Privacy policy

1. Controller and scope

This policy applies to the Wolkenworte website, the creation and use of events, the live word cloud, and the configuration and optional ordering of personalised products. The policy published there applies to the public JUSA website: general privacy policy.

2. Hosting and server logs

Wolkenworte is provided at wolkenworte.io through Fly.io, Inc. The current application instance runs in Frankfurt am Main. Fly.io processes connection and log data technically required to deliver and secure the service, in particular the IP address, date and time, requested address, browser and device information, and error and security data.

Application data and private image and print files are stored in a Postgres database and private object store provided by Supabase, Inc. The application uses encrypted connections and accesses the database through a restricted technical role.

Our structured application logs contain only approved technical identifiers and status, duration and error information. Shipping addresses, buyer email addresses, message content and raw IP addresses are not logged there. Fly.io and Supabase also maintain their own operational and security logs under their terms. Processing is necessary to provide the requested functions under Article 6(1)(b) GDPR and for secure, stable operation under Article 6(1)(f) GDPR.

Further information is available in the privacy notices of Fly.io and Supabase.

3. Events and organizer PIN

When a word cloud is created, we process the selected title, the generated event address, and the creation and expiration times.

The organizer PIN is not stored in plain text; it is cryptographically derived using an individual salt. It is transmitted, verified and then discarded only for the requested administrative action; Wolkenworte does not issue a reusable organizer token.

To protect against automated PIN attempts, the normalized IP address is pseudonymized with a secret key. Only this non-reversible check value, the number of failed attempts and the temporary block are stored.

Processing is carried out to provide and manage the requested event on the basis of Article 6(1)(b) GDPR and to protect administrative functions on the basis of Article 6(1)(f) GDPR.

4. Participants, words and live display

Participants do not need an account. When an event is opened, a real-time connection is established and the event code is processed technically. Submitted words are normalised, assigned to the event and stored with their frequency and latest update time. To let participants remove their own contribution, each contribution is also linked to a random technical browser-session identifier. Wolkenworte does not store a link to a named person and does not create participant profiles.

The title and the word cloud are visible to anyone who knows the event link. The randomly generated identifier in the address makes guessing harder but does not replace access control. Do not submit confidential information, special categories of personal data or content about other people without the required authorisation.

If the organizer resets the word cloud, the current words are stored as an archive and the visible word cloud is cleared. This processing supports the requested live function and collaborative creation of the event on the basis of Article 6(1)(f) GDPR.

5. Product design and print files

When a word cloud is designed as a product, we store an immutable snapshot of the words together with the product, quantity, colour theme, layout, edits and technical print dimensions. A print file is generated from this data. The configuration remains independent of later contributions so the preview, payment and production use the same design.

Processing is carried out to prepare and fulfil the requested order pursuant to Article 6(1)(b) GDPR.

6. Shipping address, pricing and Printful

When you request a product preview, we send the saved design to Printful before an order is placed.

For price calculation, we process first and last name, street and house number, optional address line 2, postal code, city, country and, where required, state or region. We also store products, quantities per shipping address, price components, currency, validity period and a random quote identifier.

When you ask us to check delivery, we send the delivery address, product variants and quantities to Printful to determine production, shipping and tax costs and delivery options. This happens before an order is placed. After a real paid order, Printful also receives the order and print data needed for production and delivery.

The provider is Printful. Depending on the processing, Printful may act as a processor or as an independent controller. Further information is available in Printful’s privacy policy. Processing is required to prepare the quote and perform the contract pursuant to Article 6(1)(b) GDPR.

7. Payment through Stripe and PayPal

When you select ‘Check prices and delivery’, we send your name and delivery address, product and shipping amounts, currency, product description and technical order identifiers to Stripe to calculate tax and the final total and prepare the payment page. Stripe also uses the delivery address to calculate tax. When you later open the payment page, Stripe additionally processes payment instrument data, IP address, device and fraud-prevention data, contact details and, where applicable, billing details. We do not receive full card details.

From Stripe, we receive in particular checkout and payment references, payment status, amount, currency and payment time. Stripe may also process data under its own responsibility for legal, regulatory, security and fraud-prevention purposes.

