Privacy policy

Last updated: 3 August 2026 · This page describes how this website processes personal data under the EU General Data Protection Regulation (GDPR).

1. Controller

OpenForests UG (haftungsbeschränkt)
Moerser Straße 171, 47803 Krefeld, Germany
Phone: +49 (0) 2151 4114644
E-mail: contact@openforests.com

2. What we process, and why

a) Visiting this website

Our hosting provider processes the technical data your browser transmits (IP address, requested page, browser type, timestamp) in server logs to deliver the site and keep it secure (Art. 6(1)(f) GDPR — legitimate interest in operating the site). We set no tracking cookies. All fonts, scripts, and styles are served from our own host — no requests are made to Google or other CDNs.

b) Climate data and location search

When you search for a place or view a location's climate dashboard, your browser requests data from our own climate-data cache (hosted at Supabase, see section 3) and from Open-Meteo (open-meteo.com), transmitting your IP address and the searched coordinates. Open-Meteo is an open-data weather service that does not create user profiles. If you use the optional "My location" button, your browser asks for permission first; the coordinates are rounded to roughly 10 km before use, never appear in the page address, and are not stored by us. Maps and satellite imagery — the interactive maps, page-header backdrops, place banners, and downloadable share images — load from Mapbox (Mapbox, Inc., USA — certified under the EU–US Data Privacy Framework; map data © OpenStreetMap contributors). Mapbox receives your IP address and the coordinates of the displayed place for those requests. These are always the coordinates of a publicly listed place — your own device location is never sent to Mapbox. Legal basis: Art. 6(1)(b)/(f) GDPR — providing the service you request.

c) Submitting a story

When you submit a story we process: title, story text, location, optionally your first name and photo — for publication on this website, based on your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time with effect for the future by e-mailing us (section 1); we will then remove the story. Photos are re-encoded in your browser before upload, which removes embedded metadata such as GPS coordinates.

When you submit a story, our moderation team receives a notification e-mail containing the story text, location, and your first name if given, delivered via Resend (Resend, Inc., USA — data-processing agreement with EU standard contractual clauses). Legal basis: Art. 6(1)(f) GDPR — operating the review process.

To prevent spam we additionally process: a salted hash of your IP address (the IP itself is not stored), deleted after 30 days; and the result of the Cloudflare Turnstile anti-bot check (Cloudflare, Inc., certified under the EU–US Data Privacy Framework), which processes technical browser signals on the submission page only. Legal basis: Art. 6(1)(f) GDPR — preventing abuse. Submissions that are not approved for publication are deleted after 60 days.

d) Recently explored places

When you open a named place in the climate explorer, that place (its public name and city-level coordinates) is counted in an anonymous, publicly visible "recently explored" list. The list contains only places and view counts — nothing about who viewed them — and your own position (the "My location" button) is never recorded in it. Legal basis: Art. 6(1)(f) GDPR — showing what the community explores.

e) Usage statistics

We record anonymous usage events (e.g. "a story page was viewed", "a story was shared on LinkedIn") together with the referring website's domain. No cookies are set, no IP addresses stored, and no identifiers created — events cannot be linked to any person or session. Legal basis: Art. 6(1)(f) GDPR — measuring the reach of the site. Events are deleted after 180 days.

3. Processors and recipients

We use the following processors under Art. 28 GDPR data-processing agreements: Supabase (database, image storage, and climate-data cache, EU region), Netlify (hosting; certified under the EU–US Data Privacy Framework), and Resend (submission notification e-mails to our team, see section 2c). Published stories are, by their nature, publicly visible to all visitors.

4. Local storage

We store computed climate statistics (no personal data) and, on the climate explorer, a list of the places you recently viewed — kept only in your own browser, never sent to us — in your browser's localStorage, so pages load faster on repeat visits. Team members who log in to the moderation area additionally have a login session stored in their browser. This storage is technically necessary for the service and can be cleared in your browser at any time.

5. Retention

Published stories remain online until you withdraw consent or we remove them. IP hashes: 30 days. Unapproved submissions: 60 days. Hosting logs: per our providers' standard short retention.

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21), and to withdraw consent at any time (Art. 7(3)). Contact: section 1. You may also lodge a complaint with a supervisory authority — for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (ldi.nrw.de).