Privacy policy

1. At a glance

This website sets no cookies, uses no analytics or advertising services and loads nothing from third parties (no external fonts, scripts or embedded media). Visiting it only creates an access log entry on our web server. We only process data from the beta feedback form if you submit it (section 6).

2. Controller

Wojcik Beratungs und Beteiligungs UG (haftungsbeschränkt)
Schönhauser Allee 169a
10435 Berlin
represented by its managing director Dominik Wojcik
Phone: +49 160 5 29 27 25
Email: dominik [at] wojcik [dot] de

3. Server log files

For every request our web server logs the IP address, time, requested address, status code, transferred bytes, browser identifier and referring page. We use this data to keep the website secure and running, to find errors, and in aggregated form to test the planned OpenSpider log file analysis with real data. It is not combined with other data sources. Logs are rotated weekly and deleted after nine weeks at the latest. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and error-free operation).

4. Hosting

The website runs on a server of Hetzner Online GmbH in Germany, acting on our behalf (Art. 28 GDPR).

5. Links to GitHub

Source code and downloads are linked on GitHub (GitHub, Inc., USA). Only when you follow such a link do you leave our website; GitHub's privacy statement applies there.

6. Beta feedback form

On the beta page you can voluntarily send us feedback on OpenSpider. We process the form contents (system, OpenSpider version, type of feedback, description and, optionally, what you tested), your email address if you provide one, as well as the time of submission, the page language and a shortened browser identifier. The purpose is to improve the software and, if you provide an email address, to ask follow-up questions about your feedback. The legal basis is the consent you give in the form (Art. 6 (1) (a) GDPR).

The form does not store your IP address. To limit abuse (at most five submissions per hour), we derive a salted hash from the IP address. The salt changes daily; salt and hashes are deleted after 24 hours at the latest. Independently of this, an access log entry is created as for every request (section 3).

Feedback is stored on our own server in Germany (section 4) and forwarded to the operator by email. The operator's mailbox is hosted on Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); Google processes the notification as a processor. A transfer to the USA cannot be ruled out; it is based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). We delete it no later than twelve months after the end of the beta, or earlier at your request. You may withdraw your consent at any time with effect for the future (Art. 7 (3) GDPR), for example by email to the address above; this does not affect the lawfulness of processing before the withdrawal. Please do not enter personal data of third parties, such as clients, in the form.

7. The desktop app

This policy covers the website. The OpenSpider app runs locally on your computer and crawl data stays there. Automatic update checks are enabled by default and contact GitHub Releases at startup, at most once every 24 hours. They send the app version, operating system and architecture; GitHub also sees the connection’s IP address. No user identifier or crawl data is sent and no telemetry is collected. Additional manual checks are possible. You can disable checks in Settings → Updates or with OPENSPIDER_DISABLE_UPDATE_CHECK=1.

The Windows installer downloads WebView2 from Microsoft if needed. Optional integrations (for example Google APIs) connect to their respective providers when you set them up; the provider’s terms apply. See the user guide on updates and privacy for more details.

Crash reports

If the app ends unexpectedly, it stores a crash report locally on your computer only. It contains technical details: app version and build, operating system and architecture, type and time of the problem, run time, the error message, the program location and function names, whether a crawl or JavaScript rendering was running, and the last lines of the log. Before saving, web addresses, email addresses, IP addresses, credentials and your user folder are made unrecognisable; crawl data, configuration values, file names of crawls and exports and project names are not included.

A report is sent only when you click “Send” in the notice after a crash or under Help → “Crash reports…” – never automatically and never in the background. Beforehand you can view exactly the text that will be sent and optionally describe what you were doing last and give an email address for follow-up questions. The purpose is to find and fix errors in OpenSpider; the legal basis is the consent you give by clicking “Send” (Art. 6 (1) (a) GDPR). You can turn the notice off in the settings; administrators can block sending with the policy DisableCrashReports or OPENSPIDER_DISABLE_CRASH_REPORTS=1.

Reports go to openspider.de/api/crash on our own server in Germany (section 4). Your IP address is not stored; to limit abuse (at most ten reports per hour) we derive a salted hash as for the feedback form, which is deleted after 24 hours at the latest. Each report is stored and forwarded to the operator by email (mailbox and transfer as described in section 6). We delete received reports together with the notification after 90 days, or earlier at your request; please quote the reference the app shows after sending.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 (1) GDPR).

To exercise your rights, contact dominik [at] wojcik [dot] de. You may also lodge a complaint with a supervisory authority; ours is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

9. Encryption

This website is only served over an encrypted TLS connection (HTTPS).