Privacy policy

This explains how ortwort processes personal data, and reflects the current implementation.

Answering a survey never requires an account. By default you answer anonymously: your responses are not stored with any identifier that ortwort can link back to you (see section 2). An account is optional for people who answer — signing in adds one-answer-per-person across your devices and a place on the participation leaderboard. An account is required only to create surveys. Where a signed-in creator and a signed-in answerer are processed the same way, they are described together below.

1. Controller

Uzay Durdu, Spiegelberg 3, 88090 Immenstaad am Bodensee, Germany.
Contact for data-protection matters: info@ortwort.com.

A Data Protection Officer has not been appointed. The conditions of Art. 37 GDPR and § 38 BDSG (in particular the 20-person threshold for automated processing) are not met by this single-operator service. If the service grows past those thresholds a DPO will be appointed and named here.

2. What we collect and why

Your account

Only if you create one — this whole block does not apply to anonymous respondents.

• Sign-in: email address; for password sign-in a hashed password (managed by Supabase Auth); for Google sign-in, the email and Google account identifier passed to us by Google. Purpose: providing the service. Legal basis: Art. 6(1)(b) GDPR (contract).
• Consent record: the timestamp and the version of this policy you accepted when you created the account. Legal basis: Art. 6(1)(c) with Art. 5(2) GDPR (accountability).
• Profile: your credit balance and an append-only credit ledger, your plan and subscription status, a referral code, your email-notification preference, your leaderboard display name and your leaderboard opt-out choice (see section 3). Legal basis: Art. 6(1)(b), and Art. 6(1)(f) for the leaderboard settings.
• Surveys you create: title, description, questions, the target area you draw (a geographic geometry), schedule, response goal, and — if you enable it — a shareable invite link. Legal basis: Art. 6(1)(b).
• Payments: we do not receive or store card details. Our Merchant of Record, Paddle, processes the payment; we store only a Paddle customer id, a subscription id, and plan/renewal status returned by Paddle’s signed webhook. Legal basis: Art. 6(1)(b); statutory retention obligations apply to Paddle as seller.
• Referrals: if you were invited, a record linking your account to the inviter so the referral bonus can be paid after your first published survey. Self-referrals are rejected. Legal basis: Art. 6(1)(b) / Art. 6(1)(a).
• Notifications: an in-app notification when a survey you created receives a response, plus an email to you if you opted in (switchable in Settings). Legal basis: Art. 6(1)(b) / Art. 6(1)(f), with opt-out.

When you answer a survey

• Your answers. Your responses to the questions are stored so the creator can see aggregated results. What is stored with them depends on whether you are signed in:
  • Anonymous (the default). No account id is stored with your response. It is de-duplicated only per browser, through the salted device_hash cookie described below. ortwort holds no identifier that links the response back to you as a person; for us it is effectively anonymous once submitted, and we cannot single it out again on request (Art. 11 GDPR — see section 9).
  • Signed in (optional). Your account id is stored with the response, so that each survey can be answered once per person across your devices and the response can count towards the leaderboard. The response is then pseudonymous personal data that ortwort can associate with your account.
  Either way, a response is never shown to the survey creator or to anyone else with your identity attached — the creator sees only aggregated tallies and coarse map cells. Legal basis: Art. 6(1)(b) (you chose to take part) and Art. 6(1)(f) (integrity of results, one-answer-per-person).
• Location — location-targeted surveys only. Before the browser location prompt you see a plain-language screen and must actively agree. Your device then reports approximate coordinates. The server uses them once to check whether you are inside the target area (plus a 1 km buffer), then discards them. We store only a coarse geohash of precision 6 (a cell of roughly 1.2 km) and a two-letter country code. Exact coordinates are never stored and never shown to anyone. Global surveys, and any survey you open through a shared invite link, do not request your location at all — for those, no location or country is collected. Legal basis: Art. 6(1)(a) (consent); you may withdraw by not submitting.
• Anti-fraud signal. A first-party, HTTP-only cookie (ow_did) is set and stored only as a salted HMAC (device_hash) — it identifies a browser, not a person, and is used to detect duplicate or abusive submissions and to rate-limit. For an anonymous answer it is the only one-answer-per-person key; for a signed-in answer it works alongside your account id. Legal basis: Art. 6(1)(f); for the cookie, § 25(2) TTDSG (strictly necessary for a service you requested).
• Reading accuracy & quality flags: the reported accuracy of the location reading and non-identifying flags about the submission (including whether it came through a shared invite link). Legal basis: Art. 6(1)(f).

We do not run web analytics, advertising, profiling or third-party tracking, and we do not use AI processing of your data. If any of that changes, this policy and, where required, a consent mechanism will be added before it is switched on.

