Privacy policy

Controller

The controller for data processing on this website and in the Toxin app is:

PF Capital Management UG (haftungsbeschränkt), represented by Paul Fuleda, Benrather Schloßallee 6, 40597 Düsseldorf, Germany.

Email: [email protected] · Phone: +49 151 65021317

Cookies and consent

toxin-app.com consists of pre-built pages. Without your consent, this website sets no cookies, performs no analytics and builds no usage profile. There are no embedded social media buttons and no advertising networks.

Fonts, graphics and the stylesheet are served from our own server. Opening these pages establishes no connection to Google Fonts.

On your first visit, a consent banner asks whether you agree to analytics. What is processed in that context is described in the next two sections.

Consent management with Cookiepass

The consent banner is provided by Cookiepass, a service of PF Capital Management UG (haftungsbeschränkt), Benrather Schloßallee 6, 40597 Düsseldorf, Germany, which is us. When you open a page, your browser loads the banner from cdn.cookiepass.io; your IP address is transmitted in the process.

Your decision is stored in your browser (local storage, entry “cookiepass_consent”, 12 months). The banner also stores technical entries that contain no personal data: the list of services held back and the date of the last technical report.

To be able to prove your consent, we store: a random consent ID, your decision and the chosen categories, the language, the time, the browser identifier (user agent), a shortened IP address (only its prefix, not the full address), the page opened without parameters and, where present, campaign information from the address (utm). We keep these records for three years and then remove the personal reference.

The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR: we are obliged to be able to prove consent. Storing your decision in your browser is strictly necessary within the meaning of § 25(2) No. 2 TDDDG.

You can change or withdraw your decision at any time using the icon at the bottom left of every page.

Analytics with Google Analytics

If you consent, we use Google Analytics 4 to understand how this website is used. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is integrated via Google Tag Manager, which we operate through the SignalHost service of Algorithmo GmbH, Haus-Endt-Str. 90, 40593 Düsseldorf, Germany. Measurement data is sent via the address 62jr22j20myh.signalhost.io.

Only after your consent are the cookies “_ga” and “_ga_W104R9WH30” set (lifetime up to two years) and usage data transmitted: pages viewed, time, referring page, browser and device information, the approximate region derived from your IP address and a pseudonymous identifier. Google deletes the analytics data once the retention period set in Google Analytics has expired.

Without your consent, the Tag Manager is not loaded: no connection to SignalHost is established, no cookies are set and no measurement data is transmitted.

Data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time using the icon at the bottom left; this does not affect the lawfulness of processing carried out before the withdrawal.

Server log files

When you open a page, your browser transmits technically necessary data that the web server records in log files: the address requested, the date and time of the request, the amount of data transferred, whether the request succeeded, browser type and version, operating system, referring page and IP address.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest lies in operating the website securely and without disruption, and in fending off attacks.

This data is not combined with other sources. The logs are rotated daily and deleted after 14 days.

No evaluation for advertising or analytics purposes takes place.

Hosting

The website runs on a server operated by Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany. The server is located in Germany.

A data processing agreement under Article 28 GDPR is in place with Contabo GmbH. Hosting itself involves no transfer to a third country.

Cloudflare

Requests to this website pass through the content delivery network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare receives the request, filters out attacks and forwards it to our server. In doing so, Cloudflare processes your IP address and technical details of the request.

The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in the security and availability of the website. A data processing agreement is in place with Cloudflare, and the transfer to the USA is based on the European Commission's standard contractual clauses.

Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

The Toxin app

Toxin is a menu bar app for macOS. Your settings — the chosen duration, lid-closed mode, appearance — are stored only locally on your Mac. They never leave your device, and we never receive them.

The app sends us no usage data, no crash reports and no identifiers of its own accord.

The purchase of Toxin Pro is handled by the Mac App Store. Apple is the seller; we never receive your payment details. All we learn from Apple is whether a valid purchase exists.

Voucher codes are redeemed through the Mac App Store. The code is created in App Store Connect and the redemption is handled by Apple. We receive neither the code nor any details about you; all the app learns from Apple is whether a valid entitlement exists. No server of ours is contacted in the process.

Your rights

You have the right to access the data held about you (Article 15 GDPR), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20) and to object to processing (Article 21).

To exercise them, simply write to [email protected].

Independently of this, you may lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. You may equally contact the supervisory authority where you live.

Changes to this policy

When the website or the app changes, this policy changes with it. The version that applies is the one shown on this page when you read it.