Legal · Website
Privacy Policy
How fountainflyer.app handles your data on the website. The iOS app is covered separately under App Privacy.
Last updated: October 26, 2026
1. Data Controller & Contact
2. Web Hosting (Loveable)
Our website is built and hosted using the platform Loveable (Loveable Inc.). To securely display and deliver the website to your browser, Loveable automatically processes technical log data transmitted by your device. This data includes:
- IP address of the requesting device
- Date and time of access
- Name and URL of the accessed page/file
- Browser type and operating system used
Legal Basis: This processing is based on Art. 6(1)(f) GDPR (Legitimate Interest) to guarantee a stable, functional, and secure website presentation.
3. Database Connection (Supabase)
This website connects to our backend infrastructure managed via Supabase, hosted on servers within the Europe-West (Frankfurt, Germany) region.
Usage: If the website displays live data from the FountainFlyer database (such as the number of active water fountains), your browser establishes a direct connection to the Supabase infrastructure.
Server Logs: Supabase automatically processes temporary server logs (including your IP address) exclusively for security purposes, threat detection (e.g., DDoS protection), and to maintain infrastructure integrity. These logs are deleted automatically after a short retention period.
4. Spam protection (Cloudflare Turnstile)
The two forms that write to our database — adding a Fountain and reporting a problem with one — are protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. Cloudflare processes your IP address and basic information about your browser for that check. It sets no advertising cookies and does not use the data to track you across sites. The legal basis is our legitimate interest in keeping the database usable (Art. 6(1)(f) GDPR). Turnstile runs only on those two forms; browsing the site does not involve it.
5. Analytics
This website uses TelemetryDeck to count how the site is used. We record which pages are opened and a small number of interactions: opening an airport, following the App Store link, following the “buy me a coffee” link, and submitting a Fountain. Nothing else is recorded, and no advertising or cross-site tracking takes place.
To tell one browser from another, a random identifier is generated the first time you visit and stored in your browser’s local storage. It contains nothing about you or your device, it is hashed (SHA-256) in your browser before any data is sent, and the value itself never leaves your browser. Clearing this site’s data in your browser deletes it and ends the association.
We use no tracking pixels and no advertising cookies. The legal basis is our legitimate interest in understanding whether the site works (Art. 6(1)(f) GDPR). You can prevent all of it by blocking nom.telemetrydeck.com or by blocking site data for this domain.
Separately, and never transmitted anywhere, this site keeps a few functional values in your browser’s local storage: the language you chose, and the handful of counters that decide whether and when the “buy me a coffee” line is shown at all (so that it is not shown on a first visit, not more than once per session, and not again for weeks after you dismiss it). Clearing this site’s data removes them.
6. Distinction: Website vs. iOS Application
This Privacy Policy applies solely to the marketing website. The FountainFlyer iOS Application has its own dedicated data processing parameters (including location services for finding water fountains and anonymized telemetry), which are governed by a separate policy accessible inside the app.
7. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right to Access (Art. 15 GDPR): Request information about your processed data.
- Right to Rectification (Art. 16 GDPR): Request the correction of incorrect data.
- Right to Erasure (Art. 17 GDPR): Request the deletion of your data.
- Right to Restriction (Art. 18 GDPR): Request a limit on how your data is processed.
- Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests.
- Right to Lodge a Complaint: You have the right to complain to a data protection authority (e.g., Berliner Beauftragte für Datenschutz und Informationsfreiheit).