KabinePrivacy policy
This policy applies to the project website kabine.dev and the public demo on handball.kabine.dev. It does not apply to the clubs' Kabine installations: there, the club is the controller and its own privacy policy applies. This is a translation; the German version is authoritative.
1. Controller
David Heidt
c/o Online-Impressum 12385
Europaring 90
53757 Sankt Augustin
Germany
Email: david@heidt.biz
2. Hosting on Cloudflare
Both websites run on Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you open a page, Cloudflare necessarily processes technical connection data: your IP address, date and time, the requested address, browser and operating system. This is needed to deliver the pages and protect them against attacks and misuse.
Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is the secure and reliable operation of the websites.
Cloudflare acts as a processor under a data processing agreement. Data may be transferred to the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection (Art. 45 GDPR).
3. Cloudflare bot protection
On both websites Cloudflare sets the cookie __cf_bm to recognise automated access (bots). It holds an identifier that Cloudflare derives from properties of the connection and expires after 30 minutes. If a request looks suspicious, Cloudflare may show a check page instead of the page. A Cloudflare script runs in your browser there and evaluates technical properties of your browser and device; after a passed check Cloudflare sets the cookie cf_clearance, which by default expires after 30 minutes. Cloudflare does not insert a script into the normal pages.
Legal basis: Art. 6(1)(f) GDPR; my legitimate interest is protecting the websites against misuse. Accessing your device for this is strictly necessary (§ 25(2) no. 2 TDDDG).
4. kabine.dev
Apart from the cookie in section 3, the website sets no cookies, uses no analytics or advertising and loads no fonts, scripts, images or other content from other servers. The only exception is Cloudflare Turnstile on the contact page (section 6).
If you switch the language or close the hint about the other language version, your browser stores this choice in localStorage (entry kabine-site-lang). It stays on your device until you delete it in your browser settings and is not sent to me. Storing it is strictly necessary for the language choice you asked for (§ 25(2) no. 2 TDDDG).
Links to other websites (such as GitHub) are plain links. Only when you click one does your browser connect to the other website; it then sends only the address kabine.dev, not the page you came from. From then on the other provider's privacy policy applies.
5. Contact form
If you use the contact form, I receive your name, email address and message. I use them only to answer your request. The form is delivered to my mailbox by email (Cloudflare Email Sending) and is not stored in a database; its content is not logged either. My email provider stores the message in my mailbox as a processor. I delete the message once your request has been dealt with, unless I am legally required to keep it.
Legal basis: Art. 6(1)(f) GDPR; my legitimate interest is responding to your request.
6. Spam protection (Cloudflare Turnstile)
The contact page uses Cloudflare Turnstile to protect the form against bots. For this the page loads a Cloudflare script (challenges.cloudflare.com) that evaluates technical information about your browser and device. Turnstile is loaded only on the contact page.
Legal basis: Art. 6(1)(f) GDPR; my legitimate interest is protecting the form against abuse. Accessing this information on your device is strictly necessary to provide the contact form you are using (§ 25(2) no. 2 TDDDG). Cloudflare processes the data as described in section 2.
7. Demo on handball.kabine.dev
The demo shows the app with an invented club. You use it without signing up, through shared demo access (player, parent, coach, admin) that all visitors use together. Whatever you enter there is seen by other visitors. Please do not enter real personal data. Email, SMS, passkeys, profile pictures, uploading a club logo, feedback and the game schedules from handball4all are switched off in the demo.
Every night at 3:00 (German time) the demo is reset: everything visitors entered is deleted on the server and the invented club is created again.
Legal basis: Art. 6(1)(f) GDPR; my legitimate interest is presenting the software and letting people try it. Accessing your device (section 7.1) is strictly necessary for the demo to work the way you use it (§ 25(2) no. 2 TDDDG).
7.1 In your browser
| What | Purpose | How long |
|---|---|---|
Cookie __Host-kabine_session | Keeps you signed in to the chosen demo access (random identifier). | 30 days; invalid on the server from the next reset |
Cookie kabine_view | Admin access only: remembers the view "see as player, parent or coach". | Until you close the browser |
Cookie __cf_bm | Cloudflare bot protection (section 3). | 30 minutes |
| localStorage | Language (kabine-locale), the demo club’s profile for a fast start, such as name, colours and links, without personal data (kabine-club), day of the last welcome screen (kabine-splash-day), closed hints, in the admin access the draft of a list import. | Until you delete them in your browser; the import draft until the import is finished or discarded |
| sessionStorage | Selected team and tab, progress of the setup wizard, protection against reloading twice after updates. | Until you close the tab |
| Service worker with cache | Makes the app installable and shows the last loaded state without network: app files (kabine-shell-v1) and recently loaded content such as events and chats of the demo club (kabine-api). | App files until the next update; content until you sign out or the session ends after the reset |
| Push subscription | Only if you switch on notifications: your browser creates a subscription with its maker's push service (such as Google, Mozilla, Apple, Microsoft), which delivers the notifications. | Until you switch notifications off; on the server until the reset |
The demo does not use IndexedDB.
7.2 On the server
| Where | What | How long |
|---|---|---|
| Database (Cloudflare D1) | Everything entered in the demo: responses with reasons, events, helper duties, carpools, settings; sign-ins with device type (from the browser identification) and times; push subscriptions (address at the push service and keys). | Until the next reset |
| Durable Objects | Team chat messages and read markers; devices connected live to chat and helper plans. | Messages until the next reset; connections while the page is open |
| KV storage | Maintenance switch, a lock against repeated reminders for one event (event number). | Lock 15 minutes, otherwise until the next reset |
| Queues | Jobs for push notifications (recipients, text of the notification). | Until delivered, usually seconds |
| Workers Logs | One log entry per request: time, requested address, method, status code, technical properties of the request (including browser identification and country, possibly the IP address) and error messages of the app. The app does not write names, messages or form contents to the log. | At most 7 days |
8. No sharing, no tracking
I do not share data with third parties, except Cloudflare as processor, my email provider for messages from the contact form and, if you switch on notifications in the demo, your browser's push service. There is no tracking, no analytics and no advertising.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). To exercise them, write to the email address above. You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority where you live.
Right to object
You may object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(f) GDPR (Art. 21(1) GDPR). I will then no longer process it unless I can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal objection to the email address above is enough.
Last updated: October 2026