Privacy & Security

What this page is

This page describes the privacy practices and security controls for the Chummsitz website. It is maintained by the site owner and is not an independent certification.

Data we collect

The public site does not require an account, does not run advertising trackers, and does not ask visitors for personal information. Standard server access logs (IP address, user agent, timestamp) may be retained briefly by our hosting provider for abuse prevention and reliability.

Admin accounts

A small number of invited administrators can sign in to edit site content. Admin authentication uses email and password with hashed credentials stored by our authentication provider. Admin-only actions are protected by server-side authorization and database row-level security policies.

Security controls

• HTTPS is enforced for all traffic.
• Sensitive operations run server-side; secrets are never shipped to the browser.
• The database enforces row-level security; admin role checks are evaluated server-side, not from the client.
• Dependencies and infrastructure are scanned for known vulnerabilities on an ongoing basis.

Cookies

The public site uses only essential cookies required for the site to function. Admin sign-in uses a session cookie/token to keep administrators signed in.

Your rights

If you would like to know what information we hold about you, or to request deletion, please contact us using the details on the Impressum page.

Reporting a problem

If you believe you have found a security issue with this site, please reach out via the contact details on the Impressum page so we can investigate.