--- title: "Privacy" description: "Animal Checklist stores sightings locally, supports accounts and offers a member leaderboard and photo recognition." canonical: https://animalchecklist.com/de/privacy last_updated: 2026-11-01 --- # Privacy > Animal Checklist stores sightings locally, supports accounts and offers a member leaderboard and photo recognition. Arne Kellmann, Odenwaldstr. 134L, 64372 Ober-Ramstadt, Germany, animalchecklist@arnekellmann.de, is responsible for this processing. Optional measurement and feedback start off. The site uses no advertising tracking. PostHog support loads only when you open Support. It uses PostHog's EU hosting. Our support team receives your messages and any contact details you choose to provide in the shared inbox for our websites. PostHog receives the IP address and browser details needed to deliver the chat. EU hosting does not exclude access by PostHog or its subprocessors outside the EU; its data processing terms describe the safeguards for such transfers. The chat stores an anonymous conversation identifier and any contact details you provide in your browser to reconnect your conversation. It does not receive account identifiers, sightings, sync codes or the page address you came from. The support SDK sends no analytics events, surveys or session recordings. Please do not send passwords, sync codes or payment details in chat. Clear the site's browser data to remove the local support identifier and contact details. This does not delete messages already sent; contact us for a request about support records. Provider terms: https://posthog.com/privacy and https://posthog.com/dpa. Support legal basis: GDPR Article 6(1)(b) for contractual support, and Article 6(1)(f) for our interest in answering other enquiries you request. Section 25(2) no. 2 TDDDG applies to browser storage needed for the chat you explicitly open. We delete support correspondence when it is no longer needed to handle the enquiry, unless legal retention duties or open claims require us to keep it. Privacy choices in the footer lets you enable measurement and feedback separately. Both start off. The checklist and support work without them. Do Not Track and Global Privacy Control keep both off. With measurement consent, we send fixed steps: catalogue viewed, checklist started and sighting saved. We verify local storage before sending sighting saved. We send no animal IDs, sighting dates, lists, search text, locations, page addresses, account or support identifiers. Account, sync, recognition and private sighting views send no optional events. A separate random browser identifier expires after 30 days. It helps us count returning browsers. It does not identify people across devices. Each tab stores a step list and a limit of 20 events per UTC day. These identifiers are pseudonymous personal data. With feedback consent, we offer a single-choice question after saving your first sighting. Choices are Yes, Partly and No. We send the survey identifier, its display or dismissal and your selected choice. Your browser stores a seven-day question cooldown. Feedback alone uses a random tab identifier. It uses the separate browser identifier only when you also enable measurement. PostHog processes these events and choices in its EU hosting, in the shared project for our websites. It receives the IP address and browser details needed for delivery. PostHog or its subprocessors may access data outside the EU. Its processing terms describe transfer safeguards: https://posthog.com/dpa and https://posthog.com/privacy. Optional measurement and feedback use your consent under GDPR Article 6(1)(a) and section 25(1) TDDDG. Withdraw either choice through the footer at any time. Withdrawal stops future sending, aborts pending requests and removes measurement identifiers. Browser identifier expiry and withdrawal do not delete events or choices already sent. PostHog keeps these under its retention settings. The free plan normally provides a one-year query window. This does not promise deletion after one year. Contact animalchecklist@arnekellmann.de for an erasure request. The footer loads a badge from www.makermap.lol. When the badge loads, your browser sends its IP address and user agent to MakerMap. The request includes this site's origin unless your browser blocks referrers. MakerMap records the site domain and its host keeps request logs. We use the badge to link to Arne Kellmann's profile under GDPR Article 6(1)(f). MakerMap's policy: https://www.makermap.lol/privacy. Your browser stores your sightings in localStorage. The server stores synced animal IDs, sighting dates and changes under an account ID. We process these records to provide the checklist and sync you request under GDPR Article 6(1)(b). Anonymous lists remain until you delete them with the sync code or import them into a signed-in account. Signed-in lists remain until account deletion. The animal quiz works without an account. We store round questions and checked answers under a random receipt token. Your browser keeps completed receipts and points locally. Keep receipt tokens private because they authorize access to those rounds. Unfinished rounds expire after seven days. Completed guest receipts remain until you delete or claim them. When you save points to an account, we store the verified awards and prevent duplicate rewards. Account deletion removes its quiz records. An anonymous sync code can access or delete its list. The server stores a SHA-256 hash of the code, not the code itself. Keep your code private because anyone holding it can change the list. If you add email sign-in, we store your email address, login tokens and session records. For passkeys, we store a credential ID, public key, signature counter and use dates. The private key stays on your device. We process these records to provide sign-in and synchronization under GDPR