Privacy Policy

1. Who is responsible

The controller for data processing on this website is:

Marius Nickig
Lokstedter Weg 37, 20251 Hamburg, Germany
Email: info@rucksack.wiki

This policy covers the website rucksack.wiki in English and German. It does not cover the Rucksack app.

2. Overview

On every visit: the website is delivered and protected by Cloudflare; a cookie keeps the version of pages we are testing the same for you; PostHog counts visits without storing anything on your device.

Only if you use the waitlist form: a bot check by Cloudflare Turnstile, and your email address stored with Loops.

Only with your consent: analytics cookies (PostHog, Google Analytics) and measuring our ads (Google Ads), loaded through Google Tag Manager where Google is involved.

You can give, change or withdraw consent at any time under "Cookies" in the footer of every page.

3. Hosting and delivery (Cloudflare)

This website is hosted on Cloudflare Pages. Cloudflare delivers every page and runs small programs on its servers that decide which version of a tested page you receive (section 5), apply redirects, and forward analytics requests (section 6).

To do this, Cloudflare processes the data that every browser sends: IP address, date and time, the requested address, the referring page, browser and operating system, and technical connection data. The purpose is to deliver the website securely and to protect it against attacks and abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a working, secure website. We do not store access logs ourselves.

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare acts as our processor under its data processing agreement. Data may be transferred to the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).

Fonts are served from our own domain. No external font service is used.

4. Cookies and similar storage

rucksack_consent (local storage in your browser, until you change it): stores your cookie choice. Set once you make a choice.
rk_id (cookie, 12 months, rucksack.wiki and its subdomains): a random identifier used to show you a consistent version of pages we test. Set on every visit, regardless of your cookie choice. See section 5.
ph_…_posthog (cookie and local storage, 12 months): PostHog analytics. Only with consent to analytics.
_ga, _ga_… (cookies, 2 years): Google Analytics. Only with consent to analytics.
_gcl_au (cookie, 90 days): Google Ads conversion measurement. Only with consent to marketing.

When you withdraw consent, we delete the cookies and storage of that category from your browser.

5. Page experiments (A/B tests)

We test different versions of some pages, for example two headlines, to find out which one explains Rucksack better. When you request a page, our code at Cloudflare reads the rk_id cookie, or sets it if it does not exist, and asks PostHog which version of the page to show you. Only the random identifier is sent to PostHog for this; your IP address is not. The page is then delivered in that version.

The purpose is to improve the website by comparing versions. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the website with reliable comparisons, which requires that you see the same version on every visit. The rk_id cookie is set regardless of your cookie choice. It contains no information about you, expires after 12 months, and you can delete or block it in your browser at any time; you will then be treated as a new visitor.

Which version you were shown is recorded together with the analytics data described in section 6.

6. Measuring use of the website (PostHog)

We use PostHog to understand how the website is used: which pages are visited, which version of a tested page was shown, and whether the waitlist form was used. We use PostHog's EU cloud, whose servers are located in Frankfurt, Germany. Requests are sent through our own domain (rucksack.wiki/relay), which forwards your IP address to PostHog so that it can derive your approximate location (country, region).

Automatic recording of clicks and entries is switched off, and there are no session recordings. Your email address is never sent to PostHog.

This is the default, and it applies after "Reject all". PostHog stores nothing on your device. It processes the page visited, the referring page, time, browser and device type, approximate location, the page versions shown, and events such as "joined the waitlist" (without your email address). To count visitors, PostHog calculates an identifier on its servers from your IP address and browser information combined with a secret value that changes regularly; it cannot be used to recognise you on your device. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is knowing how the website is used in order to improve it.

PostHog additionally sets the cookie listed in section 4, so that later visits can be recognised, using the same random identifier as in section 5. If you join the waitlist, PostHog keeps a pseudonymous profile noting that you joined and which consent you gave — still without your email address. The legal basis is your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future under "Cookies" in the footer.

Provider: PostHog Inc., USA, with processing in its EU cloud. PostHog acts as our processor under a data processing agreement. Where data is accessed from the USA, the transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We keep analytics data for as long as it is needed to evaluate the use of the website, and for no longer than 24 months.

7. Google Tag Manager, Google Analytics and Google Ads

These services are loaded only if you consent to analytics or marketing. Before that, no request is sent to Google.

Google Tag Manager loads the Google services below and passes on which categories you consented to (Google Consent Mode). It does not itself create a profile of you.

Google Analytics (with consent to analytics) measures page visits, device and browser, approximate location and events such as joining the waitlist, using the cookies listed in section 4. Google Analytics 4 does not store IP addresses for users in the EU.

Google Ads conversion measurement (with consent to marketing) records whether a visit that started from one of our ads led to a waitlist signup, using the cookie listed in section 4. If you are signed in to a Google account, Google may associate this with your account under its own terms.

The legal basis is your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, which you can withdraw at any time under "Cookies" in the footer. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Google Analytics data is kept for 14 months.

8. Joining the waitlist

Bot check (Cloudflare Turnstile). When you click into the email field, Cloudflare Turnstile is loaded to check that the form is not being used by a bot. Turnstile processes your IP address, TLS fingerprint, browser information and the site it is used on. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the form against spam and abuse. Cloudflare acts as our processor for this check, and as an independent controller for improving its bot detection; see the Turnstile privacy addendum.

Your email address (Loops). When you join the waitlist, we store your email address and the fact that you signed up on this website with Loops, a service for sending emails. We use it to invite you to the beta and to send you information about it. The legal basis is Art. 6(1)(b) GDPR — steps you requested before a possible use of the app. Every email contains a link to unsubscribe. We keep your address until you unsubscribe or ask us to delete it, or until the beta ends and we no longer need it.

Provider: Astrodon Corporation (Loops), USA. Loops acts as our processor under a data processing agreement. Astrodon Corporation is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Providing your email address is voluntary. Without it, we cannot invite you to the beta.

9. Contacting us by email

If you write to us, we process your message and contact details to answer it. The legal basis is Art. 6(1)(b) GDPR where your message concerns the beta or a possible use of the app, and Art. 6(1)(f) GDPR otherwise; our legitimate interest is answering enquiries. We delete the message when it has been dealt with, unless legal retention periods apply.

10. Your rights

You have the right to access your personal data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20).

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. Write to info@rucksack.wiki.

Withdrawing consent (Art. 7(3) GDPR): you can withdraw consent at any time under "Cookies" in the footer. This does not affect processing carried out before the withdrawal.

Right to lodge a complaint (Art. 77 GDPR): you can complain to a data protection supervisory authority. The authority responsible for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

11. Changes

We update this policy when the website or the services we use change. The date at the top shows the current version.