Transparency

Privacy Policy

Private MandelKit regions and your personal iCloud collection are not transferred to this website. A transfer occurs only when you explicitly choose the publishing command in the app.

1. Controller

2. Visiting the website

When you visit, the server temporarily processes technically necessary connection data, especially the IP address, to deliver the page and protect it against attacks. MandelKit sets no cookies, uses no analytics or advertising services, and loads no external fonts or media. A language you select manually is stored only in your browser’s local storage and is not sent to the server as an identifier. No regular access log is enabled for this website. Operational error messages may appear in the server system log. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is secure and reliable operation.

3. Publicly shared regions

Only when you explicitly publish from MandelKit are the region name, optional display name, preview, fractal coordinates, zoom, and saved presentation, color, lighting, and 3D settings transferred. Web links, contact addresses, markup, hidden control characters, and typical spam patterns are not permitted in public names and are rejected. “Public Gallery” lists the region in the gallery. “Link Only” prevents listing, but the page remains public to anyone with the link.

Purpose and legal basis

The data is processed to present the selected region publicly, make it shareable, and reopen it in MandelKit. The legal basis is the consent you give before upload under Article 6(1)(a) GDPR. Publishing is voluntary. Recipients include the hosting provider and anyone who opens the public page or link.

Withdrawal and storage duration

You can withdraw a publication in MandelKit at any time. The public page and preview are then disabled or deleted immediately. The technically required management record is deleted within 30 days. Backups are overwritten within a further 14 days. Active publications remain stored until they are withdrawn.

4. Ratings

When you give a region a heart, your browser creates a random identifier at that moment and stores it locally. The identifier is sent to the server, but only a verification value derived with a secret server salt is stored there. This allows one browser to give one heart per region and remove it again without creating an account, name, or public profile. Only the aggregate count is public. Local storage is necessary to provide the rating function you explicitly request (Section 25(2)(2) TDDDG). The legal basis for server-side processing is Article 6(1)(f) GDPR; the legitimate interest is a meaningful community ranking protected against simple duplicate ratings. The identifier is not used for advertising, analytics, or cross-device tracking. An individual heart remains stored until you remove it or the region is withdrawn.

5. Abuse prevention and reports

For uploads, ratings, and reports, the IP address is combined with a secret server salt to create a daily changing verification value. It limits excessive requests and is not public. The associated rate-limit events are deleted after no more than seven days. If you report a region, we store the reason, optional details, daily verification value, and time for no more than 90 days to review abuse. Five distinct verification values within 30 days trigger a precautionary, reversible quarantine: the region is no longer publicly accessible until it is reviewed or withdrawn by its publisher. The legal basis is Article 6(1)(f) GDPR; the legitimate interests are service security and protection against unlawful or abusive content.

6. Hosting and recipients

The website, region data, and previews are processed on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner acts as a processor under an agreement pursuant to Article 28 GDPR. No transfer to third countries is intended for the website operation described here. Hetzner data protection

7. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction, data portability, and objection. You may withdraw consent at any time with effect for the future; processing before withdrawal remains lawful. Contact the email address above or withdraw the publication directly in MandelKit.

Right to lodge a complaint

You may lodge a complaint with a data protection authority. The competent authority for the controller is, in particular, the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. BayLDA

8. Provision of data and automated decisions

You can use the website without publishing or providing personal details. Publishing requires the region data and a technical management key; the display name is optional. No profiling or automated decision with legal or similarly significant effects takes place. Automated security rules may reject or temporarily quarantine a publication. You may request human review at the contact address above.

Last updated: July 27, 2026