Privacy

Short version: no account, no cookies, no advertising trackers. Your quiz answers stay in your own browser. We count page views, and where on the page people click, with our own cookieless analytics.

Who is responsible

Florian Breitenberger, Münchener Str. 3, 82211 Breitbrunn-Herrsching, Germany. Email: .

Hosting

This site is hosted on Cloudflare Pages (Cloudflare, Inc.). Cloudflare processes the technical data every web request produces, such as your IP address, the requested URL, the time and your browser's user agent, in order to deliver the page and to defend against attacks. Cloudflare acts as our processor under a data processing agreement, and transfers are covered by the EU standard contractual clauses.

Your quiz answers

The quiz runs entirely in your browser. Your answers and your result are written to your browser's localStorage under the key tonesy.quiz.v2 so you can close the tab and continue later. They are not sent to a server, and we cannot read them. Clearing your browser storage deletes them permanently.

Cookies

We set no cookies. localStorage is not a cookie: it is never sent with requests and is only read by this site's own code in your browser.

Payments

The Palette Pass is currently not offered.

When it is offered, it is paid through Stripe Payments Europe, Ltd. When you start a checkout we send Stripe your color season and your four axis values, so that your report can be rebuilt after payment. Card details are entered on Stripe's own page and never reach us. Stripe processes your payment data as an independent controller under its own privacy policy, and the legal basis is the performance of the contract, Art. 6(1)(b) GDPR.

Your report

After payment, your browser receives a signed token containing your season, your axis values and an expiry date 30 days out. The token is what unlocks the report. We keep no database of buyers: the token is the record.

Analytics

We use Matomo, an open-source analytics tool, on our own server (metrics.florianbreitenberger.com), reached through this site's own address. The server is hosted by ALL-INKL.COM (Neue Medien Münnich GmbH) in Germany. Matomo runs without cookies and builds no cross-site profile. It records which pages are visited, the referring site, and device and browser type. It also counts when a test is finished and when the link to the Palette Pass is clicked. It never receives your quiz answers or your result. Your IP address is shortened before it is stored (the last part is removed), so the full address is never kept. To count visits within a day without cookies, Matomo derives a visitor ID from technical request data; this ID changes daily and is not linked to you.

Each visit is additionally counted, with the same shortened data, in a combined overview of all websites we run, on the same Matomo server. Page addresses are reported without any query string and without the part after a # sign.

Raw visit data is deleted after 6 months. The aggregated reports we keep after that contain no personal data.

Legal basis: our legitimate interest in understanding how the site is used so we can improve it (Art. 6(1)(f) GDPR) and, for reading technical device data, Section 25(2) no. 2 TDDDG. No cookie or other storage on your device is used for analytics, except the opt-out entry described below.

To opt out, use the button below. It saves the entry matomo_optout in this browser's localStorage (not a cookie), and from then on the analytics script is not loaded at all. Do Not Track and content blockers keep working as well. You can object at any time (Art. 21 GDPR); the button, Do Not Track or a content blocker take effect from your next page view.

Heatmaps

We also use the heatmap function of our own self-hosted Matomo (the OpenHsr plugin). It runs on the same server and goes through the same proxy, with the same shortened IP address. It records only where on a page you click and, sampled every 200 milliseconds, where your pointer moves, both as positions relative to the size of the whole page. Along with that it records the page address (without query string or the part after a # sign), the device class (mobile, tablet or desktop), the window size and the time spent on the page.

It does not record your screen or anything you type. It sets no cookies. Nothing is stored in your browser. A click point is only kept if Matomo has recorded the matching page view (checked on the server against Matomo's page view ID), so after an opt-out no click points are stored either. Clicks and pointer movements while you answer the quiz questions are not recorded, so your answers cannot be inferred from them.

We use the heatmaps only to see which parts of our pages are used, so we can improve the layout. Raw heatmap data is deleted after 30 days.

Legal basis: the same as for analytics, our legitimate interest (Art. 6(1)(f) GDPR) and Section 25(2) no. 2 TDDDG. The opt-out button above and Do Not Track switch heatmaps off as well.

Your rights

You can ask for access, correction, deletion, restriction or portability of any personal data we hold, and you can object to processing. In practice we hold almost nothing: write to the address above and we will tell you exactly what exists. You may also complain to a supervisory authority, in our case the Bayerisches Landesamt für Datenschutzaufsicht.

Changes

If this page changes, the change is made here. There is no mailing list to notify.