DINGSHACKS
Register New Shack
Sign in

Privacy Policy

Last updated: May 2026

This page explains what personal data DingShacks ("we", "us") collects, why we collect it, who we share it with, and how you can exercise your rights over it. DingShacks is operated by capee ventures, a Delaware C-Corporation — see the imprint page for full company details. If anything here is unclear, email jan@dingshacks.com.

What we collect

We only collect data we actually need to run the service:

  • Account data. Your email address when you sign in (passwordless magic link) and, optionally, your display name.
  • Listings you submit. Shop name, location, contact details, photos and any other information you choose to add to a shack listing.
  • Reviews, endorsements, reports. Content you post about other shacks, plus the timestamp and your account id.
  • Payment data (for claims & donations). Payments are handled by Stripe. We never see or store your card details — we only receive a Stripe customer id and subscription id so we can link a payment back to your account.
  • Technical data. Standard server logs (IP address, user agent, requested URL, response status) kept by our hosting provider (Cloudflare) for security and abuse prevention.

Cookies and browser storage

We use the minimum needed to make the site work. No tracking, no analytics, no advertising cookies.

  • Session cookie (session-id): an HttpOnly cookie set after you sign in so you stay logged in. Required for the service to function. Expires after one hour of inactivity.
  • localStorage / sessionStorage: we store small bits of state in your browser to improve your experience — the shacks you recently viewed, your last map view, your cached search location, and the coffee-prompt funnel state. This data never leaves your device.

Who we share data with

We use a small set of trusted sub-processors to run the service. Each only receives the data it needs to do its job:

  • Cloudflare — hosting (Workers, KV, D1), bot protection (Turnstile). Receives all HTTP requests to the site.
  • Stripe — payment processing for claims and coffee donations. Receives your email, the amount, and a reference to your account.
  • Resend — transactional email delivery (magic links, email-change confirmations). Receives your email address.
  • Carto / OpenStreetMap — map tile delivery. Receives your IP when the map loads tiles.
  • Nominatim (OpenStreetMap) — geocoding place names you search for. Receives the search text.
  • Google Fonts — web fonts. Receives your IP when fonts load.

We do not sell your data and we do not share it with any other third parties for marketing.

How long we keep data

  • Account & profile. Until you delete your account.
  • Listings, reviews, claims. Until you delete them or your account.
  • Magic-link tokens. 15 minutes, then automatically purged.
  • Sessions. Up to one hour of inactivity, then automatically purged.
  • Payment records. Kept as long as tax law requires (typically 7–10 years depending on jurisdiction).
  • Server logs. Retained by Cloudflare per their standard policy.

Your rights

If you are in the EU, UK or another jurisdiction with similar laws, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your data ("right to erasure").
  • Export your data in a portable format.
  • Object to specific processing.
  • Lodge a complaint with your local data protection authority.

Most of this you can do yourself from your profile page. For anything else, email jan@dingshacks.com and we will respond within 30 days.

Children

DingShacks is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

We may update this page from time to time. Material changes will be announced via email to registered users.