Article 6(1)(b). New signed-in accounts are hidden from the leaderboard. If you turn visibility on, you consent (GDPR Article 6(1)(a)) and other visible, signed-in participants can see your username, species count and quiz points. Turn it off at any time to withdraw. Do not choose a username that identifies you. Animal Checklist is for people aged 16 and over. A paid plan needs an adult or a minor with the consent of a legal guardian. We build no profiles of children and show them no advertising. Animal articles are written with AI and checked automatically for sources and quality. Each article says so. Other visible participants can search and filter your synced species list. We do not show sighting dates or avatars in the leaderboard or shared lists. You can turn off leaderboard visibility on the Account page. This immediately hides your rank and species list. Your sightings remain in your private checklist until you delete them or delete your account. The strictly necessary ac_session cookie keeps you signed in for up to 30 days. The ac_passkey_flow cookie supports passkey setup for up to five minutes. Magic links become invalid after 15 minutes. Expired authentication and rate-limit records are removed by an hourly cleanup job. You can create a read-only or read-write MCP key for a connected app. We store only its SHA-256 hash, permission, creation and expiry times. A key expires after 90 days, can be revoked on your Account page and is removed when you delete your account. The connected app receives your key and can use only the tools allowed by its permission. Cloudflare hosts the site and database. Resend sends sign-in emails and receives your email address and the link. Sentry receives error messages, stack excerpts and page paths when error reporting is configured. These providers may process data outside the EU. Transfer terms: https://www.cloudflare.com/cloudflare-customer-dpa/, https://resend.com/legal/dpa and https://www.sentry.help/en/articles/13965008-how-do-i-sign-your-data-processing-addendum. Cloudflare may process IP addresses, request URLs and user agents for security. We use IP-based limits and error reports to prevent abuse and keep the service reliable under GDPR Article 6(1)(f). The browser error reporter removes URL query and fragment values, but error text can still contain personal data. We do not intentionally send sighting lists or login credentials to Sentry. If you report a photo, we store the animal, reason, optional note and submission time to review it. We review reports under GDPR Article 6(1)(f), our interest in accurate and licensed photos. We do not attach your account or IP address to the report. An hourly cleanup removes reports older than 90 days. Do not put personal data in the note. If you use photo recognition after sign-in, your browser resizes the image and removes its metadata before upload. Our server sends the image through Cloudflare AI Gateway to OpenAI. If that analysis fails, Cloudflare's backup model receives the image. Our private BioCLIP service also checks the image in memory on a Contabo server. We do not save uploaded images or their image embeddings, and we disable our AI Gateway logs and caches. Providers may retain API data under their policies. We store a job linked to your account with an image hash, status, proposed species, visual clues and model evidence. Jobs and clues expire after 24 hours. An hourly task removes old records. Do not upload photos of people. You can confirm a missing species for the public catalog after its identity passes our checks. We store verified species names, taxonomy and source references. We obtain its public photo from an independent licensed source. Your uploaded photo and private visual clues do not become catalog content. Photo recognition requires a monthly or yearly subscription, or a manually granted unlimited account. Stripe processes subscription payments, billing details and invoices. We store the Stripe customer and subscription IDs, payment status, billing period, plan and number of photo searches. Each attempt, including a retry, counts toward the plan limit. We do not store card details. We use these records to provide the subscription under GDPR Article 6(1)(b). Stripe keeps payment records under its own retention obligations; see https://stripe.com/privacy. We store cancellation and withdrawal declarations, receipt times and email delivery references independently of account deletion. We process them under GDPR Articles 6(1)(b) and 6(1)(c). Records expire at the end of the third calendar year following receipt. Resend sends your receipt and a copy to the operator. Do not include sensitive information in the form. Signed-in users can download their account data and delete their account. The export includes synced sightings, passkey metadata, MCP key metadata, login timestamps, billing status, quiz rounds, verified quiz awards and temporary recognition job records, but no authentication secrets. Deletion cancels an active subscription and removes the account, email, linked login records, MCP keys, recognition jobs, quiz records, billing usage and server sightings. No deletion reason is required. If you select one, we count its category without your account ID or a time stamp. This browser removes its local copy after deletion; clear site data on other devices. Provider logs, payment records and backups follow their own retention settings; contact us for a request that covers those copies. You have the rights of access (Article 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21), and you can withdraw consent at any time (Article 7(3)). For these requests, write to animalchecklist@arnekellmann.de. We answer without undue delay, normally within one month. You can complain to a data protection authority, including the Hessian Commissioner for Data Protection and Freedom of Information.