After a successfully verified payment, we receive the buyer email address confirmed by Stripe. We use it solely for required order, shipping, refund and cancellation messages. Delivery recipients do not receive the buyer email address.

For customers in the European Economic Area, Irish Stripe entities are involved in particular. Details are available in Stripe’s Privacy Policy and its Privacy Center. The legal basis is Article 6(1)(b) GDPR; we process legally required records pursuant to Article 6(1)(c) GDPR.

If you select PayPal as your payment method, PayPal receives the order data required for payment through Stripe, in particular the amount, currency and order reference. PayPal also processes your PayPal account data, contact and address details provided to PayPal, payment and transaction data, and technical connection and device data as an independent controller. We do not receive your PayPal login credentials.

The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Details can be found in the PayPal privacy statement. Data processing for payment is based on Article 6(1)(b) GDPR.

8. Storage in the browser

Links to requested product previews are stored in Local Storage for up to twelve hours so reopening does not generate a new preview. The images are loaded directly from Printful.

Wolkenworte uses a functional language-preference cookie. We also offer optional usage analytics with Google Analytics 4. Without your explicit consent, we do not load Google Analytics code or send analytics data to Google.

A random event-specific session identifier is stored in Session Storage. Its sole purpose is to show this browser its own word contributions and allow only those contributions to be removed.

The selected language is stored in a functional cookie. The word cloud’s personal color palette, recently used emoji and basket drafts are stored locally so they remain available on later page views and when moving between the word cloud, configurator and shipping address. The organizer PIN is not stored in the browser.

Local design drafts can be restored for seven days; expired entries are removed on the next visit. Delivery details and quantities are saved in the browser tab for restoration for up to 24 hours. This does not place an order.

Optional sign-in stores a random protected session identifier in an HttpOnly cookie for up to 30 days. Password recovery sessions and Google sign-in identifiers last ten minutes. Access tokens remain encrypted on the server. Account drafts in this browser are bound to their account and are removed here on sign-out or deletion.

This browser remembers the last opened word cloud for seven days so you can return to it. Technical identifiers of purchased designs are also kept for up to seven days to prevent them from reappearing in your cart when going back.

This storage is necessary for the functions expressly requested. The legal basis is Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR.

Optional usage analytics

If you agree, Google Analytics 4 processes page views and selected steps such as product selection, basket activity, price checks and confirmed orders. We send general page types instead of individual event links or names. We do not send words, delivery addresses, email addresses, PINs or Stripe session IDs to Google.

Google Analytics uses the _ga and _ga_* cookies to distinguish browsers and visits; they expire after no more than 180 days. We store your choice for 180 days in a separate cookie without a user identifier. Google also processes technical connection and device data and the approximate origin of the visit. Further processing outside the European Economic Area is possible.

The provider is Google Ireland Limited. We use Google Analytics only to assess use of our service and not for personalized advertising. The legal basis for analytics and access to your device is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time using “Privacy settings” on every page; we then stop further analytics and delete the Analytics cookies in this browser. Processing before withdrawal remains lawful.

Individual event and user data in Google Analytics is set to be retained for two months; aggregate reports may remain available for longer. Further information is available in the Google Privacy Policy.

9. Order emails through Resend

We use Resend, a service of Plus Five Five, Inc., for required order, shipping, refund and cancellation messages. The sender, buyer email address, subject and immutable HTML and text content of the message are sent to Resend. We also process the message identifier and delivery events reported by Resend so that we can trace delivery and handle errors. Open and click tracking is disabled.

Resend stores message data and delivery logs in the USA. The EU sending region determines the technical sending route, not the storage location. Resend cites EU Standard Contractual Clauses and the EU-US Data Privacy Framework as transfer bases. Further information about safeguards is available in privacy policy.

Processing is necessary for contract performance under Article 6(1)(b) GDPR and for reliable evidence and technical safeguarding of delivery under Article 6(1)(f) GDPR.

10. Recipients and international transfers

Recipients are Fly.io for hosting, Supabase for the database, authentication and private files, Printful and delivery providers for production and shipping, Stripe for payments and taxes, and Resend for order and account messages. PayPal also participates in PayPal payments, and Google in Google sign-in. You must provide the delivery and contact details needed to process your order.

