Privacy Policy

Last updated: 2026-10-21

1. Controller

The controller responsible for processing personal data on https://schaffa.dev is:

Tobias Heer
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen
Germany

Additional contact: beastyrabbit.com/kontakt, impressum-schaffa@heerlab.com.

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

This policy explains which personal data is processed when you use Schaffa, for what purposes, on which legal basis, and for how long. Schaffa is a private, non-commercial project. Schaffa publishes HTML pages, files, step-by-step guides and presentations through public links.

Personal data is not sold and not used for advertising. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

3. Hosting and delivery

Schaffa runs on the controller's own server infrastructure in Germany. Requests from the internet reach the application through a reverse proxy on a virtual server operated by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (data center in Nuremberg). netcup processes the data as a processor under a data processing agreement pursuant to Art. 28 GDPR. The connection is TLS-encrypted up to the reverse proxy and forwarded from there to the controller's infrastructure through an encrypted tunnel.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure and reliable provision of the website.

To back up data, backups are regularly created within the controller's own infrastructure; they are overwritten after their retention period has elapsed.

4. Server log files

For every request, the reverse proxy automatically stores the following data:

IP address of the requesting device
date and time of access
requested address (path including parameters), HTTP method and protocol
HTTP status code, amount of data transferred, and response time
browser identifier (user agent)
TLS version and cipher used
target service

The Cookie and Authorization headers are redacted. URL paths and query parameters are logged.

This data is used to operate the site, analyse errors, and defend against attacks and abuse. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the stability and security of the service. Log files are deleted automatically after 14 days.

Pangolin retains HTTP request logs for 14 days, network logs for 30 days and authentication logs for 90 days. Short-lived application container logs contain connection data such as IP address, URL and response status and are deleted during size-based rotation or when the container is replaced. CrowdSec retains local attack alerts only briefly, generally for seven days. This processing serves secure operation, error analysis and access control under Art. 6(1)(f) GDPR.

5. Protection against attacks (CrowdSec)

To protect against attacks, the security software CrowdSec automatically analyses the server log files and blocks IP addresses that are clearly the source of attacks (for example mass login attempts or scanning for vulnerabilities). When CrowdSec detects an attack, the IP address, time and type of attack are sent to CrowdSec SAS, 20 rue Maurice Arnoux, 92120 Montrouge, France. CrowdSec uses these reports for a shared blocklist that protects many servers. No data is sent to CrowdSec during normal browsing.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is protecting the website and its users from attacks.

According to CrowdSec, the controller and CrowdSec are jointly responsible for this processing (Art. 26 GDPR): CrowdSec is responsible for operating its central services and blocklists, the controller for its use on this server. You can exercise your rights against either of them; CrowdSec can be reached at dpo@crowdsec.net. CrowdSec may pass the reported data on to members and partners of its network. According to CrowdSec, transfers to countries outside the EU are based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Full IP addresses are generally retained for no more than three months and then progressively generalised. CrowdSec describes exceptions of up to one year before anonymisation for certain attack analyses and training purposes. Details: crowdsec.net/privacy-policy.

6. Sign-in (single sign-on)

Schaffa is partly accessible only after sign-in. Sign-in is handled by the Pangolin reverse proxy with Pocket-ID, an identity service self-hosted on the controller's infrastructure. This processes your user name, e-mail address, group membership, time of sign-in and IP address. After sign-in, Pangolin sets a session cookie that is technically required for access.

Access control restricts internal administration to authorised invited people. The legal basis is Art. 6(1)(f) GDPR. Schaffa also requires an admin token for administration.

The user account in Pocket-ID and Pangolin exists for as long as access is granted and is deleted on request or after access is revoked. Authentication logs are deleted after 90 days.

7. User account and content

Schaffa stores account identifiers and optional profile data from sign-in, sessions and agent tokens, as well as uploaded pages, files, guides and presentations including versions and metadata. Content may contain personal data about the uploader and third parties. Processing takes place on the controller's own infrastructure in Germany to provide accounts, publication and secure content management. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is providing these functions and preventing abuse.

Published content and its published versions are accessible to anyone who knows the link. There is no public content directory; links are not access protection. The operator can access content for administration and removal requests.

