privacy.txt

Privacy Policy

Effective 30 August 2026. Last updated 3 September 2026.

This policy explains how ok-rich.com handles information when you visit the page or pay for a thumbs-up photo. It sits alongside the Terms of Service and follows Art. 13 GDPR.

Who is responsible

The controller is Tobias Stolz / Weird Revenue, c/o Autorenglück #73720, Albert-Einstein-Straße 47, 02977 Hoyerswerda, Germany, an individual based in Germany. Email: ok@ok-rich.com. Full details: legal notice.

The short version

  • No cookies. None. Not even a "necessary" one.
  • No local storage, no fingerprinting, no accounts, no advertising networks.
  • The website itself stores nothing about you. Data appears only when you pay (at Dodo Payments) and when I email you the photo.

Hosting (Hetzner)

The page runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The web server's access log records your IP address, the time, the page requested, the response code and the browser identification string. It exists so that I can react to an attack or a fault in the days after it, and to see which search and AI crawlers read the site. The log is deleted automatically after 14 days; nothing is archived. The reverse proxy in front of it keeps no access log, only error lines. Legal basis: Art. 6 (1) (f) GDPR (secure operation). A data processing agreement with Hetzner is in place.

Cookieless analytics (Umami)

I use self-hosted, open-source Umami, running on my own server in Germany. It sets no cookies, stores no plain IP addresses and builds no personal profiles; it counts page views, clicks on the pay button, referrer, device type and country (Art. 6 (1) (f) GDPR). No consent banner is needed because nothing that is not strictly necessary is stored on or read from your device (§ 25 TDDDG). If your browser sends a Do Not Track signal, the script does not count you at all.

The counters on the front page

The page asks my own automation (n8n, on the same Hetzner server) once per visit for two numbers: the total paid so far and the number of visits. To avoid counting the same person repeatedly, the server derives a hash from your IP address plus a secret salt, keeps that hash for twelve hours and then deletes it. The IP address itself is never stored, no profile is built, nothing goes to third parties (Art. 6 (1) (f) GDPR, interest in a count that is correct and not inflatable).

Payment (Dodo Payments)

The pay button leads to a checkout page of Dodo Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. There you enter the amount, your email address, your payment details and an optional message. Dodo Payments processes the payment data as its own controller; I receive the amount, your email address, the optional message and a payment reference, never your card details (Art. 6 (1) (b) GDPR, contract). See dodopayments.com/privacy.

Notification and email delivery (n8n, Google Workspace)

After payment, Dodo Payments sends the amount, your email address, the message and a reference to my automation (n8n) on the Hetzner server, which notifies me and sends you a confirmation. I then email you the photo through Google Workspace (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework and standard contractual clauses apply in addition. A data processing agreement is in place through the Google Workspace Cloud Data Processing Addendum (Art. 6 (1) (b) GDPR).

Sending the photo to someone else

The pay page has an optional field for a different delivery address, so the photo can be a gift. If you fill it in, I receive that address together with the payment and use it exactly once, to send that one photo. Legal basis: Art. 6 (1) (f) GDPR, the interest you and I share in delivering what was bought to the person it was bought for. It never goes on a list, is never used for anything else, and is deleted on the schedule below.

By entering an address you confirm that you may give it to me. I cannot check that, so the responsibility is yours, and the Terms say the same.

If you are the recipient and did not expect this: your address reached me from the person who paid, whose name the email carries, and it was used only to send you that photo (Art. 14 GDPR). Write to ok@ok-rich.com and I will delete it immediately and confirm that I have. You may object at any time under Art. 21 GDPR. If an address looks like it was given to annoy someone, I send the photo to the buyer instead, or refuse the order and refund it.

Top contributors board

The display name you enter before payment is shown publicly with the amount, unless you type "anonymous". Legal basis: Art. 6 (1) (b) GDPR, because the public entry is part of what you buy. Entries are grouped by name, so two payments under the same name become one line. If a payment is refunded, its amount comes off that line automatically and the line disappears once nothing of it is left. You can also ask me to anonymise or remove your entry at any time.

Wall of Thumbs

Your photo only appears in the public gallery if you ask for it in the checkout message field ("wall me"). That is consent under Art. 6 (1) (a) GDPR and you can withdraw it at any time by email, with effect for the future.

How long anything is kept

  • Your email address, any delivery address you gave and your message: deleted 30 days after the photo has been sent, both from the automation and from my mailbox.
  • The visitor hash: twelve hours, then gone.
  • Payment records: kept at Dodo Payments and in my bookkeeping for as long as tax and commercial law require (up to 10 years).

Your rights

You may ask for access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and you may object (Art. 21 GDPR). Write to ok@ok-rich.com. You may also complain to me at complaints@ok-rich.com, or to the data protection supervisory authority responsible for your place of residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

Children

This is for adults. I do not knowingly process data of children. If you believe a child has used the Service, write to me and I will delete what I can identify.

Changes

I update this policy when the Service or the law changes; the date at the top is the current version.

← back to the pinboard