Privacy policy | Kostnichts

1. The essentials: what Kostnichts does not collect

Kostnichts is a free shopping simulation. Browsing, using the simulated cart and completing the €0.00 journey do not ask for your name, postal address, date of birth, telephone number, user account, password, card details or bank details. We operate no newsletter, contact form, customer account, or purchase, delivery or payment process for displayed products.

We do not build personal shopping or advertising profiles, sell or rent personal data, or use data for personalised advertising. Meta tracking remains disabled. Google Analytics loads only after an express choice for reach and usage statistics. The technically necessary processing involved in opening a website and the voluntary use of external services are explained below.

2. Controller and contact

The controller under the General Data Protection Regulation (GDPR) is Jhonathan Campos, 10827, email: jhonathanaugusto@gmail.com.

The contact page contains no web form. Selecting the email link opens your own email application. Only when you intentionally send a message do we process its content, sender address, timestamps and technical metadata sent with it to handle your request.

3. Technical delivery by Vercel

To deliver a website, protect it against attacks and diagnose failures, the hosting provider Vercel processes technically necessary connection, security, diagnostic and log data. This may include IP address, time, requested URL including a search term entered in the URL, referrer, HTTP status, browser or device information and user agent. This processing cannot be completely avoided when a website is requested.

The legal basis is Article 6(1)(f) GDPR. The legitimate interests are secure, stable and abuse-resistant delivery, troubleshooting and attack prevention. The hosting and processing configuration confirmed for the operator account is: Vercel Standard Clauses.

4. Catalogue and search

The product catalogue, prices, discounts and reviews are part of the simulation. Search filters the catalogue using the term entered. Kostnichts does not use it to create a search profile or store it in an account or a proprietary search history. Because the term can appear in the requested URL, it may nevertheless form part of the hosting provider’s technically necessary server logs. Do not enter personal or confidential information in the search field.

5. Local browser storage

The simulated cart (“kostnichts:v1:cart”), up to eight recently viewed product identifiers (“kostnichts:v1:recently-viewed”) and the sound setting (“kostnichts:v1:sound-enabled”) are stored locally in the browser. They remain on the device and are not transmitted to Kostnichts merely by being stored. They are removed when the relevant feature resets, the cart is cleared after completion, or browser storage is deleted.

The language choice is stored as “NEXT_LOCALE”. The privacy choice is stored as “kostnichts:v2:consent” and in the “kostnichts_consent” cookie for no longer than one year. After consent, Google Analytics also sets cookies with names such as “_ga”. They are removed on withdrawal where technically accessible. You may clear browser data at any time in your browser settings.

6. Consent-based visitor statistics with Google Analytics

If you select optional visitor statistics, Kostnichts loads Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It processes in particular page views, approximate visit origin, referrer, campaign parameters, browser and device information, language, interactions and technical timestamps. Do not enter personal or confidential information in search fields.

Processing and access to Analytics cookies occur only after consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Advertising storage, personalised advertising, Google Signals and Meta tracking are disabled. You can withdraw your choice at any time through “Privacy settings” in the footer; no new Analytics events are sent afterwards. The simulation works without consent.

7. Contact by email

If you voluntarily email us, we process the information supplied to reply, assess rights notices or complaints and document the matter. The legal basis is Article 6(1)(b) GDPR for pre-contractual or service-related communications; otherwise it is Article 6(1)(f) GDPR and the legitimate interest in reliable correspondence and request handling. Statutory recordkeeping may additionally rely on Article 6(1)(c) GDPR.

Emails are deleted once the matter is complete and no statutory retention, evidential or legal-defence interest remains. Please do not send unnecessary sensitive information.

8. Voluntary support through an external provider

Voluntary support is enabled and is processed only on buymeacoffee.com. The provider shows the selected amount and whether it is one-time or recurring before confirmation.

The external provider is Buy Me a Coffee, a service of the US company Publisherr Inc. Its privacy policy states that payments are processed through Stripe and that visitor, payment-token and, where provided, name and email data may be processed. Its own terms and privacy policy apply after the external page is opened.

