Privacy policy

1. Controller

Provider:

• Chris Leon Noltemeier
• 49152 Bad Essen
• Deutschland
• Email: chris.noltemeier@gmail.com

The controller under the GDPR is the operator named below as “Provider” (same details as the legal notice / Impressum).

For privacy requests, use the email address shown in the legal notice and put “Privacy” in the subject line.

We have not appointed a Data Protection Officer (DPO).

2. Scope

This policy applies to:

• this website at the domain shown in your browser and in the legal notice (landing page, blog, contact), and any later primary domain;
• the CrashReport mobile app (currently Android; iOS after a future release) where linked from app stores or this site.

Third-party sites we link to have their own privacy notices.

3. What data we process

Public website

• Server and access logs from hosting: e.g. IP address, timestamp, requested URL, user agent. Purpose: operation, security, abuse detection. Legal basis: Art. 6(1)(f) GDPR.
• Language selection: the technically necessary session cookie 'NEXT_LOCALE' stores the selected site language (German or English). It is not used for advertising or cross-site tracking.
• Contact form: name, email, message. Submitting opens a mailto hand-off; delivery then uses your email provider and ours. Purpose: handling your request. Legal basis: Art. 6(1)(b) or (f) GDPR.
• Newsletter: none, this item is omitted until a newsletter exists and is described here.
• Web analytics: this site uses Vercel Web Analytics provided by Vercel Inc.; processing may take place in the United States. The service records aggregated page views without cookies or a persistent cross-site visitor identifier. Data points include the requested URL and route, referrer, approximate region, browser, operating system, and device type. A visitor identifier derived from the request is discarded daily. No advertising profiles are created. Legal basis: Art. 6(1)(f) GDPR (our interest in privacy-conscious audience measurement).

CrashReport Web App (online accident report at app.crashreport.de)

• Local-first architecture: accident reporting in the browser operates entirely locally. There are no user accounts, no login, and no server-side storage of your report data.
• Local browser storage: form entries and workflow state are stored on your device using HydratedBloc. Scene photos and rendered sketches are stored locally in an IndexedDB database named 'crashreport_assets'.
• No cloud synchronization: your accident report data, photos, and sketches are never automatically uploaded or synced to our servers or third-party backends.
• Client-side PDF export: PDF generation happens entirely inside your browser, downloading directly to your device downloads folder.
• Data deletion: you can irrevocably delete the current report draft or wipe all stored CrashReport browser data and preferences at any time using the dedicated red buttons inside the web app. Clearing your browser's site data also removes all records completely.
• Hosting server logs: loading static web app files generates technically unavoidable access logs on Vercel servers (IP address, timestamp, requested resource, user agent) strictly for delivery and infrastructure security.

CrashReport mobile app (currently Android; iOS after release)

• Report content you enter (e.g. event details, people involved, vehicles, notes).
• Media such as photos and a sketch, if you capture them.
• Location data if you use location features and grant OS permissions.
• PDF: a report is typically generated on-device. Where files are stored or shared depends on your actions and OS permissions. For the described default use, report data is not automatically transmitted to us; if you actively send us content (e.g. by email), we process it to handle your request.

The privacy information published in the relevant app store and inside the mobile app also applies. It describes the installed version's functionality and takes precedence if details differ.

4. Purposes and legal bases

• Handling contact requests (Art. 6(1)(b) or (f) GDPR).
• Operating, securing, and measuring use of the website (Art. 6(1)(f) GDPR).
• Providing app features (Art. 6(1)(b) and/or (f) GDPR, depending on contract and feature).
• Consent where required for optional processing (Art. 6(1)(a) GDPR).

5. Recipients and processors

We do not sell personal data. Sharing is limited to the service providers below for running the site, or where you actively share content (e.g. emailing a PDF).

• Hosting and analytics: Vercel Inc. (site operation, server logs, Vercel Web Analytics).
• Email: delivery via the sender’s and recipient’s email providers (e.g. when you write to our contact address).

6. International transfers

Vercel may process data in third countries such as the United States. Where required, we rely on adequacy decisions and/or Standard Contractual Clauses under GDPR. See Vercel’s documentation for the current mechanism.

7. Retention

• Contact: until the conversation is completed plus a reasonable follow-up period; longer only if statutory retention requires it.
• Server logs: retained for the period set by the hosting provider to deliver and secure the service, and longer only where continued retention is legally required.
• App data: generally remains on-device until you delete it or remove the app, unless a particular app feature triggers a separately explained transfer.

8. Your rights

Where the GDPR applies, you may have the rights of access, rectification, erasure, restriction, objection, and data portability.

You may lodge a complaint with a supervisory authority.

9. Security

The site is served over HTTPS. We apply reasonable organisational access controls. No online service can guarantee absolute security.

10. Changes

We update this page when processing or legal requirements change. The date above marks the current version.