Privacy policy

Controller

Stefan Wiegreffe is responsible for this processing. You can use the following contact details for enquiries and to exercise your data protection rights.

Stefan Wiegreffe · Saselheider Str. 58a · 22159 Hamburg · Germany
hello@sessionodds.com · Contact form

Hosting and technical operation

The application and database are hosted with netcup GmbH, Germany, on the operator’s server in Nürnberg, Germany. To deliver pages and protect the service, the server processes your IP address, request time, requested address and method, response status, and browser-supplied technical information such as user agent and referrer. Technical errors may cause request information to be recorded in operational logs. The legal basis is Article 6(1)(f) GDPR: the operator’s legitimate interests in reliable operation, fault diagnosis, and protection against misuse. netcup provides hosting infrastructure; it is not given your account credentials for its own purposes.

netcup · Privacy information

Account information

We store your email address, password hash (not your readable password), account ID, roles, verification status, last login time, the versions and timestamp of the policies acknowledged at registration, language, timezone, preferred units, and briefing settings. The browser’s timezone is read at registration to initialize your preference; you can change it in settings. Verification and password-reset links contain account identifiers and secret tokens; only hashes of those tokens are stored in the account. Verification links expire after 24 hours and reset links after one hour; expiry does not itself delete the stored hash. These data provide sign-in, account security, preferences, and account-related messages under Article 6(1)(b) GDPR. Providing an email address and password and completing verification are necessary for account features; you can inspect public forecasts without an account. The operator can inspect basic account details and delete accounts for administration and support under Article 6(1)(f) GDPR. Acknowledging this notice is not consent to optional analytics.

Saved location data

We store the names and coordinates of your saved Spots, their timezones and provider identifiers, custom names, and configured wind Conditions to retrieve forecasts and identify your Session windows (Article 6(1)(b) GDPR). Spot coordinates represent places you choose; the app does not request your device’s GPS position. Search text is sent from our server to Open-Meteo’s geocoding API, and selected coordinates and forecast parameters are sent to its forecast API. These requests do not deliberately include your email, account ID, custom Spot names, or browser IP address; Open-Meteo sees the server’s IP address. Its API and subprocessors process requests under its published privacy terms. Shared forecast caches contain place and weather data rather than your account’s Conditions. Avoid entering personal or sensitive information in place searches or custom names.

Open-Meteo · Privacy information

Account emails and Session Briefings

Resend (Plus Five Five, Inc.), USA, delivers verification, password-reset, and functional Session Briefing emails. It receives your recipient address, sender, subject, full message content, and delivery metadata. Briefings can include your Spot names, places, suitable times, forecast values, and settings or unsubscribe links. The legal basis is Article 6(1)(b) GDPR for the requested account and forecast service. Daily briefings are initially enabled when you first add Conditions, with an explanation in the app; settings let you select days or disable them, and every briefing includes an unsubscribe link. Account verification and password resets are independent of briefing preferences. These messages contain no marketing. Open and click tracking is disabled. Resend processes email data in the US; its standard Free, Pro and Scale plans retain messages and logs for 30 days. Delivery suppression data may be retained separately to prevent further delivery to addresses that bounced or complained. Transfer safeguards are explained below.

Resend · Processing agreement and transfer safeguards · Processing and retention

Contact enquiries

If you contact Stefan by email or the contact form, your email address, message, and any details you supply are processed to answer your enquiry. The form uses Resend (Plus Five Five, Inc.), USA, which receives the sender and recipient details, message content and delivery metadata; its standard message and log retention is 30 days. Incoming mail to hello@sessionodds.com is routed through Cloudflare, Inc., USA, to the operator’s receiving mailbox. Routing involves email addresses, message content in transit and delivery metadata; the receiving mailbox provider also processes the correspondence. Replies and incoming messages are also kept in the operator’s email correspondence until the enquiry is resolved, and beyond that only insofar as required for legal obligations or a concrete legal dispute. The legal basis is Article 6(1)(f) GDPR (answering enquiries), or Article 6(1)(b) for enquiries necessary to provide the requested service. An email address and message are required to send the form and receive an answer. Do not submit sensitive information.

Resend · Processing agreement and transfer safeguards · Processing and retention

Cloudflare · Privacy information

Necessary cookies and device information

A language cookie (language) remembers an explicitly selected language for one year. The language is also saved in your account and used across devices. Initial language selection considers your browser language preferences. The application uses a session cookie (normally PHPSESSID) for sign-in, form state, and continuity through account flows. It lasts for the browser session; browser session restoration can prolong it. Temporary CSRF cookies (csrf-token_… or __Host-csrf-token_…) protect form submissions and are removed after Turbo submission or otherwise expire with the browser session. Only if you select “Keep me signed in” (unchecked by default), REMEMBERME keeps you signed in for up to 90 days; logout clears it. You can delete cookies using your browser, but account features may stop working. These cookies provide explicitly requested functions and are used under section 25(2)(2) TDDDG, without optional tracking consent. Associated personal data processing is based on Article 6(1)(b) GDPR for account functions and Article 6(1)(f) for form security. No analytics or advertising cookies are currently used. Server-side Sentry monitoring does not add a browser SDK, tracking cookie, or local-storage identifier.

