Privacy policy

Last updated: October 2026

Controller

The controller for the processing of personal data on windbutler.com is Moritz Brandes, Heiligengeiststraße 6-8, 26121 Oldenburg, Germany, email: mb@brandes-it.com.

Windbutler sets no advertising cookies. It only sets analytics cookies if you allow them in the banner or in the privacy settings.

Hosting and server logs

Windbutler runs on Cloudflare, Inc. (USA). With every request, Cloudflare processes the technically necessary data: IP address, date and time, the requested address with its parameters (such as the place of a forecast or a search term), browser and operating system, and the referring page. Cloudflare also uses them to protect the site from attacks.

We keep access and error logs for at most seven days to find faults and keep the service running. The database is run by PlanetScale, Inc. (USA) on servers in the EU (Ireland).

The legal basis is our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR). We have data processing agreements with both providers (Art. 28 GDPR).

Usage analytics with PostHog

To understand which pages and features are used and where something gets in the way, we use PostHog (PostHog, Inc., USA), with data stored in the EU. Requests go through our own domain.

Without your consent, PostHog runs without cookies and stores nothing in your browser. Instead of an identifier, it computes a hash from your IP address, browser and a random value that changes every day, which only groups requests on the same day. The random value is deleted daily, so visits on different days cannot be linked. The IP address itself is not stored.

It records the pages you open and how long you stay, clicks and scrolling (also as a heatmap), clicks that do nothing, loading times, technical errors, country and city derived from the IP address, browser, operating system, screen size and the referring page. We keep the data as long as we need it to analyse how the site is used.

If you allow analytics, PostHog stores a random identifier in a cookie and in local storage (for up to one year) to link your visits. PostHog then also records sessions (page layout, mouse movements, clicks and scrolling; what you type into form fields is not recorded) and may show short surveys.

The legal basis for analytics without cookies is our legitimate interest in improving Windbutler (Art. 6(1)(f) GDPR); you can object to it by writing to us. For cookies, session recordings and surveys it is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time in the privacy settings.

Account

We use Clerk (Clerk, Inc., USA) for accounts. Clerk processes your email address, your name, your password (only in encrypted form) or your Google sign-in, as well as session data and your IP address to secure the sign-in. For this, Clerk sets technically necessary cookies.

With your account we store your settings, such as time steps, views and graphics quality. The legal basis is providing the account (Art. 6(1)(b) GDPR).

You can delete your account in the account settings. On request, we also delete your settings, reviews and posts.

Reviews and feedback

Signed in, you can review launch sites and post feedback, comments and votes. We store the content, the time, the language and your account ID. Reviews, posts and comments appear publicly with your shortened name (such as “Max M.”) or username.

You can also send feedback without an account. Name and email address are optional: the name appears publicly, the email address is only visible to us so we can reply. We review posts before they appear.

The legal basis is Art. 6(1)(b) GDPR, and for optional details your consent (Art. 6(1)(a) GDPR). The content stays stored until you ask us to delete it or we remove it.

Spam protection

We protect the feedback form for visitors without an account from spam with Cloudflare Turnstile. Turnstile loads content from Cloudflare and checks technical characteristics such as IP address, browser and interaction to tell people from bots.

The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). Accessing your device is strictly necessary for the submission you request (Section 25(2) no. 2 TDDDG).

Location

If you allow it, your browser determines your location. We round it to about ten metres and send it to our server to compute the forecast for that place. We do not store it, though it may briefly appear in the server logs.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your browser settings.

Place search

We send search terms with the map area and the language to Photon, the place search of komoot GmbH (Germany). We do not pass on your IP address. The legal basis is our legitimate interest in offering place search (Art. 6(1)(f) GDPR).

Maps, images and embedded content

For maps and images, your browser loads content directly from these providers. They receive your IP address and the requested map areas. The legal basis is our legitimate interest in showing complete maps (Art. 6(1)(f) GDPR).

When you open the DHV weather report, we embed it from dhv.de (Deutscher Hängegleiterverband e. V.). The DHV's privacy policy applies to it, and the DHV may set its own cookies.

  • Esri (Environmental Systems Research Institute, Inc., USA): base maps and satellite imagery
  • Bavarian Surveying Administration (Germany): aerial images of Bavaria
  • Amazon Web Services (USA): terrain data for the sunny slopes
  • Wikimedia Foundation (USA): photos in the spot guide

Live flight data

The map shows aircraft live from the Open Glider Network (OGN). Of flights, we only store the launch and last location and the times, without device ID or registration, to rank launch sites by real flights. We respect what owners set for tracking and identification in the OGN device database. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

Cookies and browser storage

Without your consent, Windbutler only stores what the site needs in your browser. These are strictly necessary to provide the features you use (Section 25(2) no. 2 TDDDG). If you allow analytics, PostHog's cookies are added (see Usage analytics).

  • Cookies “sidebar_state” (7 days) and “sidebar_width” (1 year): whether the sidebar is open and how wide
  • Session storage: settings you asked to save before signing in, until the sign-in completes
  • Cookie and local storage “c15t” (1 year): your choice in the privacy settings
  • Local storage “__ph_opt_in_out_…”: whether PostHog may set cookies, once you have allowed analytics
  • Clerk's cookies when you sign in (see Account)
  • The browser's cache for map tiles

Transfers outside the EU

Some providers are based in the USA (Cloudflare, PostHog, Clerk, PlanetScale, Esri, Amazon Web Services, Wikimedia). Transfers to them rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and otherwise on standard contractual clauses (Art. 46(2)(c) GDPR).

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21) and withdraw consent at any time for the future. Write to mb@brandes-it.com.

You can also lodge a complaint with a data protection authority, for example the Data Protection Commissioner of Lower Saxony, which is responsible for us.