1. Controller
Controller within the meaning of Art. 4(7) GDPR:
Emre Yurtbay, Ankerstraße 3, 45663 Recklinghausen, Germany
Email: datenschutz@yurtbay.dev. Further details are in the Imprint.
2. Hosting and general processing
This website is hosted on a self-operated (virtual) server; the server location is within the European Union (provider: netcup GmbH, Karlsruhe, Germany; server location: Nuremberg, Germany).
A data processing agreement pursuant to Art. 28 GDPR exists with the server infrastructure provider (netcup GmbH). No transfer to third countries takes place.
The application, email delivery (own mail server) and analytics run on our own infrastructure. No external services such as Google or Meta are used for this.
3. Server log files and technical delivery
When the website is accessed, technically necessary connection data is processed, in particular IP address, date and time of the request, requested resource, volume of data transferred, referrer and user agent (browser/operating system).
This processing is necessary to deliver the website and to ensure stability and security (in particular defence against attacks and abuse). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning service).
To limit abusive form usage, the IP address is held briefly (at most 15 minutes) in memory only for rate limiting and is not stored permanently.
4. Cookies and access to terminal equipment (§ 25 TDDDG)
This website uses no tracking, advertising or marketing cookies and integrates no services that store or read information on your device for such purposes.
Only when you actively use the community features is a strictly necessary session cookie ("better-auth.session_token") set to manage your (anonymous) session. This cookie is strictly necessary to provide the service you have expressly requested; its storage is therefore permitted without consent under § 25(2) no. 2 TDDDG. The legal basis for the associated processing is Art. 6(1)(f) GDPR.
Properties: HttpOnly, Secure, SameSite=Lax, storage period up to 30 days. No local storage or comparable technologies are used for tracking purposes.
5. Analytics with Plausible Analytics
For statistical analysis of usage we use the self-hosted, cookieless analytics software Plausible Analytics (operated on our own infrastructure at plausible.yurtbay.dev). No cookies are set, and no cross-device tracking or profiling is performed.
Aggregated usage data is processed (e.g. pages viewed, referrer, approximate origin at country level, browser/device type). The IP address is used only transiently to generate a daily-rotating, non-reversible counting value and is not stored; no data attributable to a natural person is stored.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in data-minimising, anonymous analytics without access to terminal equipment within the meaning of § 25 TDDDG). You may object to this processing at any time with effect for the future (see section 13).
6. Contact form
If you use the contact form, we process the data you provide (name, email address, message) in order to answer your enquiry. The message is delivered via our own mail server to an internal mailbox; it is not stored in a website database.
The legal basis is Art. 6(1)(b) GDPR (for contract-related enquiries) or Art. 6(1)(f) GDPR (legitimate interest in handling enquiries). The data is deleted once the enquiry has been conclusively dealt with and no statutory retention obligations apply.
7. Community tip form
When submitting a community tip, we process the nickname, optional email address, topic and tip content for review (pre-moderation) and possible publication. The submission is sent to an internal mailbox; it is not stored in a website database.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating a moderated community). Providing an email address is voluntary.
8. Newsletter (double opt-in)
For the newsletter we process your email address and the record of your consent (double opt-in: time of request and confirmation). After signing up you receive a confirmation email with a link valid for 24 hours; you are only added after confirmation.
The legal basis is Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time with effect for the future (unsubscribe link in every newsletter email or a message to us).
If an external newsletter service is connected for delivery, it acts as a processor under Art. 28 GDPR; the specific service must be named here before activation ([newsletter service/DPA, if enabled]).
9. Anonymous sign-in / user account
For community features an anonymous session or account can be created. This stores a randomly generated identifier, a technical placeholder value instead of an email address, and, for the session, the IP address and user agent. This session data serves to provide the feature and for security and abuse prevention.
The legal basis is Art. 6(1)(f) GDPR. Sessions expire after at most 30 days and are then deleted. Storage takes place in a database that is reachable only internally (not from the internet) on our own infrastructure.
10. Special categories of personal data (health data)
MomsBest is aimed at mothers, expectant mothers and relatives; in free-text input (e.g. contact and community forms, and the forum in future) users may voluntarily provide information relating to health, including mental health. Such information may constitute special categories of personal data within the meaning of Art. 9 GDPR.
We do not actively request such data and ask you not to disclose more than necessary. Insofar as you voluntarily provide such information, the processing is based on your explicit consent pursuant to Art. 9(2)(a) GDPR, which you give by submitting it and may withdraw at any time with effect for the future. Processing takes place solely for the purposes stated in this policy; such data is not disclosed to third parties.
11. Recipients and processors
Personal data is only disclosed where necessary to provide the service. The recipient acting as a processor (Art. 28 GDPR) is the server infrastructure provider netcup GmbH, with which a data processing agreement pursuant to Art. 28 GDPR exists. Email delivery and analytics run on our own infrastructure.
No transfer to countries outside the EU/EEA takes place. Any further disclosure occurs only where legally required.
12. Retention periods
- Server/connection data: briefly for security and operational purposes; rate-limiting IP at most 15 minutes (in memory only).
- Contact and community enquiries: until conclusively handled, unless statutory retention obligations apply.
- Newsletter: until consent is withdrawn or you unsubscribe.
- Anonymous sessions/accounts: at most 30 days from last activity.
- Analytics: aggregated/anonymous only, no person-identifiable storage.
13. Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on Art. 6(1)(f) GDPR (Art. 21).
You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR). To exercise your rights, a message to datenschutz@yurtbay.dev is sufficient.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular the state data protection authority competent for the controller (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Düsseldorf).
14. No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Providing certain data is partly technically necessary in order to use the respective requested feature (e.g. contact, newsletter, community).
15. Data security
Transmission is encrypted via HTTPS/TLS (including HSTS). A strict Content Security Policy, access restrictions, and encrypted, offsite-only backups are used. The application database is not reachable from the internet.
16. Status and changes
Status of this privacy policy: 19 May 2026. We update this policy when changes to processing make it necessary.
Note
No external newsletter service is currently used; it would be named here if activated in future.