Privacy Policy & Cookies

Basics

This declaration informs users of this website about the type, scope and purpose of the collection and use of personal data by the website operator. Your personal data is treated confidentially and in accordance with the legal regulations. Because this website keeps being developed, this declaration may change — we recommend re-reading it from time to time. Definitions of the terms used (e.g. “personal data” or “processing”) can be found in Art. 4 GDPR.

Access data

On the basis of its legitimate interest (Art. 6 (1) (f) GDPR) the operator records accesses to the website in server log files. The following is logged:

  • the page or endpoint requested
  • the time of the access
  • the amount of data sent
  • the referrer you came from
  • the browser and operating system used
  • the IP address used

Log files are kept only for a short period for security reasons — to investigate abuse, to keep the site working and to analyse errors — and are then rotated out automatically. If data has to be kept as evidence, it is exempt from deletion until the incident is resolved.

Sign-in, registration and password-reset requests are rate limited per IP address, and the reverse proxy in front of this site applies its own rate limiting and security headers. This is done to prevent brute-force attempts and abuse.

Account data

A valid email address is required to create an account. It is stored in readable form, because we need it to sign you in and to deliver verification and password-reset mail. Note: the previous version of this site stored email addresses only as irreversible hashes; that is no longer the case.

Alongside the address we store:

  • your password — only ever as an argon2id hash, never in clear text and never recoverable;
  • your sessions — only a hash of the session token, together with its expiry;
  • single-use, expiring tokens for email verification and password resets, likewise stored only as hashes;
  • whether your address has been verified, and which language you chose for the site and for email.

Your data is not passed on to third parties. There is currently no self-service account deletion — write to the contact address in the Legal Notice and your account and its data will be removed.

Data collected by the Hamstertacho

When you connect a Hamstertacho to the internet you agree that its measurements are recorded. For each device we store its device ID (the MAC address of its chip), the number of wheel revolutions per minute together with the time of that minute, and the settings you enter yourself — hamster name, species, wheel diameter and time zone. The device authenticates against our MQTT broker with its own credentials, which are stored hashed.

Measurements are kept for up to five years and are automatically compressed after 45 days. You agree that collected data may be published in anonymised form under an anonymised device ID, primarily for scientific purposes; a hamster’s name is never part of such a publication. If it happens, it will be made freely and publicly available.

Handling contact enquiries

If you contact the operator through the address given in the Legal Notice, your details are stored so that the enquiry can be processed and answered. Your data will not be passed on to third parties.

Liability for links

This website contains links to external third-party websites over whose content we have no influence. We therefore cannot accept any liability for that external content. The respective provider or operator of the linked pages is always responsible for their content. The linked pages were checked for possible legal violations at the time of linking; illegal content was not recognisable at that time. A permanent review of linked content is not reasonable without concrete evidence of an infringement. If we become aware of legal violations we will remove such links immediately.

Cookies

This website uses exactly one cookie, and only once you sign in: ht_session, which holds your session token so that you stay signed in. It is set with the HttpOnly, Secure and SameSite=Lax flags, expires after 30 days, and is deleted when you log out. It is strictly necessary for the site to function, which is why no consent banner is shown.

Choosing a language additionally stores your choice in a ht_lang cookie, so the site keeps speaking the language you picked. It contains nothing but “en” or “de”.

There are no analytics, advertising or tracking cookies, no third-party embeds and no externally hosted fonts or scripts.

Server location: Austria / Vienna

Last update: 7 August 2026