Privacy notice
DecisionWheel runs entirely in your browser. There is no account, no database of user content and no analytics. What does arise nonetheless is set out here.
This is a translation provided for convenience. The German version is the legally binding one.
1. Controller
HSDC GmbH Flammerweg 1074076 Heilbronn
Germany
contact@hsdc.dev
Further details in the legal notice.
2. Processing operations
2.1 Delivering the page (server logs)
When the page is requested, the web server records technical details: IP address, time, address requested, status code, volume of data transferred, the identifier reported by your browser and, where applicable, the referring page.
- Purpose: delivering the page, operational security, detecting and investigating faults and attacks.
- Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is secure and undisturbed operation.
- Retention: 7 days, then deleted automatically.
On the contents of shared links: a full wheel link
(#w=…) is never transmitted to the server by the browser — everything
after the hash stays on your device. The readable short form (?e=…) is
different: it is part of the address. The entries are therefore stripped before the
log is written and are not stored.
2.2 Storage in your browser
Everything in this section is held in your browser's local storage, stays on your device and is not transmitted to us. Clearing your browser data clears it too; we can neither read it nor restore it. No cookies are set for advertising or analytics.
Without your decision, nothing is stored. Anyone who opens the page, uses it and leaves again without answering the question leaves not a single entry on their device. Every row in the table below comes into being only through an action by which you ask for exactly that — the last one through your answer itself, even when that answer is “no”:
| What | When | Why |
|---|---|---|
dw:state |
only once you agree to the question whether your wheel should stay on the device | The wheel you are working on, with its history and settings |
dw:library |
only once you save a wheel | Your saved wheels |
dw:lang |
only once you switch the language | Your choice of language on your next visit |
dw:closed |
only once you dismiss a hint | So the same hint does not come back |
dw:consent |
as soon as you answer the question — including when you answer “no” | Your answer, so that we honour it and do not ask again |
About the last row: a refusal is recorded too. Without that single entry we would have to ask you again on every visit — and a refusal you have to repeat daily would not be one. Remembering your answer is therefore necessary in order to follow it.
The question does not appear when the page loads, but at the moment something would first be stored — that is, after you have changed the wheel yourself. You can change your answer at any time under Design; switching it off there removes what was stored.
- Legal basis: § 25(1) TDDDG — your consent. For the consent record itself, § 25(2) no. 2 TDDDG, because your decision cannot be followed without it. Insofar as personal data are processed in the course of this, Art. 6(1)(a) GDPR.
- Retention: until you delete it — via the switch under Design or via your browser settings, at any time and without asking us.
2.3 Offline storage (service worker)
The application can store itself on your device so that it runs without a network connection. To do so, the browser keeps the page's program files, fonts and images in a separate store (Cache Storage) and sets up a service worker — a small program that serves the page from that store from then on.
This does not happen by itself. It begins only when you ask for it: via the Make available offline switch under “Design”, or by installing the page to your home screen. Anyone merely looking at the page gets neither.
- Contents: files belonging to this page and nothing else. None of your input, no wheels, no names.
- Purpose: keeping the page usable without a network.
- Legal basis: § 25(1) TDDDG — your consent, given by switching it on or by installing.
- Deletion: the same switch, turned off, removes the service worker and the store completely. So does clearing your browser data or uninstalling the application.
2.4 Contacting us by e-mail or telephone
If you write to us, we process what you provide in doing so: your sender address, the content of your message and any name you give. If you call the number stated in the legal notice, we process your telephone number insofar as it is transmitted, together with what you tell us during the call. We use these details solely to deal with your enquiry; calls are not recorded.
- Purpose: answering and handling your enquiry.
- Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is responding to an enquiry addressed to us. If your enquiry is aimed at a contract, Art. 6(1)(b) GDPR applies in addition.
- Retention: until your matter has been conclusively dealt with and no statutory retention periods stand in the way. The correspondence is then deleted.
We run our mailboxes on Google Workspace. Google Cloud EMEA Limited processes the messages as our processor; processing takes place in a worldwide infrastructure, so your message may also be transferred to the United States. More on this in section 3.2.
2.5 What you have to provide
Nothing. There is no legal or contractual obligation to give us data, and you need provide nothing in order to use the wheel — no account, no name, no address.
- Technically unavoidable is your IP address alone: without it no server can send you a page (section 2.1).
- Everything else is voluntary. If you do not write or call, we cannot answer your enquiry — that is the only consequence. Anyone who does not switch on offline storage uses the page with a network just the same.
- The entries on your wheel do not reach us. They are not a submission to us but your own working material.
3. Recipients
We do not pass personal data to third parties for their own purposes. Two service providers process data for us and solely on our instructions: STRATO GmbH, Berlin, which operates the server, and Google Cloud EMEA Limited, Dublin, which runs our mailboxes.
3.1 Hosting
The site runs on a server in Germany; STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, operates the underlying infrastructure. This concerns what is described in section 2.1.
For operation and maintenance STRATO engages further processors; individual ones are based outside the European Union — the supplier of the virtualisation software, for instance. For those cases the transfer rests on an adequacy decision of the European Commission or on its standard contractual clauses. We therefore do not claim that processing takes place exclusively within the European Union: the server stands in Germany, but we cannot promise that for every hand laid on it.
3.2 E-mail
Our mailboxes are run as part of Google Workspace by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. This concerns only what is described in section 2.4 — that is, only if you actually write to us.
We have not set up a restriction of storage to European data centres; we therefore cannot guarantee that your message is processed exclusively within the European Union. In particular, a transfer to the United States takes place.
As at the date given below, that transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which Google is certified; in addition, the European Commission's standard contractual clauses apply. Should the adequacy decision cease to apply, the standard contractual clauses continue to carry the transfer — we will then update this statement.
There is no automated decision-making within the meaning of Art. 22 GDPR by HSDC GmbH. The wheel's random draw is unaffected by this: it runs in your browser, involves no decision about you as a person and does not reach us. No profiling takes place.
4. Your rights
You have the right at any time to
- access the data processed about you (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- object to processing based on a legitimate interest (Art. 21 GDPR).
Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out until then remains unaffected.
Right to object
We process the data named in sections 2.1 and 2.4 on the basis of a legitimate interest (Art. 6(1)(f) GDPR). You have the right to object at any time, on grounds relating to your particular situation, to that processing (Art. 21(1) GDPR).
If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. An informal message to contact@hsdc.dev is enough to object.
To exercise these rights, a message to contact@hsdc.dev is enough.
5. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Lautenschlagerstraße 2070173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de
You may equally turn to the supervisory authority of your place of residence or place of work.
6. Changes
If new features are added that process further data, this notice will be extended accordingly beforehand.
Version of this privacy notice: 11 August 2026