Controller
The controller for data processing within the meaning of the GDPR is:
Martin Purgat
[email protected]
Last updated
Basics
By default, WieGesagt sets only technically necessary cookies, for login and security. Your settings stay locally in your browser (localStorage). The law treats this the same as a cookie, but technically it is leaner. You decide whether optional features such as session recording are switched on. This page shows what is stored where and how you can control it at any time.
Controller
Martin Purgat
[email protected]
What is stored where
EntryPurposeRetention period
Required
Essential storage
These entries are the foundation of the site. Without them, login, consent management and uploads would not work. They cannot be switched off.
Legal basis
Legitimate interest (GDPR Art. 6(1)(f)) and Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). The storage is technically necessary.
| Entry | Purpose | Retention period |
|---|---|---|
| cookie_ | Stores your consent choice (localStorage) | 12 months |
| access_ | Login session (HttpOnly cookie, not readable by scripts) | 15 minutes |
| refresh_ | Extends the session (HttpOnly cookie, path /api/auth) | 7 days |
| csrf_ | Protection against cross-site request forgery (readable by scripts) | 7 days |
| konversation_ | Remembers that you agreed to your voice being sent for real-time transcription (localStorage) | permanent, until you clear your browser storage |
| wiegesagt_ | Status of running uploads, with progress and file details (localStorage) | until the upload is finished or removed |
| tus::… | Address of a running upload, so that it can continue after an interruption (localStorage) | until the upload is finished (after a cancelled upload, it remains) |
| construction_ | Remembers preview access during the session (sessionStorage) | session |
| chunk-reload-once | Technical protection against endless reloading when the site is updated (sessionStorage) | session |
Cookie-free
Analytics
WieGesagt uses a privacy-friendly, cookie-free analytics service. It creates no personal profiles and does no cross-site tracking. Your IP address is sent to the service for the visitor statistics but is not stored there permanently.
Legal basis
Legitimate interest (GDPR Art. 6(1)(f)). The service sets no cookies, so no consent is needed.
| Entry | Purpose | Retention period |
|---|---|---|
| Page views | Anonymised visitor statistics | none (nothing is stored in the browser) |
| Referrer | Where you came from, without fingerprinting | none (nothing is stored in the browser) |
| Region | Country or state, derived from the IP address | none (nothing is stored in the browser) |
The analytics service uses neither cookies nor localStorage. The data cannot be traced back to any individual. The privacy policy gives the details of the data transfer.
Optional
Preferences
These entries let the site remember your theme, your playback speed and your other small preferences. Everything stays in your browser’s localStorage. Without your consent, a change only lasts until you reload the page.
Legal basis
Consent (GDPR Art. 6(1)(a)).
| Entry | Purpose | Retention period |
|---|---|---|
| theme | Dark or light mode (localStorage) | until you withdraw |
| wie-gesagt-playback | Playback settings such as speed and auto-pause (localStorage) | until you withdraw |
| wie-gesagt-audio-player | Volume, mute and playback rate (localStorage) | until you withdraw |
| wie-gesagt-subtitle-display | Font size of the subtitles and whether a word reacts to hovering or to a click (localStorage) | until you withdraw |
| wie-gesagt-privacy | Privacy preferences (localStorage) | until you withdraw |
| wie-gesagt-notifications | Notification preferences (localStorage) | until you withdraw |
| wie-gesagt-onboarding | Which introductory hints you have already seen or closed (localStorage) | until you withdraw |
Optional
Session recording
With your explicit consent, WieGesagt records your clicks, mouse movements, scrolling and the pages you visit. This helps find errors faster. It is switched off by default.
Legal basis
Consent (GDPR Art. 6(1)(a)). It is off by default, and you can withdraw it at any time (Art. 7(3)).
| Entry | Purpose | Retention period |
|---|---|---|
| Recording session | Recorded interactions (on the server) | 30 days |
| Recording storage | localStorage and sessionStorage to match a session to a visitor (no cookies) | local, until you withdraw |
What you type, your saved words, the subtitles and your pronunciation recordings are never captured.
Legitimate interest
Error diagnostics
Regardless of your consent, a heavily masked snapshot is taken only when an error occurs, with texts and media hidden. It is kept for 90 days.
Legal basis
Legitimate interest (GDPR Art. 6(1)(f)). No separate consent is needed.
| Entry | Purpose | Retention period |
|---|---|---|
| Error diagnostics session | Links a snapshot to the session in which the error occurred (sessionStorage) | until you close the tab |
Manage settings
Change your preferences at any time, even after your first choice. One click is enough, and no questions are asked.
Is your browser blocking cookies? You can manage them there as well.
Legal framework
Controller
GDPR and TKG
Under GDPR Art. 6(1)(a), the legal basis is your consent.
Under Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), cookies may only be set with consent, unless they are technically necessary.
You can withdraw your consent at any time, and the withdrawal does not affect the lawfulness of earlier processing (Art. 7(3)).
Austrian Data Protection Authority
Barichgasse 40–42
1030 Wien, Österreich