Gnocchi is an event guide. It runs no ads and does not sell your data. The sections below list every place where the site touches personal data. Questions and requests: hello@lukasvonkunhardt.com.
Who is responsible
Lukas von Kunhardt, Berlin, Germany, is the controller; full details in the imprint.
Hosting and delivery
The site runs on a server in Germany rented from Hetzner Online GmbH. Cloudflare sits in front of it as CDN and terminates TLS, so Cloudflare processes the IP address of every request, as our processor; it keeps no log of the requests for us, as log retention is off, which is Cloudflare’s default. Legal basis: our legitimate interest in delivering the site fast and protecting it from attacks (Art. 6(1)(f) GDPR).
The web server writes an access log (timestamp, path, status, referrer, user agent, IP address), used to debug problems and to count aggregate usage, including how often AI assistants read the pages. Logs are deleted after 30 days. An error of the server is reported to PostHog (see below) with the address, browser and IP address of the request that met it, and the number of your account if you were logged in. Legal basis: our legitimate interest in running and securing the site (Art. 6(1)(f) GDPR).
Images
Event images are copied from the organizers, venues and ticket platforms that publish them and served from our own server, like the pages, so your browser requests nothing from their servers. The copies keep the picture and its colours but none of the original’s metadata, such as the camera or the place a photo was taken, and are deleted three weeks after the event’s last date. Rights holders find how to have an image removed in the imprint.
Analytics
Analytics run on PostHog, on its EU servers in Frankfurt, which your browser reaches through i.go-gnocchi.app, a proxy PostHog runs for us on Cloudflare. Without your consent, visits are counted without cookies: PostHog’s servers compute a hash from your IP address, browser and a salt that changes daily and is deleted after the day, so the hash cannot be traced back to you afterwards; no profile is kept and nobody is recognised across days. Counting without cookies rests on our legitimate interest in knowing how the site is used (Art. 6(1)(f) GDPR).
If you say yes at the foot of the page, PostHog sets first-party cookies and local storage to recognise your browser across visits and records sessions, that is what you click and scroll, with text you type masked, so that we see where the site is hard to use. Cookies and session recordings rest on your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time.
Before you say yes, PostHog gets the page, the page you came from, your browser and operating system as the request names them, your IP address, which links and buttons you click and the errors the page’s scripts meet. Nothing measured on your device is sent, so no screen size, language, time zone or device model. After a yes it also gets how fast the page loaded, your device’s screen, language and time zone, and the session recording. PostHog keeps events for one year and session recordings for 30 days. Change your cookie choice
Accounts
You can log in at my.go-gnocchi.app with your email address, without a password: we email you a link and a code. To limit how many login mails one address gets and one IP address asks for, we keep the address, your IP address, the time and a fingerprint of the link and the code, and delete them with the first login request after a day has passed. Legal basis: our legitimate interest in protecting the form, other people’s inboxes and our mail from abuse (Art. 6(1)(f) GDPR).
The mails go out through Cloudflare Email Sending, our processor. Cloudflare logs each mail’s address, time and delivery status for us and keeps the log for 31 days; it keeps no copy of a mail’s content. If a mail bounces for a passing reason, such as a full inbox, Cloudflare puts the address on a block list that stops further mails to it for a day to a week; if the address does not exist or the mail was marked as spam, it stays there until we take it off, which we do on request. Legal basis for the log and the list: our legitimate interest in knowing that our mail arrives and in mailing only addresses that take it (Art. 6(1)(f) GDPR).
On the login form, Cloudflare Turnstile checks that a person rather than a program fills it in. For that it reads your IP address, browser and the connection’s properties. Cloudflare does this as our processor, and also uses the same signals, as controller on its own legitimate interest, to improve its bot detection (Turnstile privacy addendum). Reading these properties is strictly necessary to protect the form (§ 25(2) no. 2 TDDDG). Legal basis: our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR).
When you use the link or the code, your account is made: your email address, your name once you give it, and when you joined and last logged in, kept until you ask us to delete the account. A cookie on my.go-gnocchi.app ties the code to your browser and then keeps you logged in for a year or until you log out, and a second one protects its forms from forged requests; both are needed for logging in and never reach go-gnocchi.app. Legal basis: the account you asked for (Art. 6(1)(b) GDPR, § 25(2) no. 2 TDDDG).
Recipients outside the EU
Cloudflare, Inc. and PostHog, Inc. are US companies. PostHog processes the data described above on servers in the EU. Cloudflare handles each request at the data centre nearest to the visitor, which can lie outside the EU. Both work under data processing agreements with the EU standard contractual clauses; Cloudflare is also certified under the EU-US Data Privacy Framework, which also covers its own use of Turnstile’s signals. Hetzner Online GmbH is a German company.
Your rights
Under the GDPR you have the right to access, correction, deletion, restriction, portability and objection, and you may withdraw a consent you gave: email us. You may also complain to a data protection authority, for Berlin the Berliner Beauftragte für Datenschutz und Informationsfreiheit.