Skip to content
Stube

Privacy Policy

Last updated: May 13, 2026

This privacy policy explains how personal data is processed on this site.

What we collect and why

Name and email address
Used to create and manage your account and to send sign-in links. Legal basis: Art. 6(1)(b) GDPR — necessary for performance of a contract.

Session cookie
A technically necessary cookie that keeps you signed in. Sessions expire after 30 days of inactivity, or 90 days at most. Legal basis: § 25(2) No. 2 TDDDG — strictly necessary.

Security logs
When sessions are created or terminated, we record an event log including the event type, your user ID, device category, city, and country. We also record when each session was last used, refreshed at most once every five minutes. This data is processed by Cloudflare as part of the Workers runtime and is used solely to detect and investigate security anomalies. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in protecting the security of this service.

Server request data
When a visitor loads a page, image, or video, CDN edge servers process the visitor's IP address and basic request metadata (such as user agent and referring URL) to route and deliver the response. Pages, images, videos, and video thumbnails are all served via Cloudflare. To monitor the operational health and security of this service, request metadata (URL, HTTP method, status code, duration, and any application log events) is recorded to an operational log archive stored in Cloudflare R2. IP addresses are redacted at the logging layer before storage, and cookie values are excluded from logged headers. Logs are retained for 90 days and then automatically deleted. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating, monitoring, and securing this service.

Locale preference
A cookie that remembers your language preference. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing a usable interface.

Dismissed-banner cookie
If you dismiss the email-notification banner, we set a cookie for 30 days so the banner stays hidden. Legal basis: § 25(2) No. 2 TDDDG — strictly necessary, since the cookie only stores your own dismissal choice.

Content you create
Posts, comments, reactions, photos, and videos you share on the site. Legal basis: Art. 6(1)(b) GDPR — necessary for performance of a contract.

Automatic image alt text
When you upload a photo, the image is sent to Gemini Enterprise Agent Platform on Google Cloud to automatically generate a short alt text description for screen readers. This feature is enabled by default and can be disabled at any time in your account settings. The image is transmitted solely for alt text generation. Under Gemini Enterprise Agent Platform, Google does not use submitted data to train or improve its models. Google may log requests for a short, limited period (typically up to 24 hours) to detect abuse and policy violations. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing accessible image descriptions. You can object to this processing by disabling the feature in your settings.

Automatic translations
When a post or comment is created or updated, the text content (post title, post body, or comment text) is sent to Gemini Enterprise Agent Platform on Google Cloud to detect its language and translate it between English and German. Generated image alt text is also translated automatically. Translations are produced in the background and stored alongside the original content. This feature is enabled by default and can be disabled at any time in your account settings. Under Gemini Enterprise Agent Platform, Google does not use submitted data to train or improve its models. Google may log requests for a short, limited period (typically up to 24 hours) to detect abuse and policy violations. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in making content accessible to all members of this bilingual community. You can object to this processing by disabling the feature in your settings.

AI-generated titles and slugs
When you click the generate button in the post editor, the post title and the body text are sent to Gemini Enterprise Agent Platform on Google Cloud to suggest a title or URL slug. No data is sent until you click the button. Under Gemini Enterprise Agent Platform, Google does not use submitted data to train or improve its models. Google may log requests for a short, limited period (typically up to 24 hours) to detect abuse and policy violations. Legal basis: Art. 6(1)(a) GDPR — consent (by initiating the request).

Email notifications
If you enable email notifications in settings, we store that preference and send you emails accordingly. Legal basis: Art. 6(1)(a) GDPR — consent. You can withdraw consent at any time in your settings.

Data processors

Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855 Luxembourg) — used in the Frankfurt region (eu-central-1) for: (1) image transformation via AWS Lambda — when a visitor requests an image variant in a specific size or format, a Lambda function fetches the stored original from Cloudflare R2, produces the requested variant, and returns it; (2) video transcoding via AWS MediaConvert — uploaded video files are temporarily copied to an S3 input bucket, encoded into adaptive HLS variants, and the outputs are written to an S3 output bucket from which they are copied back to Cloudflare R2; the source and output objects in S3 are then automatically deleted by lifecycle rules (1 day and 7 days respectively). Image and video data remain within the European Union throughout processing. For any processing or transfers outside the EU by AWS's parent entities, the EU Commission's Standard Contractual Clauses apply under Art. 46(2)(c) GDPR. AWS's privacy notice.

Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) — provides the technical infrastructure this site runs on, including the runtime environment, database, image and video storage, video delivery via the Cloudflare network, and delivery of transactional emails via the Cloudflare Email Service. Database and image/video storage are located within the European Union. When sending email, email addresses and message content are processed on Cloudflare's global network; transfers outside the EU rely on the EU-US Data Privacy Framework and, as a fallback, the EU Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR. Cloudflare's privacy policy.

Google Cloud EMEA Limited (70 Sir John Rogerson's Quay, Dublin 2, Ireland) — used via Gemini Enterprise Agent Platform to generate alt text from uploaded photos, to automatically translate posts, comments, and alt text between English and German, and to suggest post titles and URL slugs from post text. Images and text content are transmitted to Google for these purposes. Google processes the data under the Google Cloud Data Processing Addendum and the service-specific terms for Gemini Enterprise Agent Platform, and does not use it to train or improve its models. Google may log requests for a short, limited period (typically up to 24 hours) to detect abuse and policy violations. Requests may be processed globally, including in the United States. For such transfers, the EU Commission's Standard Contractual Clauses apply under Art. 46(2)(c) GDPR. Google's privacy policy. Google Cloud Data Processing Addendum. Gemini Enterprise Agent Platform service-specific terms.

How long we keep your data

Session data is deleted automatically after 30 days of inactivity, or 90 days at most. Account data and content are retained for as long as your account is active. Following a deletion request, your data will be removed without undue delay.

Operational logs (request metadata and application events) are retained for 90 days and then automatically deleted.

Your rights

Under GDPR, you have the following rights:

  • Access to the personal data held about you (Art. 15)
  • Rectification of inaccurate data (Art. 16)
  • Erasure of your data (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability in a common format (Art. 20)
  • Objection to processing based on legitimate interests (Art. 21)
  • Withdrawal of consent at any time, without affecting prior processing (Art. 7(3))

To exercise any of these rights, contact privacy@thestube.com.

Right to complain

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for this site is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW):

www.ldi.nrw.de

Who is responsible

Jakob Wells
privacy@thestube.com