Privacy
Privacy Policy (Datenschutzerklärung)
Last updated: August 20, 2026
This is the customer-facing English version. The operator is established in Germany, and this page concerns applicable German and EU legal obligations.
1. Controller
Dr. Yuno Rolfes, Danksteder Str. 11, 26316 Varel, Germany. For privacy questions, contact us at contact@keepsakeclues.com.
2. Visiting this website
When you visit this website, the hosting operation processes technically necessary connection data, such as your IP address, date and time of access, requested page, and browser and device information. This processing is necessary for the secure and reliable provision of the website (Article 6(1)(f) GDPR). The website is provided through Vercel; application and database functions use Convex. The specific retention periods for technical logs are the responsibility of these infrastructure providers and cannot be configured in this application.
3. Puzzle draft
Information entered on the homepage, such as the recipient's name, occasion, memories, answers, and clues, is initially held in the current browser session. When you build a puzzle or begin checkout, the current draft is stored in the application database behind a long, opaque access token so it can be matched to the exact paid puzzle. This draft data is not listed publicly or exposed through a guessable URL. The legal basis, retention period, processor details, and deletion workflow for this server-side draft storage must be confirmed before paid checkout is enabled.
4. Customer account
If you create an account or sign in, the Convex authentication function processes the account and sign-in data you provide, in particular your email address and password. This is used to provide the account and control access (Article 6(1)(b) GDPR). Account data remains for as long as the account exists or retention is necessary; this project does not show a different, technically fixed retention period.
5. Contact form
When you send a message through the contact form, we process your name, email address, and message to handle your inquiry (Article 6(1)(b) GDPR where your inquiry relates to pre-contractual steps; otherwise Article 6(1)(f) GDPR). Messages are sent through the MadeThis platform's notification service. We retain the information only for as long as necessary to handle and document the inquiry; specific deletion periods are not currently automated in the system.
6. Analytics and cookies
If you consent, we use PostHog for reach and usage analytics. Identifiers, usage events, page views, and technical device and browser data may be processed and stored in cookies and your browser's local storage. The legal basis is your consent (Article 6(1)(a) GDPR; § 25(1) TDDDG, the German Telecommunications Digital Services Data Protection Act). Without consent, PostHog, its associated cookies, and the storage of campaign parameters are not activated. You can change your choice at any time through . If PostHog or the infrastructure used processes data outside the EEA, the relevant international data transfers may take place; the specific region and transfer mechanism depend on the configured service and must be confirmed before production launch.
7. Payments
When paid checkout is enabled, payments will be processed through the MadeThis platform and its payment service providers. The storefront sends a private opaque draft reference to the documented checkout metadata field and verifies the completed order through the documented platform lookup before it releases the PDF. Before activation, this policy must be updated with the actual recipients, payment data, legal bases, retention periods, and international-transfer details used.
8. Fonts and external content
The Inter and Playfair Display fonts used are provided through Next.js. According to the current source code, this does not add an external font CDN request in the browser. The brand logo is loaded from the MadeThis/Convex storage address; the relevant provider receives technically necessary request data when this happens.
9. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. You can withdraw consent at any time with effect for the future. You may also lodge a complaint with a data protection supervisory authority. To exercise your rights, please contact us using the address above.