When you consent, Google receives analytics data.

Where providers process data outside the European Economic Area, the requirements of Articles 44 et seq. GDPR apply. Depending on the provider, transfers rely in particular on an adequacy decision such as the EU–US Data Privacy Framework or on EU Standard Contractual Clauses with supplementary safeguards.

You can request information about the applicable transfer bases and a copy of the relevant safeguards at kontakt@jusa.io; further details are available in the provider information linked above.

11. Retention and deletion

Events, current and archived words and technical contribution records become eligible for deletion after three calendar months without editing and are removed during daily cleanup. Each successful edit extends this period; viewing alone does not. Unpaid product configurations are also removed unless they are still needed to clarify an unresolved order.

Incomplete address and price quotes are valid for between 5 and 120 minutes, with a default of 30 minutes. Expired, unused quotes are automatically removed after a one-day technical grace period. Paid print files are retained for at least 90 days after submission or 60 days after delivery; a support hold may extend retention.

Order and payment records required for tax purposes, including necessary address details, are generally retained for eight years after the end of the relevant calendar year. Order and refund confirmations also serve as supporting records and are retained for eight years; shipping and cancellation messages are generally retained for six years after year-end. Specific legal requirements may require retention for ten years or longer.

Additional operational copies of delivery and contact details and stored product designs are removed three years after the end of the year in which processing was completed. Technical error and provider details that are no longer needed are removed after 90 days. Checkouts confirmed as unpaid are deleted 30 days after their confirmed expiry; uncertain payment cases remain protected until resolved. These shorter periods do not affect legally required records.

Open complaints, refunds, disputes or audits may extend retention of the required data. Related deletion holds are reviewed regularly. Data held by Fly.io, Supabase, Stripe, PayPal, Printful and Resend is also subject to their respective retention and deletion periods; deletion in our application does not automatically remove copies stored by those providers.

Optional account and saved designs

Designing, participation and ordering work without an account. If you create one, we process your email, authentication data, language and creation, sign-in and activity timestamps. Supabase handles authentication and stores cryptographically derived passwords. Resend sends verification, recovery and security messages.

With ‘Continue with Google’, Supabase and Wolkenworte receive your Google account identifier, email and basic profile information such as name and picture. We do not request access to Gmail or other Google content. Google's privacy policy at policies.google.com/privacy also applies.

Only an explicit save transfers your editable design, name, product, words, colours, fonts, layout, images and preview to private storage. Further edits are not saved automatically to your account. Each account allows up to 20 designs and 100 MB in total. Processing provides the requested account function under Article 6(1)(b) GDPR; security and limited technical records rely on Article 6(1)(f) GDPR.

A design expires three calendar months after its last full opening, explicit save or confirmed successful purchase. The expiry date is displayed with it. Sign-in, the library overview and adding to the cart do not extend this period. Unverified registrations are deleted after seven days; verified accounts without designs after twelve months without account activity.

You can permanently delete designs or your account. Access ends immediately; files and authentication data are immediately submitted for deletion. Provider failures trigger technical retries. There is no trash folder. A technical account identifier remains as a blocking record for up to 35 days to prevent in-flight sign-ins from restoring the account. Short-lived storage and delivery records are cleaned up after a day. Independent cart copies and required order records follow their own retention periods.

In ‘My account’, you can change your email and password, download your account data and editable designs and delete your account after verifying your identity again. Contact kontakt@jusa.io to exercise other privacy rights. Provider logs and existing backups have separate deletion periods; deleted accounts and designs are not reactivated for normal operation from them.

12. Your rights

Under the GDPR, you have in particular the rights of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with future effect. Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation.

You also have the right to lodge a complaint with a data-protection supervisory authority. The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg is one authority responsible for us.

13. Privacy requests and changes

Please send privacy requests to kontakt@jusa.io. If possible, include the event link and do not send the organizer PIN by email. To prevent unauthorized disclosure, we may request appropriate proof of your authorization or identity.

We update this policy when Wolkenworte, its providers or the legal requirements change significantly.