Privacy

Most of Wattlas is a plain static website: every page is a pre-computed file, and reading one creates no account and fills in no form. By default it loads no third-party scripts, fonts or map tiles — the fonts and libraries it needs are served from this site itself. Two features are opt-in and change that: analytics, and the on-page Q&A assistant on the views that offer it. The assistant is the one part of the site with an account, a small store of its own and a record of the questions it is asked; all three are described below. The contact page and the sign-up page each have one form, described below too. A small first-party cookie, wx_consent, remembers whichever choice you make on the consent banner — even a decline — for 180 days, so you aren't asked again every visit; that cookie itself needs no consent, since it's what makes consent possible. Until you turn analytics or the assistant on, the only other personal data involved is the request metadata your browser sends to the host to load a page.

Who is responsible

The controller within the meaning of the GDPR is the operator named in the Impressum: Sebastian Knödel, contact@sekond.de.

What is processed, and why

To deliver a page, the hosting provider necessarily receives and logs standard request metadata — in particular your IP address and browser user-agent. This is used only to serve the pages and keep the site secure and available. Legal basis: our legitimate interest in delivering and securing the site (Art. 6(1)(f) GDPR). Beyond the optional assistant account and the stored questions described below, Wattlas keeps no data store of its own.

Recipients & international transfer

The site is hosted on Google Firebase Hosting, operated by Google LLC in the USA, which processes the request metadata above to serve the content. If you opt in to analytics, Google additionally processes your usage data via Google Analytics (see below). If you use the assistant — signed in or not — Google also receives your question text and the page's public data through its Gemini API, on every question, in order to generate the answer; and if you sign in, Google separately processes your sign-in through Firebase Authentication. If you send the contact form, your message passes through Google's Gmail on its way to the operator's mailbox. Each of these entails a transfer to the USA; the safeguard is the EU-US Data Privacy Framework, under which Google LLC is certified (European Commission adequacy decision (EU) 2023/1795). If you subscribe to mail or alerts, Brevo SAS (France) receives your address and the lists you chose, under its data processing agreement, with hosting in the EU. Beyond hosting, analytics, the assistant, the contact form and the mail sign-up, no other recipients receive your data.

Analytics (only with your consent)

If you accept the consent banner, Wattlas uses Google Analytics 4 (provider: Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland; measurement ID G-5FNHRWGTHK) to understand aggregate usage — pages viewed, approximate region, and device/browser type. It sets analytics cookies (e.g. _ga) and processes your IP address (minimised) and a random client identifier; Google advertising signals and ad personalisation are disabled. Legal basis: your consent (Art. 6(1)(a) GDPR and § 25 TDDDG). You can withdraw consent at any time via “Cookie settings” in the footer or by declining the banner — withdrawal takes effect immediately and does not affect processing already carried out. Analytics data is retained for the period configured in the Analytics property (GA4 default up to 14 months).

The Q&A assistant (only if you use it)

Ask the assistant a question and Google's Gemini API receives your question text and the page's public data to generate an answer — on every question, whether you're signed in or not. The assistant also gives every visitor a handful of free questions before it asks for more, on the views that offer it; a first-party cookie, __session, counts those anonymous questions and expires after 30 days — it identifies a browser, not a person. Once the free allowance runs out, signing in with a Google account lets you keep asking. Signing in is optional — nothing else on the site needs it — the Firebase library that handles it only loads the moment you click “Sign in”, never on page load, and it keeps you signed in between visits using its own storage in your browser until you sign out. Beside it, a one-byte first-party marker, wx_auth, notes that you signed in, so the next page you open knows to restore the session; it holds no name, email or identifier, and it is cleared when you sign out or delete the account. Signing in sends your sign-in request to Google and creates two records. The first is the quota record Wattlas keeps, holding:

• The timestamp of when you first signed in.
• Your account email, kept with the record — your daily limit is tracked by your sign-in, not by your email.
• Today's date and how many questions you've asked today, to enforce the daily limit.
• A plan field, currently always “free” — there's no paid tier yet, so it doesn't affect your limit.
• What you work on, if you chose to tell us after signing in: one optional line, asked once, kept with the record and removed with it. Legal basis: your consent (Art. 6(1)(a) GDPR); withdraw it by deleting the account or writing to the operator.

The second record belongs to Google's Firebase Authentication, which handles the sign-in itself and keeps its own user entry for you. Wattlas doesn't choose what goes in it — signing in with Google creates it. It holds:

• Your account email, and whether Google has verified it.
• The display name and profile photo URL on your Google account. The sign-in returns both whether or not this site asks for them; nothing here shows or uses either.
• The sign-in method (google.com) and the account identifier Google issued for it.
• When you first signed in and when you last signed in.

What Google does with a question once it reaches the Gemini API is governed by Google's terms for that service, not by Wattlas. Legal bases, one per thing (what Wattlas itself keeps of a question is a separate matter, set out below): sending your question to Gemini and showing you the answer rests on our legitimate interest in providing the feature you asked for (Art. 6(1)(f) GDPR) — that covers anonymous visitors and signed-in ones alike, since nothing is sent until you press Ask; the account and quota record rests on performing the contract you're using (Art. 6(1)(b) GDPR); and the anonymous trial counter rests on our legitimate interest in keeping a free service from being abused (Art. 6(1)(f) GDPR). When you're signed in, the assistant panel shows which account you're using, so a shared browser can't leave you asking as someone else. Delete your account any time from the assistant panel: deletion removes your quota record first, then your sign-in — if the second step fails, you'll see an error rather than a silent partial deletion, and you can try again.

