Privacy policy

Last updated: 1 October 2026.

This policy explains how Flocklist (https://flocklist.dev) handles personal data under the GDPR and German law. It covers three groups: website visitors, waitlist owners, and people who join a waitlist.

1. Who is responsible

For website visitors and waitlist owners, the controller is Smart-Byte GmbH, Landshuter Str. 29, 85435 Erding, Germany, represented by its managing director Mario Heubach. Email: info@smart-byte.com, phone: +49 8122 5676-141. See also the Impressum.

For people who join a waitlist, the waitlist owner is the controller. We are the processor under Art. 28 GDPR (see section 4).

2. Website visitors

Flocklist sets no cookies. Fonts are self-hosted, so your browser contacts no font provider.

On our own pages (home page, docs and these legal pages) we count visits with Umami, an open-source, cookieless analytics tool that we run ourselves at analytics.smart-byte.com, on a server in Finland (EU) rented from Hetzner (see section 5). It records the page, the referring site, browser, operating system, device type, screen size, language and country (derived from your IP address). It does not store your IP address and sets no cookies; visits are grouped with an anonymous identifier that changes daily. The data stays in the EU and is not shared with third parties. If your browser sends a "Do Not Track" signal, no visit is recorded. Legal basis: Art. 6(1)(f) GDPR; our interest is understanding which pages and features help people. Waitlist pages, the embeddable widget and the admin page contain no analytics.

The site runs on Cloudflare. On our behalf, Cloudflare processes technical request data, such as your IP address, the time and the page you request, to deliver the page. It also keeps short-lived request logs (Workers observability), which we use for debugging. Legal basis: Art. 6(1)(f) GDPR. Our interest is a secure, working service.

The embeddable widget stores your own referral code in your browser's localStorage on the waitlist owner's website. This lets you see your position again. It is not a cookie, we do not use it for tracking, and you can delete it in your browser settings. It is needed for the feature you asked for (§ 25 (2) no. 2 TDDDG).

3. Waitlist owners

You are an owner if you create a waitlist. We process:

• your email, waitlist name, and optional site URL and redirect URL;
• a SHA-256 hash of your admin key (never the key itself);
• a salted, truncated SHA-256 hash of the IP address you used to create the waitlist, for abuse prevention and rate limiting;
• if you buy a plan: your email, Stripe customer ID and plan.

Purposes and legal bases: running your account and waitlists (Art. 6(1)(b) GDPR); abuse prevention, security and debugging (Art. 6(1)(f) GDPR); tax and accounting records (Art. 6(1)(c) GDPR).

Stripe sells paid plans as merchant of record and reseller. It processes your payment data under its own privacy policy. We receive only the data listed above.

4. People who join a waitlist

The waitlist owner decides why and how your data is used. The owner is the controller, and we process your data for them as processor. The owner's own privacy notice explains the purpose and how long they keep it.

An email address is required to join. If the owner asks, you may also give a name, a crypto wallet address and an X handle. We store:

• those fields;
• a random referral code, the code of the person who referred you, and your referral count;
• your country, derived by Cloudflare from your IP address;
• a salted, truncated SHA-256 hash of your IP address, for rate limiting and to prevent referral fraud;
• timestamps.

Raw IP addresses are not stored in the database. A hash of an IP address is still personal data, and we treat it that way. Public leaderboards show emails only in masked form, for example "ja***@gm***.com".

Contact the waitlist owner first about your data. We forward requests and support the owner in answering them.

5. Processors and international transfers

Cloudflare, Inc. (USA) hosts Flocklist: Workers, the D1 database and static assets. Data is processed in Cloudflare's global network, including outside the EU. Cloudflare is certified under the EU-US Data Privacy Framework. Cloudflare's data processing addendum (DPA) and the EU Standard Contractual Clauses apply.

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, hosts the server of our analytics tool (Umami) in Finland, under a data processing agreement (Art. 28 GDPR). This data does not leave the EU.

For payments, see section 3.

6. How long we keep data

• Owner data: while the account or waitlist exists.
• Signups: until the owner deletes the waitlist (admin page or API). Then all its signups are deleted immediately.
• Payment and accounting records: as long as German tax law requires, up to 10 years (§ 147 AO, § 257 HGB).
• IP hashes: kept with the record they belong to.
• Request logs: short-lived.
• Referral code in localStorage: until you clear it.

7. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can object at any time to processing based on Art. 6(1)(f) for reasons relating to your situation.

For owner data, write to us. For signup data, contact the waitlist owner first. We will forward your request and help the owner answer it.

You can complain to a supervisory authority (Art. 77 GDPR), for example in the EU country where you live or work. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

8. Contact and changes

Privacy questions: info@smart-byte.com. We update this policy when the service changes. The date above shows the current version.