3. Participation leaderboard

ortwort shows a public leaderboard that ranks accounts by the number of surveys they have answered while signed in (one entry per survey). It is visible to every visitor, signed in or not. Answering never requires an account; anonymous answers are not counted here and no anonymous respondent is listed.

• What is shown: a rank, a display name, and a participation count. Nothing else — no email, no location, no survey content, no identifiers.
• Display name: by default this is an automatically generated, non-identifying handle (for example Surveyor-1a2b). A name that identifies you is only shown if you deliberately set one in Settings → Participation. You can change or clear it there at any time.
• Opt-out: Settings → Participation lets you hide yourself from the public leaderboard entirely. Your own standing is still shown to you privately.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in encouraging participation, balanced by the minimal, mostly non-identifying data shown and the one-click opt-out. You may object under Art. 21 GDPR.

4. Contact form

If you write to us through the contact form, we store your name, your email address, your message, and a salted hash of your IP address (used only to rate-limit spam and abuse), and we send the message to info@ortwort.com via our email processor (Resend). Legal basis: Art. 6(1)(b) (steps prior to a contract, or an existing one) and Art. 6(1)(f) (handling and documenting enquiries). We keep the message until the enquiry is resolved and for a limitation period thereafter.

5. Server logs

Our hosting provider (Vercel) processes standard request data, including the IP address, transiently to deliver and secure the service. We do not keep our own long-term access logs. Vercel’s data-processing terms apply. Legal basis: Art. 6(1)(f).

6. Processors and recipients

We use the processors below under Art. 28 GDPR, each with a data-processing agreement. Where a processor is outside the EU/EEA, transfers are based on the EU Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework as provided in that processor’s DPA; Switzerland is covered by an EU adequacy decision.

• Supabase (Supabase, Inc.) — database, authentication and file storage; the project is hosted in the EU (Frankfurt). Also sends account emails (sign-in links, confirmations, password resets).
• Paddle (Paddle.com Market Ltd, United Kingdom) — reseller / Merchant of Record for all payments: runs the checkout, processes payment data, calculates and remits VAT, issues invoices.
• Resend (Resend, Inc., USA) — sends our transactional email: the “new response” notifications to creators who opted in, and messages submitted through the contact form.
• Google (Google Ireland Ltd) — only if you choose “Continue with Google” to sign in; Google authenticates you and returns your email and account id.
• MapTiler (MapTiler AG, Switzerland) — serves the map tiles shown in your browser and thereby receives your IP address and the map area being viewed.
• Vercel (Vercel, Inc., USA) — application hosting; serverless functions are configured for an EU region.

7. Cookies and local storage

See the cookie information. In short: a Supabase session cookie for signed-in users, the strictly-necessary ow_did anti-fraud cookie and ow_loc_consent location-consent cookie for the answer flow, and a few localStorage / sessionStorage keys for UI preferences and to carry your consent choice through the sign-in redirect. No advertising or analytics cookies are set.

8. Retention

• Account data and everything linked to it is kept until you delete your account. Settings → “Delete account” removes your profile, your surveys and their questions, the responses you gave while signed in, and your presence on the leaderboard. Anonymous responses carry no link to your account, so they are not identifiable as yours and are not affected. Provider backups may persist for a short rolling window as set out in each provider’s DPA (typically up to 30 days).
• Individual survey responses are kept while the survey exists in the creator’s account; deleting a survey deletes its responses. In addition, the row-level responses of a closed survey are automatically deleted 12 months after it closed — any account link (for answers given while signed in), the coarse cell, the country code and the quality flags are all removed, and only the survey’s aggregate response count remains. This sweep also trims webhook and notification history.
• The consent record (timestamp and policy version) is kept for the life of the account and for a limitation period thereafter, for accountability.
• Contact-form messages are kept until the enquiry is resolved and for a limitation period thereafter.
• Payment and invoice data is held by Paddle as seller under its own statutory retention obligations (German commercial and tax law generally require 6–10 years).

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)). You can remove yourself from the public leaderboard, and change your display name, in Settings → Participation. For an anonymous survey answer we keep no identifier that links it to you, so we cannot retrieve, correct or delete an individual anonymous response, and are not required to collect more data just to enable that (Art. 11 GDPR); the per-browser anti-fraud cookie can still be cleared in your browser. Contact: info@ortwort.com. You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Königstraße 10a, 70173 Stuttgart, baden-wuerttemberg.datenschutz.de.

10. Children

The service is not directed at people under 18. You must be 18 or older to create an account or answer a survey. We do not knowingly collect data from minors; if we become aware that an account belongs to a person under 18, we will delete it. There are no age-targeted surveys.

11. Changes

We may update this policy as the service changes. The current version is “2026-09-09”. The version you accepted is recorded against your account; where a change introduces materially new processing, we will ask you to accept the updated policy before that processing applies to you.