Privacy Policy

Last updated: October 1, 2026

1. Controller and scope

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection laws is:

Christin Löhner
Hofgärtenstr. 13
72172 Sulz am Neckar
Germany

Email: info@fedisuite.com
Phone: +49 1590 1704664

This privacy policy applies to the information website www.fedisuite.com. The FediSuite app at app.fedisuite.com has its own privacy policy (see section 6).

2. Overview of processing activities

On this website, personal data is only processed to the extent required to operate and secure the website, or if you have given your consent. The following processing takes place:

  • server log files when pages are requested (section 3)
  • contact by email or phone (section 4)
  • voluntary registration of FediSuite instances in the instance directory (section 5)
  • technically necessary cookies and storage of your consent decision in the browser (section 7)
  • audience measurement with Matomo, only with your consent (section 8)

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

3. Hosting and server log files

When you visit this website, the web server automatically records data that your browser transmits (server log files):

  • IP address
  • date and time of the request
  • requested URL
  • referrer (previously visited page)
  • user agent (browser and operating system)

The purpose of the processing is to deliver the website, to ensure stability and security, and to defend against attacks and abuse. The data is not merged with other data sources and is not used to build profiles of individual visitors.

The legal basis is Art. 6 (1) lit. f GDPR. The legitimate interest lies in the secure and error-free operation of the website. The log files are deleted after 7 days at the latest.

Providing this data is technically necessary to be able to access the website. There is no legal or contractual obligation to provide it. The processing takes place on the servers on which this website is operated. Where service providers are used as processors, this is done on the basis of a contract under Art. 28 GDPR.

4. Contact, no registration and no forms

This website has no registration, no user accounts, no contact forms and no comment function.

If you get in touch by email or phone, your details (sender address or phone number, content of the message, time) are processed to handle your request. The legal basis is Art. 6 (1) lit. f GDPR (interest in answering inquiries) or, where the request relates to a contract or pre-contractual steps, Art. 6 (1) lit. b GDPR. The data is deleted once the request has been fully handled and no statutory retention obligations apply.

5. Instance directory

Operators of FediSuite instances can voluntarily register their instance in the public directory at www.fedisuite.com/instances through an interface (API). The submitted details are processed: address (URL) of the instance, name, optional description, user count and version, plus a hash of the registration secret and timestamps (verification, last contact).

To confirm ownership, the server of this website calls a verification endpoint on the given instance. In doing so, the IP address of this website's server is transmitted to the instance. A verification token is valid for 15 minutes.

Registered instances are shown publicly with name, description, URL, user count and version. Where these details are personal data (for example the name of an individual), the legal basis is Art. 6 (1) lit. b GDPR (carrying out the registration you requested). The data is stored until the entry is deleted through the API using the registration secret. On request by email to info@fedisuite.com, the entry is deleted as well.

6. The FediSuite app (app.fedisuite.com)

Separate privacy provisions apply to the use of the FediSuite app at app.fedisuite.com (opens in a new tab), and you can read them there. The app requires registration and therefore processes additional data. This privacy policy does not cover the app.

7. Cookies and consent management

Cookies are small text files that your browser stores. This website sets the following cookies:

Technically necessary cookies

The framework in use (Laravel) sets a session cookie (laravel-session) and a cookie that protects against cross-site request forgery (XSRF-TOKEN) when a page is requested. Both contain only randomly generated identifiers and no plain data, they are not used for audience measurement, and they expire after 120 minutes. The legal basis is Section 25 (2) no. 2 TDDDG and Art. 6 (1) lit. f GDPR (secure operation of the website).

Consent management (Klaro)

The consent manager Klaro is used to ask for and manage your consent. Klaro is delivered locally by this website, no connection to third-party servers is made. Your decision (acceptance or refusal per service) is stored in the cookie klaro in your browser. The cookie expires after 120 days, after which you will be asked again. The legal basis is Section 25 (2) no. 2 TDDDG and Art. 6 (1) lit. c GDPR in conjunction with Art. 7 (1) GDPR (proof of consent).

Audience measurement cookies

Matomo only sets cookies if you have given your consent (see section 8). Without consent, they are not set.

Managing and withdrawing consent

You can change your decision or withdraw your consent with effect for the future at any time. Use the button below for this. Alternatively, you can delete the klaro cookie and the Matomo cookies (prefix _pk_) in your browser settings.

