Privacy Policy

This policy covers the dashboard at bernwald.net and the application “Streitbar Publisher” it contains. A German version is available under Datenschutzerklärung; in case of doubt, the German version prevails.

1. Controller

The controller responsible for data processing under the GDPR is:

Thomas Bernwald
Am Eichelgarten 50
90602 Pyrbaum
Germany
E-Mail: thomas@bernwald.net

2. What this is about

Streitbar Publisher is the publishing tool of the podcast “Streitbar”. It is used to plan episodes and short clips and to publish them on YouTube, Instagram and TikTok. Members of the Streitbar team sign in with an account created by invitation; there is no public sign-up. Every member connects their own platform accounts and publishes only to those accounts.

3. Visiting the website

When you visit the website, the hosting provider processes technically necessary data (IP address, time, requested address, browser identifier) in server logs in order to deliver the page and fend off attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). There are no advertising or analytics trackers.

4. Sign-in

For sign-in, the email address and a password hash are stored and a technically necessary session cookie is set (Art. 6(1)(b) and (f) GDPR). In addition, the browser stores display settings (e.g. light/dark theme) locally.

5. Connected platforms (YouTube, Instagram, TikTok)

When a user connects an account via OAuth, the application receives an access token from the respective platform. Only the following data is processed:

• the access and refresh tokens and the permissions granted,
• basic information about the connected account (account/channel ID, display name),
• the content the user created and wants to publish (video, title, description, hashtags, thumbnail, publishing time),
• publicly available metrics of the user’s own posts (e.g. views, likes) as well as public search and trend data of the platforms, used to suggest suitable hashtags.

This data is used solely to publish and evaluate the user’s own content on the user’s own accounts. It is not sold, not used for advertising and not shared with third parties other than the respective platform itself. The legal basis is Art. 6(1)(b) and (f) GDPR.

YouTube

The application uses the YouTube API Services. The YouTube Terms of Service and the Google Privacy Policy apply in addition. Access can be revoked at any time at myaccount.google.com/permissions.

Instagram / Meta

The Instagram Privacy Policy applies. Access can be revoked in the Instagram app under Settings → Apps and websites.

TikTok

The application uses TikTok Login Kit and the Content Posting API. It requests the scopes user.info.basic (display name and avatar of the connected account), video.upload and video.publish (posting a video the user has reviewed and approved), and — where enabled — user.info.stats and video.list (follower count and metrics of the user’s own videos). Before every post, the user sees a preview and the target account, chooses the privacy level and the interaction settings, and confirms TikTok’s Music Usage Confirmation. The TikTok Privacy Policy applies. Access can be revoked in the TikTok app under Settings and privacy → Security → Apps and services.

6. Deletion of data

If a connection is removed in the dashboard or revoked at the platform, the associated tokens are deleted or become unusable. Stored metrics are deleted once they are no longer needed. Original videos for short clips are deleted automatically after 30 days at the latest. Deletion of all data can be requested at any time by email to thomas@bernwald.net; it is carried out within 30 days.

7. Service providers (processors)

• Vercel Inc., USA – hosting of the application (EU-US Data Privacy Framework, standard contractual clauses)
• Supabase Inc. – database and storage of published media files (podcast audio, short clips), server location London (UK adequacy decision)
• Hetzner Online GmbH, Germany – server for processing the original videos (cutting short clips, podcast audio)
• OpenAI and Anthropic, USA – transcription and text drafts for the podcast’s own content (EU-US Data Privacy Framework or standard contractual clauses)
• STRATO GmbH, Germany – domain and DNS

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Please contact the address above. You also have the right to lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.