Privacy Policy

The controller under the General Data Protection Regulation (GDPR) is Sorin-Ionut Curescu, trading as en3sis, Nürnberg, Germany. The full postal address is on the imprint. For any privacy question or request, write to [email protected]. en3sis is not required to appoint a data protection officer and has not appointed one.

This policy covers this website and every service published by en3sis that refers to this page: web and mobile apps, extensions, bots, and integrations with platforms such as TikTok, GitHub, Discord and Google. A service may provide an additional privacy notice. Where it does, that notice applies alongside this one.

• +Hosting and server logs. The site is hosted by Vercel Inc. To deliver a page, Vercel processes your IP address, browser user agent, the requested URL, the referring URL and the time of the request. This is necessary to deliver the site and keep it secure (Art. 6(1)(f) GDPR). Logs are kept by the host for a limited period and then deleted.
• +Analytics. Vercel Web Analytics measures page views without cookies and does not identify individual visitors across sites. It reports only aggregated figures such as pages viewed, referrer, country and device type (Art. 6(1)(f) GDPR, interest in understanding how the site is used).
• +View counter. Blog posts show a view count stored in a Supabase database. It is a single number per post with no IP address or other identifier attached.
• +Images from other hosts. Some older blog posts display images hosted by third parties, such as Amazon Web Services (dev.to uploads) and GitHub. When such a post is opened, your browser requests the image directly from that host, which receives your IP address and browser information (Art. 6(1)(f) GDPR, interest in displaying the post as written).
• +Cookies and browser storage. The site sets no cookies and loads no advertising or tracking scripts. Fonts are served from this domain. The site may keep a small value in your browser's session storage to complete an action you started, such as reloading the page. This storage is strictly necessary for that function (section 25(2) no. 2 TDDDG) and is never sent to a server.
• +Email. If you write to en3sis, your email address and message are processed to answer you (Art. 6(1)(b) or (f) GDPR).

A service processes only what it needs to work. Depending on the service, that can include:

• +Platform account data. When you sign in with or connect TikTok, GitHub, Google, Apple, Discord or another platform, the service receives only the data covered by the permissions you approve on that platform's consent screen. Typically that is an account identifier, display name or username, and profile picture, plus an email address where the platform provides one.
• +Platform content. Where a feature works with content on a connected platform, for example reading information about your posts or videos, or publishing content you selected, the service accesses only what that feature needs and only within the permissions you granted.
• +Access tokens. Credentials a platform issues so the service can act on your instruction. They are used only for the actions you request and deleted when you disconnect the service or delete your account.
• +Content you provide. Files, text or media you upload or create in a service.
• +Technical data. Logs and error reports needed to run the service and fix faults.
• +Purchases. Where a service sells something, the payment provider processes your payment details. en3sis receives the order information, not your card details.

Data received from a platform is used only to provide the features you use. It is not sold, not used for advertising, and not shared except as described below. Where a service uses Google APIs, its use of information received from them adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• +Contract, Art. 6(1)(b) GDPR. Signing you in, providing the features you use, and acting on a connected account at your request.
• +Legitimate interests, Art. 6(1)(f) GDPR. Delivering and securing the site and services, preventing abuse, fixing faults, and cookieless usage statistics.
• +Consent, Art. 6(1)(a) GDPR. Anything a service asks you to opt into. You can withdraw consent at any time with effect for the future.
• +Legal obligation, Art. 6(1)(c) GDPR. Retention of tax and accounting records for purchases.

You are not legally or contractually required to provide personal data. Some features cannot work without it; for example, signing in with a platform requires the account data that platform shares. No decisions based solely on automated processing that have legal or similarly significant effects are made about you.

• +Service providers. Hosting (Vercel), databases (Supabase), and where a service needs them, email delivery and error monitoring providers, acting as processors under data processing agreements (Art. 28 GDPR).
• +Connected platforms. When a service acts on your TikTok, GitHub or other account, that platform receives the request you initiated.
• +Payment providers. Such as Stripe or an app store, for purchases.
• +Authorities. Where there is a legal obligation to disclose.

Some of these providers are located in or process data in the United States. Transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Personal data is kept only as long as needed for the purpose it was collected for, and then deleted:

• +Account data and content: while your account or connection exists.
• +Access tokens: until you disconnect the service, revoke access, or delete your account.
• +Logs and error reports: for a limited period needed for security and troubleshooting.
• +Tax and accounting records: for the periods required by German law, up to ten years.

You can remove a service's access at any time in the connected platform's settings, for example in TikTok under Settings and privacy, Security, Manage app permissions, or in GitHub under Settings, Applications. To have the data a service holds about you deleted, email [email protected] naming the service and the account. Data is deleted without undue delay and at the latest within one month, unless the law requires it to be kept.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and to withdraw consent at any time (Art. 7(3)). Write to [email protected]. Requests are answered within one month, which can be extended by two further months where necessary (Art. 12(3)).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work. The authority responsible for en3sis is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA).

Where processing is based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to it at any time on grounds relating to your particular situation (Art. 21(1) GDPR). Processing then stops unless there are compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. To object, write to [email protected].

Appropriate technical and organisational measures protect personal data (Art. 32 GDPR), including encryption in transit, restricted access to credentials, and requesting the narrowest platform permissions a feature needs.

The services are not directed at children under 16. If it becomes known that data of a child under 16 was collected without the required consent, it is deleted.

This policy is updated when processing changes or the law requires it. The current version is always on this page, with its date at the top.