Privacy policy

This is a translation for convenience. The legally binding version is the German Datenschutzerklärung.

1. Controller

2. General

xmoo.app is a collection of small tools. They calculate in your browser; what you enter into a tool is not sent to my server unless the tool says otherwise. The exception is the tool What is my IP? (German): there your browser asks my server which address your request arrives from and shows it to you. It is not stored; the server keeps no access log (section 3). The e-invoice viewer (German) reads the file you select only in your browser; it is not uploaded. The display runs in an isolated area in which neither ads nor Google Analytics are loaded. PDF to ZUGFeRD (German) works the same way: the invoice and everything you enter into the form stay in your browser. The tool saves your sender details only if you ask it to, as a file on your device. The fun and random tools (wheel of fortune, random generator, “Who has to?”, excuse generator, name generator; all German) also run only in your browser. If you create a link to share there, your entries are part of the link itself, after the #. Browsers do not send that part to the server; the tool removes it from the address bar right after opening, and the website reports the address to Google Analytics without it. Fonts come from your own device; maps and videos are not embedded. The website loads content from Google in two places: I use Google Analytics to measure reach (section 4), and I show ads via Google AdSense (section 5). Otherwise personal data is processed only to the extent described below.

The APIs at api.xmoo.app have their own API privacy notice.

3. Hosting and server logs

This website runs on a virtual server (Hetzner Cloud) operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a data centre in Helsinki, Finland (EU). When you visit the website, your browser necessarily transmits, among other things, your IP address, the date and time, the page requested, the browser type and operating system, and the page visited before (referrer). The server processes this information to deliver the page.

My web server keeps no access log: ordinary requests are not written to a file or database. Only technical error messages of the server software are logged (container logs, limited to a few megabytes and overwritten continuously); if an error occurs while a request is handled, the entry may contain the IP address of that request. Sign-in attempts at the server's maintenance access (SSH) are also logged including the sender's IP address; this serves to fend off attacks, and the operating system deletes these entries within its usual log rotation. Hetzner also makes backup copies of the server's disk; they contain the website's programs and the account list (section 7), no visitor data.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in providing the website without technical errors and keeping it secure. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

4. Web analytics with Google Analytics

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics helps me see which search terms and pages bring visitors here and which tools are used.

For this, a script from www.googletagmanager.com is loaded when you visit the website, and cookies are stored on your device (in particular _ga and _ga_<ID>). These cookies make it possible to tell returning visits from new ones. Processed are in particular the pages visited, time and duration of the visit, the referrer URL, information on browser, operating system and device, and a coarse location derived from it. If you click a link to another website, its target address is recorded; for affiliate links to Amazon also the position on the page where the link sits (short line or text section).

According to Google, IP addresses are not logged or stored in Google Analytics 4; for traffic from the European Union the IP address is used solely to derive location data and is then deleted immediately (see the Google help page on EU data collection). A transfer of data to Google LLC in the USA cannot be ruled out nonetheless.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in evaluating the use of the website statistically and shaping its content accordingly. A data processing agreement under Art. 28 GDPR is in place with Google. The retention period of the usage data is limited in the property settings.

Objection: You can object to the collection at any time. To do so, you can block or delete cookies in your browser or install the browser add-on provided by Google to deactivate Google Analytics: tools.google.com/dlpage/gaoptout. More on how Google handles user data can be found in Google’s privacy policy.

5. Ads with Google AdSense

This website shows ads via Google AdSense, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The revenue covers the cost of this website. Google chooses which ad appears where.

For this, a script from pagead2.googlesyndication.com is loaded when you open a page. It fetches further content from Google’s servers, including the ads, scripts for detecting invalid traffic (adtrafficquality.google) and the consent dialogue described below. In doing so Google receives in particular your IP address, the page visited, the referrer URL and information on browser and device.

