Privacy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Joscha Klopfer
Fließstr. 12b
12439 Berlin
Germany
Email: [email protected]

Lanes is a pre-launch project run by a private individual. No data protection officer has been appointed, as none is required.

Overview

• This website sets no cookies and stores nothing in your browser for tracking.
• It has no analytics, no tracking pixels and no advertising.
• It makes no requests to third parties: scripts, styles and fonts are self-hosted and everything is served from this domain.
• Personal data is processed in two places only: the web server logs and, if you use it, the waitlist form.

Hosting and server logs

The website runs on a dedicated server at OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, in the European Union. OVH acts as a processor on my behalf. The site is served by nginx behind a Traefik reverse proxy.

When you open a page, the web server processes your IP address, the date and time of the request, the requested URL, the HTTP status code, the number of bytes sent, the referrer (if your browser sends one) and your browser's user agent. This is necessary to deliver the site and to keep it secure and stable.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of the website). Server logs are kept for at most 14 days and then deleted.

Encryption

The site is served only over an encrypted connection (TLS). The certificate is issued by Let's Encrypt. Let's Encrypt does not receive any data about your visit to this site.

Waitlist

If you request access, you enter your email address and, optionally, your name and a note. Together with the time of your entry, this data is stored in the Lanes database.

When you submit the form, the API additionally keeps short-lived rate-limit counters to prevent abuse. One counter is keyed by your IP address and one by a hash (SHA-256) of your email address, together with the number of requests and the time of the last request. The counters apply to a 15-minute window and are deleted once that window has passed, with a cleanup running at least hourly.

Purpose: managing access requests, contacting you about your request, and preventing abuse of the form.

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to granting access) and Art. 6(1)(f) GDPR (abuse prevention). Providing the data is voluntary; without an email address I cannot process your request.

Retention: a waitlist entry is kept while it is needed to decide on and grant access (an approved entry is what allows the account to be created). Entries are deleted on request at any time, and entries that are no longer needed are deleted manually during a review at least once a year. If access is granted, the data you provide when creating an account is covered by the privacy information of the Lanes application.

Recipients: when I approve your request, the approval email is sent through the SMTP relay of an email delivery provider that acts as a processor on my behalf and may only process the data (your email address and the message) to deliver it.

Signup status check

The site asks the Lanes API whether sign-up is currently open, in order to show the right button. This request contains no personal data beyond what appears in the server logs described above.

Links to other services

This site links to the Lanes application (lanes.j11r.io) and to the changelog (lanes-changelog.j11r.io). These are separate services with their own data processing; this policy does not apply to them. Following such a link only transmits data once you open it.

Your rights

You have the right, under the conditions of the GDPR, to:

• access to your personal data (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20), and
• object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21).

Where processing is based on your consent, you can withdraw it at any time with effect for the future. This does not affect the lawfulness of processing before the withdrawal.

To exercise your rights, email [email protected].

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for me is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany

Automated decisions and third countries

There is no automated decision-making and no profiling. The website itself does not transfer personal data to third countries outside the European Economic Area.

Changes to this policy

I update this policy when the website or the legal situation changes. The current version is always the one on this page.

Last updated: 12 October 2026