Clicking the support link leaves Kostnichts. No payment form or support-provider script is embedded on this website. Payment, card and bank data are therefore not entered into Kostnichts. The external provider processes data arising there under its own terms and privacy information.

If the provider makes a payment confirmation available to the operator, it may contain the amount, time, transaction identifier and any name, email address or message voluntarily supplied. This information is processed to accept and document support, address questions or payment errors and comply with statutory recordkeeping and tax duties under Article 6(1)(b) and (c) GDPR where applicable.

9. Purposes and legal bases at a glance

Technical delivery, security and troubleshooting: Article 6(1)(f) GDPR. Browser functions requested by the user: Article 6(1)(f) GDPR and section 25(2) no. 2 TDDDG. Optional visitor statistics: consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Voluntary email communication: Article 6(1)(b) or (f) GDPR. Voluntary real support and its administration: Article 6(1)(b) GDPR; legally required documentation: Article 6(1)(c) GDPR.

10. Recipients and no data sales

Vercel receives technically necessary data as hosting and infrastructure provider. After consent, Google Ireland Limited receives visitor-statistics data and may use affiliated Google companies and processors. Only after the external support page is deliberately opened do the identified support and payment providers receive data. Other recipients are considered only where required by law, necessary to establish or defend legal claims, or initiated by you. Kostnichts does not sell, rent or trade personal data.

11. Processing outside the EU and EEA

Vercel, Google and the support provider may use companies or processors in the United States and other third countries. Processing outside the European Union or European Economic Area therefore cannot be excluded. It is governed by adequacy decisions, including the EU-US Data Privacy Framework where applicable, Standard Contractual Clauses and other contractual data-protection safeguards of the relevant provider.

12. Retention

Local cart, recently viewed and sound data remain until removed by the feature or until you clear browser storage. The privacy choice is retained for no longer than one year. Event and user data in the GA4 property are configured for two months; aggregated reports may remain longer. Vercel currently documents a standard three-day retention period for its general runtime logs; different security, billing or account configurations may be subject to other periods.

Email correspondence and payment confirmations are retained only for as long as necessary for handling, evidence, abuse prevention or statutory recordkeeping and tax duties. They are then deleted or, where lawful, anonymised.

13. Security

Kostnichts uses technical and organisational safeguards appropriate to the risk: encrypted HTTPS transport, restrictive security headers, a Content Security Policy, protection against framing by other websites, no user accounts or password database, no embedded payment form and consent-based visitor statistics without advertising personalisation. Vercel also documents transport encryption, encryption of stored platform data and measures against DDoS attacks.

No website can promise absolute security or complete freedom from defects. Safeguards are therefore reviewed and adapted when the technology, risks or law changes.

14. Is providing data mandatory?

Technical connection data is required to open the site; without it, the service cannot be delivered. Local storage is needed for each selected function but can be ended by clearing browser storage. Email and support are entirely voluntary. There is no statutory or contractual obligation to provide Kostnichts with other personal data.

15. Your rights

Subject to the GDPR, you have in particular rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection to processing based on legitimate interests (Article 21). Consent may be withdrawn at any time for the future. A message to the email address above is sufficient. We may request information needed to verify identity and avoid disclosing data to an unauthorised person.

16. Complaints and the Berlin supervisory authority

You may lodge a complaint under Article 77 GDPR with a data protection supervisory authority. In particular, the authority responsible for a controller based in Berlin is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, telephone +49 30 13889-0, email mailbox@datenschutz-berlin.de. Its official complaint form is available at https://www.datenschutz-berlin.de/buergerinnen-und-buerger/beschwerde/. You may also contact the authority for your habitual residence, workplace or the place of the alleged infringement.

17. No automated decisions and policy changes

Kostnichts makes no solely automated decisions producing legal or similarly significant effects and performs no profiling within Article 22 GDPR.

This policy will be updated before new processing, tracking technology or providers are activated. The published version and its stated date apply.