Your consent: On your first visit a dialogue appears in which you decide whether Google and its advertising partners may store and read information on your device, for example in cookies, and whether the data may be used for personalised ads, ad measurement and the other purposes listed there. The dialogue is Google’s own consent management platform and works according to the Transparency & Consent Framework (TCF) of IAB Europe. Its settings list the partners with their purposes, and you can allow or reject them individually. Some partners rely for certain purposes not on your consent but on a legitimate interest; you can object to that in these settings too. Your choice is stored on your device so that the dialogue does not reappear on every visit.

Which ads you see depends on this choice:

• Personalised ads are based on data collected earlier, such as your visits to other websites. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this and/or other sites on the internet. This happens only with your consent.
• Non-personalised ads are based on the content of the page and a coarse location such as the city, not on your past behaviour. According to Google they still use cookies to limit how often the same ad appears and for aggregated reporting (Google help on non-personalised ads).
• Limited ads are served by Google if your choice allows neither personalised nor non-personalised ads. According to Google, cookies and local storage are then used solely to detect invalid traffic such as click fraud (Google help on limited ads).

The legal basis for storing and reading information on your device is your consent (section 25(1) TDDDG, the German Telecommunications Digital Services Data Protection Act), as it is for processing your data for advertising purposes (Art. 6(1)(a) GDPR). For limited ads it is my legitimate interest in funding the website through advertising while protecting it against click fraud (Art. 6(1)(f) GDPR). For AdSense, Google processes the data as an independent controller (Google’s overview of its advertising services). A transfer of data to Google LLC in the USA cannot be ruled out.

Withdrawal: You can change or withdraw your choice at any time with effect for the future. For this, Google shows a link to the privacy and cookie settings at the bottom of every page.

The same dialogue also opens via this link: Privacy and cookie settings

You can also switch off personalised advertising from Google in Google’s ad settings, and from many other providers via www.aboutads.info. How Google uses data from websites that use its services is explained on Google’s page “How Google uses information from sites or apps that use our services”.

6. Amazon affiliate links

xmoo.app participates in the Amazon EU Associates Programme. Some links to products on amazon.de are affiliate links; they are marked with an asterisk (*), next to the note “As an Amazon Associate I earn from qualifying purchases.” (on German pages: “Als Amazon-Partner verdiene ich an qualifizierten Verkäufen.”). If you buy something after clicking one, I receive a commission. The price stays the same for you.

As long as you do not click, nothing is transmitted to Amazon – the links are ordinary links, and no Amazon script is loaded on xmoo.app. Only when you click do you go to amazon.de. The link contains my affiliate ID so that Amazon can attribute the purchase; for this Amazon may set cookies on amazon.de. Amazon is responsible for this processing; details are in Amazon’s privacy notice. My legitimate interest in the affiliate links is funding this website (Art. 6(1)(f) GDPR). Google Analytics records that you clicked an affiliate link like any click on an external link (section 4).

7. Sign-in for invited accounts

On the sign-in page (German), people for whom I have created an account by hand can sign in; you cannot register yourself. While signed in, the website does not load ads from Google AdSense on that device.

For each account I store only the user name, a non-reversible hash of the password (PBKDF2) and the setting whether the account is ad-free – no email address, no real name. When you sign in, your browser sends user name and password encrypted (HTTPS) to my server. The server checks the password against the hash and neither stores nor logs it (section 3).

After a successful sign-in the website sets the cookie xmoo_werbefrei. It contains your user name and the time of the last check and lasts one year or until you sign out. Once a day the website asks my server whether the account is still ad-free; the user name is transmitted for this. The cookie is strictly necessary for the service you requested (section 25(2) no. 2 TDDDG); the legal basis for the processing is Art. 6(1)(b) GDPR. Google Analytics (section 4) also runs for signed-in accounts.

8. Contact by email

If you email me, I process the data you send (email address, name, content of the message and any attachments) to handle your request. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). The data is deleted as soon as it is no longer needed for handling the request and no statutory retention obligations apply.

9. Disclosure of data

Beyond the services described in this policy (in particular sections 4 to 6), your data is not passed on to third parties unless I am legally obliged to do so.

10. Your rights

You have the following rights against me as controller regarding the personal data concerning you:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing (Art. 21 GDPR)

An informal email to julian@haag-automation.com is enough.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW).

Last updated: November 2026