Privacy Notice

This notice explains how Roastbook processes personal data when you visit roastbook.coffee, read its guides, or join the waitlist. It also explains your rights under the General Data Protection Regulation (GDPR).

The controller is:

1. At a glance

• You do not need an account to use this website.
• Guide helpers such as the espresso ratio calculator run in your browser and do not send their inputs to us.
• We do not use advertising trackers or analytics cookies, and we do not sell personal data. A strictly necessary first-party cookie remembers your privacy choice.
• Hosting providers necessarily process request data, and only with your consent we use cookieless analytics to understand use and performance.
• If you join the waitlist, we process the email address you choose to send.

2. Hosting and server logs

Roastbook is hosted by Vercel Inc. When your browser requests a page or asset, Vercel may process the IP address, request URL, date and time, referrer, user-agent information, response status, and similar technical data needed to deliver and secure the site.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are reliable delivery, abuse prevention, troubleshooting, and the security of the service. Technical logs are retained according to the applicable Vercel account settings and then deleted or aggregated, unless an incident requires longer retention.

3. Storage on your device

The c15t consent manager stores your privacy choice, its time, and a randomly generated browser subject identifier in a first-party c15t cookie and mirrors that record in localStorage. This local-only configuration does not send the consent record to a c15t backend. The record remains on your device and can be removed through your browser settings.

This storage is used to provide a function you request. Where § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies, it is based on the strictly necessary exception in § 25(2) no. 2 TDDDG.

4. Cookieless analytics

With your “Analytics” consent, we use a self-hosted Umami instance to understand site use and performance. Umami does not set analytics cookies, and its script loads only after you enable that category. Until then, it does not collect browser usage data. Reports may include the page path, referrer, approximate location derived from the request, browser, operating system, device type, screen size, and language. Umami is configured to respect browser Do Not Track signals.

The legal basis is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw consent at any time with effect for the future via “Privacy settings” in the footer; withdrawal does not affect the lawfulness of processing before it. The consent manager reloads the page when consent is withdrawn so the tracker no longer runs. Analytics records are deleted or aggregated when they are no longer needed for trend analysis.

After a successful waitlist signup, our server sends Umami an event named “waitlist_signup” so we can measure how many people join. The event contains no email address or other personal data, and involves no script or storage on your device. It is based on Article 6(1)(f) GDPR, our legitimate interest in measuring signup reliability with limited, cookieless data.

5. Waitlist

If you join the waitlist for hosted Roastbook, we process your email address and the time of signup to inform you when the hosted version is available and to gauge interest. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time by emailing us. Withdrawal does not affect processing that occurred before it.

Signups are sent through our server to Resend, our email delivery provider, and delivered to our administrative inbox. We do not maintain a separate signup database.

6. Service providers and international transfers

Vercel and Resend may process data in the United States and through their subprocessors. Their data-processing terms provide transfer safeguards including the European Commission's Standard Contractual Clauses; certified recipients may also rely on the EU–US Data Privacy Framework. Details are available in the Vercel Data Processing Addendum and Resend Data Processing Addendum.

7. Retention

• Waitlist addresses are retained until you withdraw consent or the hosted version launches and the announcement has been sent, unless limited retention is required to document or honor the withdrawal.
• Analytics and technical data follow the periods or deletion criteria described in sections 2 and 4 and the relevant provider settings.

8. Your rights

Subject to the conditions in the GDPR, you may request access to and rectification or erasure of your personal data, restriction of processing, and data portability. You may object on grounds relating to your situation to processing based on Article 6(1)(f) GDPR. You may withdraw consent at any time for future processing.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for private-sector controllers in Bavaria is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. Required information and automated decisions

You are not legally or contractually required to provide personal data to use this website. The waitlist email field is necessary to deliver the notification you request; without it, we cannot process that request. We do not use personal data for automated decision-making or profiling with legal or similarly significant effects.

10. Privacy contact

To exercise a right, withdraw consent, object to processing, or ask a privacy question, email michael@lohr-it.de. Provider details are also available in our Legal Notice.

11. Changes to this notice

We update this notice when our processing or the applicable legal framework changes. The date at the top identifies the latest revision.