipt for withdrawals and reports, and messages about the review and about link changes through Cloudflare Email Sending (see below). The emails contain the content of your order or declaration.

Withdrawal through the website

If you withdraw from the contract through the "Withdraw from contract" function ("Vertrag widerrufen"), we process your name, the order number, your email address and, if provided, your reason. We send you an acknowledgement of receipt. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a German Civil Code (BGB). We keep the withdrawal as part of the order records (see Stripe and Storage period).

Reports of illegal content

If you report content to us through the report form, we send your report by email to our mailbox contact@sharedforest.com. We do not store it in a database. The report contains the reported content, your reasons and, if provided, your name and your email address. With your email address, we send you an acknowledgement of receipt and our decision. To limit requests, we process your IP address transiently in working memory, for at most 1 hour. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16 of Regulation (EU) 2022/2065. We delete the report 1 year after our decision.

Access for AI agents (OAuth)

If you give an AI agent access to your account, we store the name of the application, the addresses to which it is redirected, the identifier of your account, the permissions chosen, your spending limit per order and per day, the time of approval and the daily total already used. We store access and refresh tokens only as a hash value. Access tokens are valid for 15 minutes, refresh tokens for 30 days. The data is in Cloudflare Workers KV storage. When you delete your account, we revoke all access. On request, we also revoke an access earlier: write to contact@sharedforest.com. The purpose is the execution of your orders through the agent. The legal basis is Art. 6(1)(b) GDPR. We delete the daily total and the consent notes after at most 2 days and 10 minutes respectively.

Contact form

If you use the contact form at /kontakt, we send your name (if provided), your email address and your message by email to our mailbox contact@sharedforest.com. We do not store the message in a database. To limit requests, we process your IP address transiently in working memory, for at most 1 hour. The purpose is to answer your request. The legal basis is Art. 6(1)(b) GDPR, for other requests Art. 6(1)(f) GDPR. We delete the correspondence as soon as the request is resolved, unless a retention obligation applies (business letters: 6 years, Section 257 German Commercial Code (HGB), Section 147 AO).

Rights of the data subject

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and the right to object (Art. 21). You can withdraw consent that you gave at any time with effect for the future.

Send requests to: contact@sharedforest.com

For requests through the form about visit data, we send a confirmation link to your email address. To prevent email floods, we store hash values of your IP address and email address with counters. Their automatic deletion is scheduled after one day. The legal basis is our legitimate interest in defending against abuse (Art. 6(1)(f) GDPR). The form does not change any data of your user account; for that, use the account functions or the contact address stated above.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority — e.g. the Hessian Commissioner for Data Protection and Freedom of Information (https://datenschutz.hessen.de) or the Federal Commissioner for Data Protection and Freedom of Information (https://www.bfdi.bund.de).

Storage period

We delete personal data as soon as the purpose of the processing ceases and no statutory retention period applies any longer. We discard visitor identifiers after 1 day.

Automatic deletions in the user account run through scheduled alarms. If an alarm runs later, the physical deletion takes place at the next alarm or access. Expired sign-in links, codes and sessions are then already invalid.