Privacy Policy

1. Controller

The controller for this website is:

Email: [email protected]

2. In short

• No account, no login, no advertising, no tracking cookies.
• Usage statistics run without storing anything in your browser (PostHog, EU servers, IP address discarded).
• Your browser stores one thing locally: the last map position on the map page, so that the map opens where you left it. It contains no personal data.
• Third party content loads only where you need it: Mapbox tiles on the map page, the Windy forecast only after you click it.
• Email addresses are stored only with double opt-in, and every mail carries an unsubscribe link and a delete link.

3. Hosting and server logs

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in Finland (EU). When you open a page the server records, for technical reasons, the IP address, time, requested page, referrer and browser identification. The logs serve the stable and secure operation of the site, are not combined with other data and are deleted after 7 days.

Legal basis: Art. 6 (1) (f) GDPR, legitimate interest in operating the site securely.

4. Usage statistics with PostHog

We use PostHog (PostHog Inc.; EU cloud, data processed and stored in Frankfurt, Germany) to count page views and the use of the planner, maps and links. PostHog runs in memory mode: it sets no cookie and writes nothing to local storage, so a new visit cannot be linked to an earlier one. The IP address is used to derive the country and is then discarded by the PostHog project setting; it is not stored in events. We record no names, no email addresses and no form contents. Requests go through our own domain to PostHog in the EU.

Legal basis: Art. 6 (1) (f) GDPR, legitimate interest in understanding how the site is used. No information is stored on or read from your device for this purpose, so no consent under section 25 TDDDG is needed.

5. Local storage

The map page stores your last map position (latitude, longitude, zoom) in your browser's local storage so that the map reopens where you left it. This is strictly necessary for that function, contains no personal data and never leaves your browser. You can clear it through your browser settings.

One more key exists only on the operator's own devices: opening the site with the address parameter internal=1 stores the flag kc_internal, which marks those visits as internal so they are excluded from the statistics. On every page load the site checks whether this flag is present; for visitors it never is and nothing is written.

Legal basis: section 25 (2) no. 2 TDDDG (strictly necessary for a function you requested) for the map position; the internal flag is set only by the operator on the operator's devices.

6. Map tiles from Mapbox

The map page loads map tiles directly from Mapbox Inc., 740 15th St NW, Washington DC, USA. Your browser sends Mapbox its IP address and the requested tile coordinates. Mapbox is certified under the EU-US Data Privacy Framework. The small satellite picture on spot pages is fetched by our server, not by your browser, so Mapbox does not see you there.

Legal basis: Art. 6 (1) (f) GDPR, legitimate interest in showing an interactive map on the page you chose to open.

7. Wind forecast from Windy (after your click)

Spot pages, destination pages and the map panel offer a live forecast from windy.com (Windyty SE, Czech Republic). Nothing is loaded until you click "Load Windy forecast". After the click your browser connects to Windy, which receives your IP address and may set its own cookies under its own privacy policy.

Legal basis: Art. 6 (1) (a) GDPR and section 25 (1) TDDDG, your consent by clicking. Reloading the page withdraws it.

8. Fonts

Fonts are delivered from our own server. No request goes to Google Fonts or any other font service.

9. Email: early access list and booking reminder

You can leave your email address for two things: to hear once when kiteCOMPASS Pro opens for early access, or to get one booking reminder for a place and month you chose. In both cases we first send a confirmation mail. Only when you click its link do we mark the address as confirmed and store the time of confirmation, the version of the consent text and a keyed hash of your IP address as proof of consent. Unconfirmed addresses are deleted after 7 days. We store the page you signed up on, the chosen place and month and the language.

Mails are sent through Resend (Resend Inc., 2261 Market Street, San Francisco, USA) from servers in the EU region; Resend processes your address and the mail content to deliver it and is bound by standard contractual clauses. Every mail carries an unsubscribe link (we keep the address marked as unsubscribed so we never mail it again) and a delete link (we erase the address and every sign up linked to it). You can also write to [email protected].

Legal basis: Art. 6 (1) (a) GDPR, your consent, which you can withdraw at any time with the links in each mail.

10. Weather data

Our wind, temperature and rain figures come from Open-Meteo (open-meteo.com). Our server requests them with the coordinates of kite spots; no visitor data is involved.

11. Contact by email

If you write to us we keep your message and address to answer you and delete them once the matter is closed, unless we must keep them by law.

Legal basis: Art. 6 (1) (b) or (f) GDPR.

12. Your rights

• Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21).
• Withdraw consent at any time (Art. 7 (3)), for mails with the links in every mail.
• Complain to a supervisory authority. The authority for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2 bis 4, 40213 Düsseldorf, Germany.

Write to [email protected] for any of these.

13. Changes

We update this page when the site changes. The date at the bottom tells you when.