Handzeichen

Privacy policy

As of: November 2026. This is a translation for convenience; the German version is the legally binding one.

1. Controller

Maximilian E. Herrmann, Lotter Straße 25, 49078 Osnabrück, Germany
Email: contact@maximilianherrmann.com

2. The essentials in brief

3. Visiting the website

When you visit, the web server stores technically necessary access data (server logs): IP address, date and time, requested URL, status code, amount of data transferred, browser and operating system, and the referrer URL. They serve secure and error-free operation and are not combined with other data. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest). The logs are deleted after 30 days at the latest.

The IP address is also used briefly in memory to limit abuse (request limits, counting views at most once per hour). It is not stored permanently for this purpose.

4. Voting as a participant

When you vote, your answers are stored, and on free-text slides (word cloud, ideas, questions) also the text you enter. Please do not enter personal data there. No name is asked for. To prevent anyone from voting several times, a random device ID is created:

These are technically necessary to keep voting fair and to remember your language choice. The legal basis is § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR. Answers cannot be attributed to individual persons by the host. Answers in presentations are deleted together with the presentation.

5. Account for hosts

You create an account yourself with a username and password. No email address is needed. When you register, your IP address is only used briefly in memory for a rate limit. Stored are the username, a password hash (never the password itself), expiry date, creation date, and your presentations, folders and uploaded images. With Pro, if you add them: your logo and accent colour (participants see both in your presentations) and custom links for presentations. Logos for QR codes stay in your browser and are not uploaded. Optionally, you can add a profile picture (your own photo or an illustration), a display name, a short bio and a link in the settings; these are visible on your public profile and on your published presentations. After a username change, the old name stays reserved for your account for 90 days so old links redirect. The legal basis is Art. 6 (1) (b) GDPR (use of the service). In the settings you can download your data as a JSON file at any time (Art. 20 GDPR) and delete your account with its content yourself; an email also works.

Storage period: Presentations in your account (free or Pro) stay stored until you delete them or your account. They are not deleted automatically. If an account has an expiry date (only for accounts set up for a limited time), its presentations can no longer be used afterwards but stay stored until the account is deleted. Presentations with an active Event Pass stay usable during that time. Without an account: drafts that are not claimed are deleted 7 days after they were created; guest copies of templates, quick polls and anonymous API presentations 30 days after their last use; demo rooms after 12 hours.

6. Published presentations and open polls

Presentations you publish in the library are visible to everyone, with your account name as the author. In open polls the results are visible to everyone as bars. Word clouds are not included in open polls. Idea slides are included only if the poll's owner switches them on. Others then see a text only after the owner has approved it. If you switch on “Share results by link” for a presentation, a page with summarised results (bars, averages) is visible to everyone with the link. It contains no names, word clouds or free text. You can switch it off again at any time.

7. PowerPoint import and “Generate here” (AI features)

Only for enabled Pro accounts. When you upload a presentation or enter a description in the “Create with AI” dialog, this text is sent to the service OpenRouter (OpenRouter, Inc., USA) and from there to an AI model provider in order to create poll slides from it. Please do not upload presentations containing personal or confidential data. The legal basis is Art. 6 (1) (b) GDPR; the transfer to the USA relies on EU standard contractual clauses. The file itself is not stored permanently.

AI summary. Also only for Pro accounts, and only when the host explicitly clicks “Summarize now” in a Handzeichen: the questions and counted results of that Handzeichen as well as its free-text answers, ideas, words and audience questions are sent to OpenRouter (OpenRouter, Inc., USA) and from there to an AI model provider in order to create a summary. Participant IDs, device or IP data, names and aliases from scheduling slides and rating comments are not sent. Answers in Handzeichen are anonymous; anyone who types names into a free-text answer shares them. The legal basis is Art. 6 (1) (f) GDPR (the host’s legitimate interest in evaluating the results); the transfer to the USA relies on EU standard contractual clauses. The summary is stored with the Handzeichen and deleted with it, immediately when all results are cleared; the host can delete it at any time.

7a. Interface for AI assistants (API)

Presentations can also be created via a programming interface, for example by an AI assistant you use yourself. Without an API key, an anonymous presentation is created that is deleted automatically after 30 days without use. With an API key it belongs to your account. Of API keys I only store an irreversible hash, a short prefix, the name and the creation and last-use dates. You can revoke keys at any time in the settings. What content your AI assistant sends to Handzeichen is decided by you or your assistant; Handzeichen itself does not call any AI service in the process. The legal basis is Art. 6 (1) (b) GDPR.

7b. Embedded videos (YouTube, Vimeo)

Presentations can contain videos from YouTube (Google Ireland Limited, Ireland) or Vimeo (Vimeo.com, Inc., USA). They are only loaded when you click “Load video” (two-click solution). Before that, no connection to these providers is made, not even for a preview image. After the click, the provider receives technical data such as your IP address, browser details and the page you are on, and may set cookies. YouTube is embedded via youtube-nocookie.com, Vimeo with the “dnt” (do not track) parameter. The legal basis is your consent by clicking (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). It only applies while the page is open, and you can withdraw it at any time by reloading the page. Transfers to the USA are covered by the EU-US Data Privacy Framework. See the privacy notices of Google and Vimeo for details.

7c. Link previews (link cards)

When creating a presentation or quick poll, you can add a link, e.g. to a news article, as a card. To do this, the server of this website fetches the page once, reads the title, source and preview image and stores the preview image on the server in Germany. When the card is shown, your browser loads nothing from the linked site, so no connection and no IP address of participants goes there. Only when you click the card does the linked site open in a new tab, and its privacy policy then applies. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a data-saving preview).

Scheduling polls

In a scheduling poll (/termin) you enter a name or nickname so everyone can see who is available when. Your name and answers are visible to everyone with the link; no email address is requested. So that you can change your entry later, your browser stores a key for it (localStorage, not a cookie). The person who created the poll can delete entries. We delete every scheduling poll automatically 14 days after the last proposed or chosen date, at the latest 60 days after the last activity. The legal basis is Art. 6 (1) (b) GDPR (providing the feature you use).

“Find a date” slide in a Handzeichen: you say when you are available. The purpose is to find a shared date. A name or nickname is always optional and doesn't have to be your real name. Without a name, your choice only counts in the numbers. We store only your choice and, if you enter one, the name. We do not store your IP address or device data with it. If the slide asks for names, everyone in this Handzeichen sees the name and your choice. You can change or delete your entry on your device at any time, and the person who created the Handzeichen can delete entries. Everything is deleted with the Handzeichen or when its results are reset. The legal basis is your consent by entering it voluntarily (Art. 6 (1) (a) GDPR). There are no third parties and no trackers involved.

8. Contact by email

If you write to me, I store your email address and the message in order to process your request. I do not pass them on and delete them once the matter is settled. The legal basis is Art. 6 (1) (b) or (f) GDPR.

The same applies to the “Reserve / request a quote” form on the pricing page: I store the plan, name, email address, optionally company and message on the server in Germany in order to reply or send you a quote. No email is sent automatically and nothing is passed on to third parties. I delete the details once the request is settled, at the latest after 12 months without a contract. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual request).

9. Hosting and encryption

Handzeichen runs on a server operated by me at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Germany. A data processing agreement under Art. 28 GDPR exists with Hetzner. The connection is encrypted via HTTPS (TLS).

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Simply write to contact@maximilianherrmann.com. You can also lodge a complaint with a supervisory authority. The competent one is the State Commissioner for Data Protection of Lower Saxony.

11. Changes

I will adapt this policy if features or the legal situation change. The version published here applies.