What Wattlas keeps of your questions

Wattlas stores the questions people type into the assistant and the answers it gave back. That is new: until recently none were kept, and nothing asked before the change was added afterwards. Each stored question holds seven things:

• The question you typed, and the answer you were shown.
• Which view you were on, and how it was set — the zone or chart mode the page was showing.
• Whether you were signed in. Yes or no, never who.
• When it was asked.
• A random number that ties the questions asked in one visit to each other — the next paragraph says what it is, and what it cannot do.
• Which of the site's data series the answer drew on, and how many of its figures could not be traced back to them — a note about the answer, never about you.
• Whether the answer helped, if you said, and what you were looking for, if you told us. Kept the same 90 days, stripped of contact details the same way.

What it does not hold is anything saying the question was yours: no name, no email address, no account identifier, no IP address. The random number is stored with each question so that the ones asked in a single visit to a single page can be read as a thread — a follow-up as a follow-up, rather than as a stranger's question. The page invents it the moment you ask the first one. It is never written to your machine and it does not outlive the visit in your browser — close the page and it is gone, load it again and you get a new one. Nothing lines up what you asked today with what you asked last week, and nothing is meant to.

The questions and answers are deleted within 90 days of being asked. What outlives them is a monthly tally: how many questions each view got, how far the follow-ups ran, and which words came up most. That word list is the one thing you typed that is kept for good, and it is kept one word at a time — never a phrase, never a whole question — and only a word that at least three separate visits used. A separate visit is not necessarily a separate person: the random number above starts again on every page load, so one reader coming back counts as more than one.

The point of keeping them is to see which questions a page failed to answer, which is the clearest signal there is that an explanation is not working; to read the answers back and check they hold up, since this site is only worth reading if its numbers are right; and to see what was being asked if the assistant ever hits its cost limit. Legal basis: our legitimate interest in those three things (Art. 6(1)(f) GDPR). You can object to it under Art. 21 GDPR — write to the operator at contact@sekond.de.

One consequence has to be said plainly rather than dressed up. Because nothing in a stored question points back to you, we cannot find yours in order to delete them: there is no identifier to look them up by, and Art. 11 GDPR does not oblige us to keep one so that we could. What we can tell you is what happens anyway — every stored question and answer goes within 90 days, and what outlasts them holds no sentence you wrote, only single words, and only ones that at least three separate visits used. So please do not type personal details into a question. There is no reason to: everything you type is sent to Google, and some of it is now kept here for a while as well. Obvious contact details are stripped from the question you typed and the answer you were shown before either is stored — an email address, an international phone number, an IBAN each become [redacted] — but that catches shapes, not meanings. It will not catch “our flat in Leipzig”. Leave it out.

The contact form (only if you send it)

The form on the Contact page sends your email address, your message, your name if you give one, and the view you came from if you followed a link from one. It is sent once, as an email, through Google's Gmail to the operator's mailbox so they can reply. Two copies exist after that: the one in the operator's mailbox, and one in the sent mail of the Gmail account the form sends from, which is used for nothing else. Wattlas keeps no other copy and stores nothing in your browser. Legal basis: answering the request you sent (Art. 6(1)(b) GDPR), or our legitimate interest in replying to it (Art. 6(1)(f) GDPR).

Mail and alerts (only if you subscribe)

Sign up at /subscribe or on the home page and your address goes to Brevo, the mail service Wattlas uses, with the lists you chose: the monthly newsletter, the alerts for the sections you follow, or both. Nothing reaches a list until you click the link in the confirmation mail Brevo sends. Brevo keeps the address, the lists and the record of that confirmation: when you clicked and from which IP address. Brevo is Brevo SAS in France, hosting in the EU, bound by its data processing agreement with the operator. Wattlas itself keeps no copy of the address. Legal basis: your consent (Art. 6(1)(a) GDPR; § 7(2) UWG for the mail itself). Every mail carries an unsubscribe link, which stops what you chose; a line to contact@sekond.de erases the address completely.

Retention

Your assistant account — both records above — is kept for as long as the account exists, and no longer: there is no fixed expiry, because the account only exists while you want it to. Delete it from the assistant panel and both go straight away; you can also ask the operator to erase it. The question count in it is overwritten each day rather than added up, so no record of what you asked, or how often, accumulates. The anonymous trial cookie expires 30 days after your last question — asking another one renews it, so it doesn't just count down from when it was first set. The questions and answers described above are deleted within 90 days of being asked; the monthly tally that replaces them is kept for good, and the only text in it is single words that at least three separate visits used — never a phrase, never a whole question. Wattlas retains nothing else of its own. The host's request logs, and analytics data if you opted in, are kept for the periods set out in Google's own policies (for analytics, up to 14 months). A message sent through the contact form is kept, in the operator's mailbox and in the sent mail of the form's own account, until the enquiry is closed. If you subscribe to mail or alerts, Brevo keeps your address and the lists you chose until you unsubscribe. After that it keeps the address only on its list of addresses never to be mailed, so nothing more is sent; a line to contact@sekond.de erases it completely.

Your rights

You have the right of access, rectification, erasure, restriction of processing, and to object to processing. To exercise them, contact the operator at contact@sekond.de. The stored questions described above are the one thing erasure cannot reach: they carry nothing identifying who asked, so they cannot be singled out (Art. 11 GDPR), and they expire on their own within 90 days. You also have the right to lodge a complaint with a data-protection supervisory authority — for this site, the Landesbeauftragte für den Datenschutz und die Informationsfreiheit (LfDI) Baden-Württemberg.