Sentry error and performance monitoring

We use Sentry, operated by Functional Software, Inc., USA, to diagnose software failures and slow server requests. The current organization uses Sentry’s US region. Our PHP integration reports error types and stack locations, application and runtime versions, route names, technical event and trace identifiers, timestamps, request durations, operation types, and success or failure status. Server-side performance monitoring initially samples 100% of requests, subject to the account’s quotas. Selected operational logs contain fixed operation names, aggregate counts, forecast freshness and execution timings. Scheduled Session Briefing checks report job status and duration. No browser monitoring or session replay is enabled.

The application removes request URLs, query parameters, bodies, headers, cookies, user identity, extra context, breadcrumbs, exception messages, and span payloads before transmission, retaining technical diagnostic structure and timings. Visitor IP addresses and emails are not deliberately attached to Sentry events; Sentry still receives the sending server’s network address. We rely on Article 6(1)(f) GDPR: maintaining a reliable service and finding faults with minimized diagnostic data, rather than measuring individual behaviour. Sentry’s current Developer plan retains error events for 30 days; performance data is retained according to the Developer subscription’s event-retention limit (currently 30 days). Sentry Logs have a 30-day lookback. Transfers to the US and safeguards are described below. You may object on grounds relating to your particular situation using the controller contact details.

Sentry · Privacy information · Processing agreement and transfer safeguards

PostHog EU — planned, not active

We plan to use PostHog Cloud EU for product analytics, but it is not integrated and no data is currently sent to it. The intended purpose is to understand use of selected features and completion of signup steps. Future collection may include selected event names, timestamps, page or feature identifiers, and a pseudonymous analytics identifier. Emails, custom Spot names, search text and precise locations will be excluded, and session replay and unrestricted automatic capture will remain disabled. Before activation, we will publish the actual provider, event fields, retention periods and transfer arrangements, and offer prior opt-in under Article 6(1)(a) GDPR and section 25(1) TDDDG where device storage or access requires it. Rejecting analytics will not restrict the service; withdrawing consent must be as easy as giving it. EU hosting alone does not remove consent or transfer-assessment requirements. This notice is not a request for consent and does not authorize future collection.

PostHog · Privacy information

Recipients and international transfers

The operator and the providers needed for hosting, forecasts, email delivery, and technical monitoring process data for the purposes above. We do not sell account or Spot data. Resend and Sentry process data in the US; Cloudflare’s email routing can also involve US processing. Authorities or legal advisers receive data only where required by law or necessary for a concrete legal claim (Article 6(1)(c) or (f) GDPR). No claim is made that all service data stays in the EU.

Functional Software, Inc. (Sentry), Plus Five Five, Inc. (Resend), and Cloudflare, Inc. are listed in the official EU–US Data Privacy Framework register as active participants covering Non-HR Data. When checked on 15 October 2026, Sentry’s status was “Active”; Resend and Cloudflare were “Active – Re-certification under Review”. Where the recipient and processing fall within this participation, US transfers rely on the European Commission’s adequacy decision under Article 45 GDPR. The processing agreements also incorporate EU Standard Contractual Clauses under Article 46 GDPR; Sentry and Cloudflare provide for these particularly as a fallback where the DPF does not apply.

EU–US Data Privacy Framework · European Commission adequacy decision

The DPF adequacy decision does not replace a processing agreement under Article 28 GDPR. Resend’s processing agreement, including Standard Contractual Clauses, is incorporated into its terms and becomes binding when those terms are accepted. Cloudflare’s Self-Serve agreement also incorporates its processing agreement; acceptance takes place electronically or through use of the service. Sentry’s processing agreement takes effect through separate electronic acceptance and incorporates the Standard Contractual Clauses. netcup offers a separate electronic processing agreement in its customer portal. Information about safeguards, subprocessors, or copies of the applicable agreements can be requested from the controller.

Resend · Service terms · Cloudflare · Service terms

Account deletion and retention

Account data, saved Spots and Conditions remain until you delete the account or the relevant Spot, or the operator deletes an account. Self-service account deletion removes the account and owned configuration from the live database without a recovery period. If you have unsubscribed from briefings, a separate record of the email address remains to honor that choice even after account deletion and re-registration; it is removed on deliberate re-enrollment, or reviewed on request where continued suppression is unnecessary. The basis is Article 6(1)(f) GDPR, preventing unwanted messages. Account deletion does not instantly erase existing provider logs or delivered emails; provider retention and justified legal obligations apply independently. Routine application logs and scheduled-job output are stored in daily files and deleted by scheduled cleanup within seven days during normal operation. This limit does not cover low-level container output or the shared reverse proxy’s logs; those rotate at a 10 MB threshold and currently have no fixed age limit. Monitoring and enforcement of retention for those infrastructure logs remain an operational task. No application-managed backups are currently configured; this does not rule out infrastructure-provider copies. Specific evidence may be retained for an incident or legal claim only as long as needed for that purpose.

Your rights

Subject to the conditions in Articles 15–22 GDPR, you can request access, correction, erasure, restriction, and portability of data you provided where processing is based on contract or consent and carried out automatically. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where consent is used, you can withdraw it for the future without affecting the lawfulness of earlier processing. Contact Stefan using the details above; requests are normally answered within one month, with any legally permitted extension explained. No solely automated decisions producing legal or similarly significant effects are made about you; forecast matching is informational planning assistance.

You can complain to a data protection supervisory authority, including the authority for your residence, workplace or the alleged infringement. The authority for the operator in Hamburg is the Hamburg Commissioner for Data Protection and Freedom of Information.