Privacy policy
The tools on edzly run in your browser and can be used without an account. If you create one, we store what is needed to run it. This page explains what is processed when you visit the site and when you use an account.
Controller
Mehmet Alp, c/o flexdienst – #22518, Kurt-Schumacher-Straße 74, 67663 Kaiserslautern, Germany. Email: info@edzly.com. See also the imprint.
Using the tools
What you enter into a tool, for example a class list, is processed in your browser and not sent to us. Only when you are signed in and choose to save something (a favorite or a saved setup) is it sent to our server and stored with your account, see below.
Your account
An account is optional. When you register we store your email address, the display name you choose (if any) and your password as an Argon2id hash, never the password itself. We send you an email to confirm the address; links in our emails for confirming the address or resetting the password contain single-use codes that expire after 24 hours and 1 hour.
New passwords are checked against known data breaches with the “Pwned Passwords” service of Have I Been Pwned, using k-anonymity: only the first five characters of the password’s SHA-1 hash leave our server. The password itself and your email address are never sent, and the service cannot tell which password was checked.
For every device you sign in on, we keep a session: a short device label (browser and operating system), when it was created and when it was last used. You can see these sessions on your account page and end any of them. Your account data (email address, display name, password hash, favorites and saved setups) is kept until you delete the account; favorites and saved setups you remove earlier are deleted right away.
To protect accounts against abuse we keep a security log of sign-ins and failed sign-in attempts, password changes and resets, ended sessions and account deletions. Each entry holds the time, the kind of event, the IP address and the device label, never passwords or tokens. Entries are deleted after 90 days. We also limit how often sign-in and similar actions can be tried.
You can delete your account at any time on your account page. This immediately deletes your profile, sessions, favorites and saved setups, including your entries in the security log. Only one “account deleted” entry (user ID, time and IP address) remains and is removed after 90 days, like all log entries.
Account emails (address confirmation, password reset and security notices) are sent through the SMTP service of Hostinger International Ltd., Cyprus, which processes the email address and the content of the message on our behalf as a processor.
Legal basis: Art. 6 (1) (b) GDPR for providing the account you asked for; Art. 6 (1) (f) GDPR for the security log, the rate limits and the breach check, our legitimate interest being protecting accounts against abuse.
Hosting and server logs
The site runs on our own server in Germany; no hosting provider processes your data on our behalf. The site’s own fonts, scripts and images are served from this server, without a content delivery network.
When you open a page, the web server records the date and time, the requested path (without anything after a “?”), the status code and size of the response, the referring page and your browser’s user agent. Your IP address is shortened before it is written (the last part is removed), so it can no longer be linked to you.
The reverse proxy in front of the web server records redirects and error responses (for example a request for a page that doesn’t exist) with the full IP address, the time, the requested address and the browser’s user agent, to detect and fend off attacks and to find errors. Normal page views are not recorded there. These logs are deleted automatically after 7 days at the latest and are not combined with other data.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is operating the site securely and fixing errors.
Anonymous visitor statistics
To learn which tools are useful, we count page views with Umami, an open-source analytics tool that we run on our own server. It sets no cookies and does not store IP addresses or build profiles across websites. We see aggregated numbers: pages viewed, the referring website, the browser, the operating system, the device type and the country. Anything after a “?” or “#” in the address is never recorded, so links with codes from our emails stay private.
If your browser sends a “Do Not Track” signal, nothing is counted. You can also exclude your visits here:
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is improving the site based on anonymous usage.
Cookies and storage in your browser
When you sign in, the server sets one cookie, __Secure-edzly-rt. It keeps you signed in and is only sent to our sign-in endpoints; scripts on the page cannot read it. It expires 30 days after your last visit, at the latest one year after you signed in, and is deleted when you sign out. This cookie is strictly necessary for the account you asked for, so no consent is needed (§ 25 (2) no. 2 TDDDG).
The site stores your choice of light or dark theme in your browser’s local storage, while you are signed in a marker that a session exists (edzly-session; it holds no token and no personal data), and, if you use the switch above, that your visits should not be counted. To work offline, your browser also keeps a copy of the site’s own files and of pages you visited; it never contains your account data or anything you entered into a tool. You can delete all of this at any time in your browser settings.
Encryption
All connections to the site are encrypted with TLS (https).
Your rights
You have the right to access the personal data we process about you, and to have it corrected, deleted or restricted, and to data portability (Art. 15–20 GDPR). Where processing is based on legitimate interests, you may object to it at any time for reasons arising from your particular situation (Art. 21 GDPR). Contact us at the email address above.
If you have an account, you can see and change your data on your account page and delete the account there. Without an account, we usually can’t link any data to you, and in that case these rights can’t be applied (Art. 11 GDPR). If you give us details that let us find your data, for example your IP address and the time of your visit within the 7 days the proxy logs are kept, we will handle your request.
You also have the right to lodge a complaint with a data protection supervisory authority, for example Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.
We do not use automated decision-making.
Changes
We update this policy when the site changes. Last updated: .