You can delete your own pages and files through the account or with the owning token through the CLI/API, and guides with the owning token through the CLI/API. The administrator can also delete this content. Individual page versions can only be deleted through the account or by the administrator. Published guide versions remain even after individual steps are removed. Separately uploaded files must be deleted separately. Agent tokens can be revoked; their records remain. Account deletion can be requested from the operator; it removes the profile and sessions and revokes tokens, but does not delete published content. Affected third parties can request removal of content concerning them at datenschutz-schaffa@heerlab.com, including the affected URL. Copies already downloaded or cached cannot be recalled.

Anonymous pages expire automatically after a short time and are automatically deleted. Accounts, token records and published content you have not deleted are stored until deleted, at most up to 10 years.

8. Sign-in via Shoo

Opening the sign-in page loads a script from the external service Shoo (shoo.dev), which brokers sign-in with Google. Shoo and Google receive connection data and, on sign-in, the Google account identity and optionally e-mail address, name and picture. Schaffa receives an identifier and the optional profile data. The purpose is the sign-in and access security you request under Art. 6(1)(f) GDPR. For provider details and possible third-country transfers, see Shoo's privacy policy, contact support@ping.gg, and Google's privacy policy. Google Ireland Limited is responsible for the European Economic Area.

9. Upload security scanning

Before publication, uploads are scanned for malware by the self-hosted ClamGate service on the controller's own infrastructure; scan data is deleted after the scan and results after a short time. Images are re-encoded to remove embedded metadata; this serves secure publication under Art. 6(1)(f) GDPR.

10. Contact by e-mail

If you contact us by e-mail, your e-mail address, the content of your message and the technical details of the e-mail are processed to answer your request. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is being able to answer requests.

The mailboxes are hosted by Fastmail Pty Ltd, PO Box 234, Collins Street West, VIC 8007, Australia, as a processor. Data may be transferred to countries outside the EU, in particular Australia, the USA and India. For these transfers, Fastmail uses the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Details: Fastmail privacy policy, data processing agreement and Standard Contractual Clauses. You can obtain a copy of the safeguards by writing to datenschutz-schaffa@heerlab.com.

The controller deletes messages after dealing with the request unless retention remains necessary. Fastmail may subsequently retain backup and log data under its published deletion rules.

11. Analytics and error monitoring

Umami is self-hosted by the operator in Germany. Only after you consent in the cookie banner does Umami collect visits, interactions and performance, as well as masked session recordings and heatmaps on Schaffa's own pages, not on published content. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw consent at any time through "Cookie settings".

Views of published content and API actions are counted in aggregate on the server, without cookies, IP addresses or other personal data. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is understanding how the service is used.

GlitchTip is self-hosted in Germany and processes technical error reports from the browser and server without cookies or browser storage. Tokens, e-mail addresses and URL parameters are removed. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is operational security.

Umami analytics data is deleted after 25 months, session recordings and heatmaps after 30 days. GlitchTip error reports are deleted after 90 days.

12. Cookies and local storage

Without sign-in and without a choice in the cookie banner, Schaffa does not set cookies; only the API documentation at /api stores the selected code-example language as a display setting in your browser's local storage. After your choice, the technically necessary cc_cookie cookie stores your banner decision for six months. Umami sets no cookies and only reads an optional opt-out flag. Signing in uses technically necessary session cookies for the Schaffa account and administration, and Pangolin cookies for administrative access. Shoo sign-in entries are also stored in browser storage. This storage is necessary for the expressly requested access, cookie preference and API documentation display under Section 25(2) no. 2 TDDDG. The legal basis for access security processing is Art. 6(1)(f) GDPR.

13. Your rights

You have the following rights regarding your personal data:

access (Art. 15 GDPR)
rectification (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
withdrawal of consent (Art. 7(3) GDPR): you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to object (Art. 21 GDPR): Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

To exercise your rights, simply send a message to datenschutz-schaffa@heerlab.com.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

14. Obligation to provide data

You are not obliged to provide personal data. However, the website cannot be delivered without the technically necessary connection data, and the protected areas cannot be used without signing in.

15. Changes

This privacy policy is updated when the website or the legal situation changes. The version published here applies.