Privacy Policy

Controller

Mario Nowak
Fritz-Kohl-Straße
Mainz
Germany
hello@marionowak.com

There is no statutory obligation to appoint a data protection officer for this service, so none has been appointed. Send data protection requests to the address above.

Scope

This policy covers two separate things:

• the public website at idealweek.marionowak.com, which anyone can visit
• the application at app.idealweek.marionowak.com, which requires an account

The website is a set of static pages. It sets no cookies, runs no analytics, embeds no tracking pixels, and loads no fonts, scripts, or images from third-party servers. Visiting it does not create a profile of you.

Website server logs

Every request to the website is recorded by the web server. Each log line contains your IP address, the date and time, the requested page, the HTTP status code, the amount of data transferred, the referring page, and your browser’s user agent string.

Purpose: delivering the pages, diagnosing faults, and detecting abuse. Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is operating a functioning and reasonably secure website. Logs are deleted after 14 days and are not combined with any other data.

Hosting

The website and the application run on servers operated by OVHcloud in EU. The provider processes data strictly on instruction as a processor under Art. 28 GDPR, on the basis of a data processing agreement.

Contacting me by email

If you write to hello@marionowak.com, your email address, your name if you give it, and the content of your message are processed in order to answer you. Legal basis: Art. 6(1)(f) GDPR for general enquiries, or Art. 6(1)(b) GDPR where your message concerns an existing account. Correspondence is deleted once it is no longer needed and no retention obligation applies.

Creating an account with Google

The application has no password login. You sign in with your Google account through OpenID Connect. When you start the sign-in, you are redirected to Google, and Google decides what it tells me based on the permissions you grant. The requested scope is openid email profile.

From that sign-in the following data is stored in the application database:

• your email address, which also identifies your account
• your first name and last name
• the web address of your Google profile picture
• the time zone reported by your browser, used to place your plan on a calendar correctly
• the times your account was created and last changed, and whether you finished onboarding

Purpose: creating and running your account. Legal basis: Art. 6(1)(b) GDPR, because this processing is necessary to provide the service you asked for. Without this data an account cannot exist.

Your profile picture is not copied onto my servers. Only its address is stored, so your browser fetches the image directly from Google when the application displays it.

Google Ireland Limited and Google LLC act as independent controllers for the sign-in itself. Their handling of your data is governed by Google’s own privacy policy. Data may be transferred to the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection.

Your weekly plan

The content you create in the application is stored under your account: the titles of your time blocks, their categories, emoji, days and times, and whether editing is locked. This content is visible only to you unless you publish a calendar feed as described below. Legal basis: Art. 6(1)(b) GDPR.

Calendar feed

You can optionally generate a calendar feed so that your weekly plan appears in an external calendar application. The feed has a long, randomly generated address. Anyone who knows that address can read the contents of your weekly plan without signing in, because calendar applications cannot log in on your behalf. Treat the feed address as a secret and share it carefully.

No feed exists until you create one. You can generate a new address at any time in the application, which immediately makes the previous one stop working.

Cookies

The application sets two cookies, both strictly necessary to sign you in and keep you signed in:

• a short-lived session cookie that secures the sign-in exchange with Google and remembers where to send you afterwards
• a login cookie named iw-token, valid for seven days, that identifies you on each request

Both cookies are set with the HttpOnly flag, so scripts in your browser cannot read them. Neither is used for analytics or advertising. Because they are strictly necessary to deliver a service you explicitly requested, they are exempt from the consent requirement under §25(2) TDDDG, and no cookie banner is shown. The public website sets no cookies at all.

Retention and deletion

Account and plan data are kept for as long as your account exists. There is currently no delete button in the application. Email hello@marionowak.com from the address you signed up with, and your account and all associated plan data will be deleted. Server logs are deleted automatically after 14 days. Statutory retention obligations, where they apply, take precedence over deletion.

Your rights

Under the GDPR you have the right to:

• access the data held about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• have processing restricted (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21)

To exercise any of these, email hello@marionowak.com. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

Right to complain

You may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence or place of work. The authority responsible for me is the competent data protection authority.

Changes to this policy

This policy is updated when the service changes. The date at the top of the page shows the current version.