Privacy

As of: 7 November 2026. English translation of the German original; if in doubt, the German text applies.

In short

• You can view and share our cards without an account and without entering anything.
• We set no cookies, do not measure visits and embed no advertising or services of other providers. We serve fonts, images and videos ourselves.
• When you open the site, our host Cloudflare creates technically necessary logs.

Controller

The controller under Art. 4 no. 7 GDPR is the provider named in the Imprint:

We have not appointed a data protection officer because we are not obliged to.

Visiting the website

The pages are hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare delivers them through data centres, usually one near you. In doing so Cloudflare processes on our behalf:

• IP address, date and time of the request
• requested address, amount of data transferred, status code
• browser and operating system (user agent), and the previously visited page (referrer) if your browser sends it

Purpose: delivering the pages, detecting and fending off attacks and misuse. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is a secure, available website.

Retention: We do not store these logs ourselves and have no access to them. Cloudflare keeps them only as long as needed for delivery, security and troubleshooting, and then deletes them under its own schedules.

Data processing agreement: We have a data processing agreement with Cloudflare under Art. 28 GDPR (Data Processing Addendum).

Transfer to the USA: Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; the transfer relies on the European Commission’s adequacy decision (Art. 45 GDPR) and, in addition, on standard contractual clauses (Art. 46 (2) (c) GDPR).

At Cloudflare we have switched off everything that sets cookies or inserts scripts of other providers (e.g. Web Analytics, Bot Fight Mode).

Storage on your device

We store nothing in your browser: no cookies and no entries in local storage. The language is only part of the page address (e.g. /de/ or /en/).

Sharing cards

If you tap “Share”, the share sheet of your device opens. What you choose there (e.g. WhatsApp, Instagram or a message) goes straight from your device to that app; we learn nothing about it. If your device offers no share sheet, we copy the link to your clipboard; this too happens only on your device. The privacy notices of the app you choose apply. The cards contain no fields for names or other details; only the address of the card is shared, in the language you are currently viewing (e.g. /en/diwali/… or /pa/bandi-chhor/…).

Motion sensor

Some cards move their image layers slightly when you tilt your phone. For this your browser reads the orientation or motion sensor; on iPhones it asks for permission first. The values are used only on your device for this effect and are neither transmitted nor stored.

If you write to us

If you send us an email, we process your address and the content in order to reply (Art. 6 (1) (f) GDPR; our legitimate interest is answering enquiries). We delete the message when the enquiry is dealt with and no statutory retention duty applies. Our emails are hosted by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Gmail).

Our profiles on Instagram, TikTok, YouTube and Facebook

On this website Instagram, TikTok, YouTube and Facebook are only linked, not embedded. Only when you tap a link do you leave our site, and the platform’s terms apply.

For our profiles there:

• Instagram and Facebook are operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. For the statistics on our profile and our page (Insights) we are jointly responsible with Meta (Art. 26 GDPR); Meta provides the agreement and then takes on the main responsibility, including for your rights as a data subject.
• TikTok is operated for users in the EU by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited. For the statistics on our profile (TikTok Analytics) we are jointly responsible with TikTok (Art. 26 GDPR); TikTok provides the agreement at TikTok Analytics Joint Controller Addendum.
• YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google does not offer a joint controller agreement for YouTube channels and processes the data for the statistics of our channel (YouTube Analytics) as an independent controller.

We only see what the platform shows us: public profiles, comments and messages to us, and aggregated statistics. We use this to answer messages and to improve our posts (Art. 6 (1) (f) GDPR). Which data the platforms process themselves is described in their privacy notices.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Simply write to us at the address above.

Objection (Art. 21 GDPR): Where we process data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation.

Complaint: You can complain to a data protection supervisory authority, for example the one responsible for us: the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf.

You do not have to give us any data to view the cards; without the technical logs, however, the site cannot be delivered. There is no automated decision-making or profiling.