Privacy Policy

Last updated: September 2026

1. Controller

The controller responsible for data processing on this website is:

Jens Röcker
Südeschstraße 32
48429 Rheine
Germany
Email: [email protected]

2. Hosting

This website is hosted on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. When you visit the website, the following connection data (server log files) is automatically collected:

• IP address of the requesting computer
• Date and time of access
• URL accessed and referrer URL
• Browser and operating system used
• Data volume transferred and HTTP status code

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website operation and security). Retention period: 7 days, then automatically deleted.

3. Content Delivery Network (Cloudflare)

We use Cloudflare (Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA) to deliver content faster and protect against attacks. Requests are routed through Cloudflare servers, including servers located in the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework.

Cloudflare Privacy Policy: cloudflare.com/privacypolicy

Legal basis: Art. 6(1)(f) GDPR.

4. Cookies

This website uses technically necessary cookies and — with your consent — analytics cookies from Google Analytics and Microsoft Clarity (see Sections 6 and 7):

• Language cookie (pll_language): Stores your selected language. Expires when you close your browser.
• WordPress session cookie: Set only for logged-in users.
• Consent cookies (cmplz_*): Store your cookie consent decision. Lifetime: 365 days.
• Google Analytics cookies (_ga, _ga_*): Set only after consent. See Section 6 for details.
\n
• Microsoft Clarity cookies (_clck, _clsk and, where applicable, Microsoft third-party cookies): Set only after consent. See Section 7 and the cookie overview below.

You can withdraw your cookie consent at any time via the cookie banner.

Cookie and service overview

5. Price Alerts (Email Notifications)

When you set up a price alert, we process the following data:

• Your email address
• Your target price and the selected product
• Date of registration and confirmation

Registration uses a double opt-in process: you first receive a confirmation email and the alert is only activated after you click the confirmation link.

Legal basis: Art. 6(1)(a) GDPR (consent). You can cancel your alert at any time via the unsubscribe link in the notification email. Your data will be deleted upon cancellation.

6. Statistics (Google Analytics 4 with Google Consent Mode v2)

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; for users outside the EEA/CH: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics helps us understand how visitors use our website (pages visited, session duration, country, device type).

How our tracking works (Google Consent Mode v2 – Advanced):

• With your consent: Google Analytics sets anonymized cookies (mainly _ga, _ga_*) and measures sessions, page views, and user interactions in the standard way. Legal basis: Art. 6(1)(a) GDPR (consent).
• Without your consent: The Google Tag (gtag.js) is loaded but only sends cookieless pings to Google (consent signal gcs=G100, analytics_storage=denied). These pings contain no cookies, no persistent identifiers, and no personal data — only anonymous event signals (page view, device type, country at country level). Google uses these signals exclusively for statistical modeling of aggregated trends (Behavioral Modeling) and does not attribute them to any individual user. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in statistically valid reach measurement).
• IP anonymization is active by default in Google Analytics 4. IP addresses are truncated before being stored by Google.

The collected data is processed in a Google account for which we have concluded a Data Processing Agreement (Art. 28 GDPR) with Google. Retention period of user data in GA4: 14 months.

You can withdraw your consent at any time via the cookie banner. Cookieless pings as described above will continue to be sent even after withdrawal; if you also wish to prevent those, please use the Google Analytics Opt-out Browser Add-on.

Google Signals (cross-device measurement): With your consent, we additionally enable Google Signals. For users signed in to a Google account who have opted into Ads Personalization in their Google account settings, this allows cross-device data to be aggregated — in particular approximate location, Search and YouTube history, and data from Google’s advertising partner sites. This enables us to evaluate cross-device sessions, demographics, and interests of consenting visitors. You can view and delete Google Signals data anytime via your Google Account “My Activity” dashboard, or disable personalization via your Google Ads Settings. Legal basis: Art. 6(1)(a) GDPR (consent).

Google Privacy Policy: policies.google.com/privacy | Google Consent Mode: support.google.com/analytics/answer/9976101 | Google Signals: support.google.com/analytics/answer/7532985

7. Microsoft Clarity (Heatmaps and Session Recordings)

We use Microsoft Clarity, an analytics service provided by Microsoft, to understand how visitors use our website and where usability problems occur. The Clarity tag is loaded only after you consent to the “Statistics” category. Without this consent, no connection to Clarity is established and Clarity does not collect data.

After you consent, Clarity collects in particular visited URLs, clicks, scroll and mouse movements, window sizes, browser, device and operating-system information, referrers, performance and error events, and DOM and layout changes. Microsoft uses this information to create aggregated usage statistics, heatmaps, and session replays. According to Microsoft, input field content, numbers, and email addresses are masked by default and are not uploaded to Clarity. We do not use the Clarity Identify API and do not send names or email addresses to Clarity as user identifiers.