8. Audience measurement with Matomo

With your consent, this website uses the web analytics software Matomo to evaluate how the website is used and to improve it. Matomo is operated by the controller (matomo.christin-loehner.de). The data is not passed on to third parties and not used for advertising.

When Matomo is loaded

The Matomo script is only loaded after you have consented in the banner. Before your consent, and after a refusal or withdrawal, no measurement data is transmitted to the Matomo server. If your browser sends a Do Not Track signal, nothing is measured even if you have consented.

Data processed

After your consent, Matomo records the following on each page view and on clicks on outgoing links and downloads:

  • IP address
  • requested page and time of the request
  • referrer (previously visited page)
  • browser, operating system, device type, screen resolution and language setting
  • approximate location derived from the IP address
  • outgoing links and downloads that were clicked

Cookies

  • _pk_id.16.*: pseudonymous visitor identifier, lifetime up to 13 months
  • _pk_ses.16.*: identifier of the current session, lifetime 30 minutes

Matomo may additionally set short-lived auxiliary cookies with the prefix _pk_. The cookies are stored on www.fedisuite.com.

Legal basis, voluntariness and withdrawal

The legal basis for storing and reading information on your device is Section 25 (1) TDDDG, and for the subsequent processing of the data Art. 6 (1) lit. a GDPR (consent). Consent is voluntary. The website can be used in full without consent. You can withdraw your consent with effect for the future at any time (Art. 7 (3) GDPR), for example with the button in section 7. The lawfulness of processing carried out until then remains unaffected.

Storage period

The cookies expire after the periods stated above. The measurement data stored in Matomo is only kept as long as required for audience measurement and is then deleted or anonymized.

9. Fonts and locally hosted resources

This website uses the font "Inter" as a locally hosted file. No connection to Google Fonts is made and no personal data is transmitted to Google. Scripts and stylesheets (including Klaro) are also delivered by this website itself and are not loaded from third-party servers.

10. Retrieval of version and changelog

This website shows the current version number and the latest changes of FediSuite. The server of the website retrieves this information itself from forge.chrislo.de, the controller's Forgejo instance, and keeps it in a cache for a few minutes. Your browser does not connect to forge.chrislo.de in the process, and no data about you or your visit is transmitted. Only the IP address of this website's server is transmitted.

11. External links

This website contains links to external services. When you click one, your browser connects to the respective provider and transmits at least your IP address. The controller has no influence on these services. The provider's own privacy rules apply there. In particular, the following are linked:

  • Forgejo (forge.chrislo.de): source code, issues and changelog, the controller's Forgejo instance
  • Docker Hub (hub.docker.com): Docker image, provider Docker, Inc., USA
  • F-Droid (f-droid.org): Android app source
  • Mastodon profiles in the fediverse (for example lsbt.me and chaos.social): each an independent instance with its own privacy rules
  • Liberapay (liberapay.com): donation platform
  • Weblate (weblate.fedisuite.com): translation platform, an account is required to contribute
  • FediWings (rstockm.github.io/fediwings): sister project hosted on GitHub Pages, provider GitHub, Inc., USA
  • Instances in the directory at /instances: websites of the respective operators

12. Recipients and transfers to third countries

Personal data is not passed on to third parties for their own purposes. Recipients are at most service providers used as processors to operate the servers (see section 3). This website itself does not transfer personal data to third countries. With external links (section 11), a transfer can only take place once you click, and under the responsibility of the respective provider.

13. Data security

This website is delivered over an encrypted connection (HTTPS, TLS). The controller takes appropriate technical and organizational measures to protect the processed data.

14. Your rights

You have the following rights against the controller with regard to your personal data:

  • access (Art. 15 GDPR)
  • rectification (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • notification of recipients about rectification, erasure or restriction (Art. 19 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing (Art. 21 GDPR)
  • withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)

Right to object under Art. 21 GDPR: Where processing is based on Art. 6 (1) lit. f GDPR, you may object to the processing at any time on grounds relating to your particular situation.

To exercise your rights, an informal message to info@fedisuite.com is sufficient.

15. Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for the controller in Baden-Württemberg is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de (opens in a new tab)

16. Currency and changes

This privacy policy is updated when the website, the services in use or the legal situation change. The version published here applies. The date of the last change is shown at the top of this page.

← Back to home