This page explains how DettingenConnect works technically: which cookies there are, where the data is stored and which other servers our server talks to. Wherever possible, the information comes directly from the app’s configuration so that it is accurate. The legal side is covered in the privacy policy.
At a glance
- No advertising, no selling of data.
- No tracking and no visitor statistics, not even our own.
- Nothing from third-party servers: fonts, icons and scripts are delivered by our own server, and so are the map images.
- Our emails have no tracking pixels and no redirected links.
- The text of direct messages is stored encrypted on the server.
- Every look by moderation into a reported chat is logged; we delete the log after 365 days.
Cookies
Only these, all technically necessary:
- ortsconnect-session: your session; expires 120 minutes after your last click.
- XSRF-TOKEN: protects against another website submitting forms in your name; lasts as long as the session.
- remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d: only if you choose “Stay signed in”; keeps you signed in for 400 days until you sign out.
- theme: only if you choose light or dark permanently under Settings; remembers this until you choose “like the device” again.
Storage on your device
The app remembers a few things on your device, in the browser or in the app, which only reach our server when you send them:
- drafts when creating an event, an organisation or a meeting place, so that nothing gets lost;
- messages that could not be sent yet, for example without a connection;
- the text size in the chat and whether you have already seen the notice about contact details.
So that the web app starts quickly, your browser keeps the app’s program files in a cache; content is not included.
Where the data is stored
DettingenConnect runs on its own server: CMO Internet Dienstleistungen GmbH, Rechenzentrum Reutlingen (Deutschland). This server also runs the search (Meilisearch) and the live connection for chat and notices (Laravel Reverb); neither is a third-party service. The server re-processes images when they are uploaded, which removes the location and camera data.
Outgoing connections
Our server only talks to other servers in these cases:
- Map images from tile.openstreetmap.org: if a map image is missing, the server fetches it once and stores it. Your browser only asks us.
- Emails via the mail server set up by the operator.
- Push notifications via your browser’s push service, to iPhone and iPad via Apple, only if you have switched on push.
- PayPal, only if you start a payment with PayPal.
- Imports, if the operator has set them up: events and news from their publishers’ websites (such as the municipality), business details from OpenStreetMap. Nothing about you is sent there. The texts are reworded by the operator’s own language-model server, and the operator’s own image server draws an illustration for them (labelled “AI-generated”); only these public texts are sent there too.
- Wikidata and Wikipedia, at night, to fetch a short description and the population figure for the members’ places of residence. Only the place name and the centre of the place are sent there, never anything about you; your device only asks us.
- Catalogues for My Shelf (Wikidata, MusicBrainz, Open Library), when you search for a work: only the search term, never anything about you.
- Weather from Bright Sky (data from the Deutscher Wetterdienst, the German Meteorological Service): only the coordinates of the meeting place or event.
- Radio stations, to query the track currently playing (without data about you).
Nothing else. You make one exception yourself: if you play a radio station, your device fetches the stream directly from the station, which sees your IP address in the process. Links to other websites (such as “Plan route” on openstreetmap.org) only open when you tap them.
Messages
The text of direct messages is stored encrypted in the database; without the server’s key it cannot be read. Images, voice messages and PDFs are stored unencrypted in a protected area that only the participants can reach via verified links. Emails about the chat never contain the text. Group chats are stored unencrypted, because many people write in them and people who join later can read them too. No chat is end-to-end encrypted: the server could read the messages. Moderation only sees reported messages together with the ten before and after them, and this is recorded in the log.
Who sees what
- Guests without an account: public events, meeting places and organisations, the manual, this page.
- Signed-in users: in addition, what organisations show only to members, and “People” if they are visible there themselves.
- In the activity feed: all signed-in users see the entries of those who have not switched off “Appear in the feed” (on by default).
- Leaders and caretakers: their organisation or their meeting place, and the registrations and enquiries relating to it.
- Moderation: reports and the reported content.
- Admins: the administration of the app. Important interventions are recorded in the log with name and time.
- In direct chat: the other person sees “Active now” or “last active …”, unless you hide your online status; then you cannot see it for others either.
What we do not do
- We do not analyse who views whose profile.
- We do not build advertising or interest profiles from your details.
- “Stance” is never a search filter and is never used for suggestions.
- We do not pass any data to third parties, except to the services named above, and only what they need for their task.
Software
DettingenConnect is based on free software, including Laravel, Vue, Inertia, Tailwind CSS, Filament, Meilisearch and Laravel Reverb. The maps and some of the business details (location, contact, opening hours) are based on data from OpenStreetMap (© OpenStreetMap contributors, Open Database License). The search terms of the emoji picker come from the Unicode CLDR (© Unicode, Inc., Unicode License v3).