After consent, Clarity sets the first-party cookies _clck (recognition and preferences, up to 1 year) and _clsk (grouping page views into one session, up to 1 day). Depending on your additional marketing consent and browser settings, Microsoft third-party cookies such as CLID, ANONCHK, MR, MUID, and SM may also be set. The complete overview is provided in Section 4.

The legal basis for storing and accessing cookies is Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act); the legal basis for subsequent processing is Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie banner with effect for the future. On withdrawal, our consent management system instructs Clarity to stop further collection and erase the Clarity cookies _clck and _clsk set by our domain. We cannot technically delete cookies on Microsoft domains ourselves; they expire according to the retention periods stated in Section 4.

Microsoft normally retains playback data for 30 days; click data, heatmaps, and labeled or favourited sessions are retained for up to 9 months. Processing may involve transfers of data to the United States. For more information about processing, safeguards, and data-subject rights, see the Microsoft Privacy Statement and the Clarity documentation.

8. Community Forum

At community.vapochecker.com we operate a publicly readable Lemmy forum. The operator and contact details are those in Section 1. The forum runs on our Hetzner server in Germany and uses Cloudflare (Sections 2 and 3). Federation with other Lemmy instances is disabled.

New members sign in with their VapoChecker account. With your approval, the forum receives a permanent random account identifier for linking, no VapoChecker password or VapoChecker email address. Watchlists and price alerts are not transferred to the forum. In the forum, we process your chosen public username and your application, including your declaration that you are at least 18 and accept the forum rules. An administrator reviews the application; forum permissions are assigned separately. An email address provided directly in the forum is optional and enables account and notification emails activated there. We do not request copies of identity documents. Existing independent operator and automation accounts retain their native passwords, stored only as hashes.

Central sign-out ends linked forum sessions through a minute job; delivery may be delayed. Disabling or deleting the VapoChecker account disables the linked forum access. Your forum profile and posts remain and are handled upon a separate deletion or anonymization request to [email protected]. The independent native operator emergency access remains available.

We store posts, comments, uploaded images, upvotes/downvotes, private messages, reports and moderation decisions. Usernames, profile information, posts, comments and images are public and may be indexed by search engines. Individual votes and private messages are not public, but authorised administrators can access them on the server. Private messages are not end-to-end encrypted. Avoid sensitive personal information and remove unnecessary metadata before uploading images.

Session tokens, sign-in timestamps, IP addresses and browser information are processed for authentication and abuse prevention. The forum uses essential session cookies and local storage for preferences. Google Analytics and Microsoft Clarity are not embedded in the forum. Technical forum logs rotate according to storage size; no guaranteed seven-day deletion period applies to these logs. You can revoke sessions in your account settings.

Optional account and notification emails are sent through Resend (Plus Five Five, Inc., USA; privacy information). The provider processes recipient addresses and the message and delivery data needed for sending. Transfers to the USA are subject to the provider’s applicable data-protection safeguards.

Private marketplace listings publicly display the device, condition, price, shipping region and photos you provide. Payment and shipping take place outside the forum. We do not receive payment data and are not a party to transactions. A labeled moderation bot compares account age and visible contributions outside the marketplace, checks required fields and detects image links. It does not verify identity or provide buyer protection.

Legal bases are Art. 6(1)(b) GDPR for providing the requested account and functions, Art. 6(1)(f) GDPR for operation, security, spam and fraud prevention, and Art. 6(1)(c) GDPR where legal handling or retention obligations apply. This privacy notice is not consent to advertising.

Account data and content remain stored during use. You can delete content and your account in Lemmy or request deletion at [email protected]. Deletion in the interface does not always immediately physically erase all data from databases, moderation records and backups. For valid erasure requests, we review those data separately; evidence required for ongoing disputes or legal obligations may need longer retention.

The forum is included in daily encrypted backups on a separate Hetzner Storage Box. The retention policy keeps daily snapshots for 30 days, monthly snapshots for twelve months, yearly snapshots for three years and at least the latest 48 snapshots per category. Deleted data may therefore remain in older backups. Backups are used for disaster recovery, not normal operation; erasure requests must be taken into account again after restoration.

Report content through “Report” or, without an account, by email to [email protected]. We process the post URL, reported content, your reason, username or contact address, and our decision. The same address accepts access, correction and deletion requests and challenges to moderation decisions.

9. Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)

Please send requests to: [email protected]

10. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection supervisory authority:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
PO Box 20 04 44
40102 Düsseldorf, Germany
www.ldi.nrw.de