Privacy

Max Ritter
An der kalten Quelle 11, 86825 Bad Wörishofen, Deutschland
mail@maxritter.net

This website is hosted by Vercel Inc. in the United States. When you access it, server logs automatically record access data: IP address, date and time, requested file, amount of data transferred, referrer and user agent.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure and stable operation of the website. The data is not combined with other sources or evaluated to identify individual people.

The installation files for macOS, Windows and Linux are provided through a public GitHub release. Your browser connects directly to GitHub only after you choose the repository link or a download. GitHub then processes information including your IP address, device and browser details, date, time and requested file. bahnsparer.de embeds no GitHub content that would establish this connection earlier.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the reliable, tamper-resistant distribution of large installation files. The provider is GitHub, Inc. in the United States. Further processing is governed by GitHub's Privacy Statement.

I use Vercel Web Analytics to see how often individual pages are viewed and Vercel Speed Insights to measure how quickly pages load for real visitors. Neither service uses cookies or stores anything on your device. The services record the page viewed, referring page, country, device type, browser and anonymous load-time measurements. Vercel derives a hash from this information and recalculates it with a new key each day, so views cannot be assigned to one person across days. Your IP address is not stored for this purpose.

The legal basis is my legitimate interest in audience measurement without personal identification under Article 6(1)(f) GDPR. The provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. You can prevent this measurement by enabling tracking protection in your browser.

I use no other analytics or tracking services on bahnsparer.de and include no advertising networks. The font is hosted on my own server; no font CDN is contacted and no connection to Google is made.

Your light or dark theme preference is stored under the key bahnsparer-theme in your browser's local storage. This value never leaves your device and I do not read it. You can delete it at any time through your browser settings.

Downloads for iPhone, iPad, Android, macOS, Windows and Linux are available without an email address. You need no Bahnsparer account and do not have to subscribe to the newsletter.

If you voluntarily subscribe to the newsletter, you will receive occasional emails about new versions, features, important project news and installation options. The complete consent text is shown before submission. Resend then sends a neutral confirmation email. The subscription is created only after you open the link in that email.

After confirmation, I store your email address, the exact consent text and its version, the request and confirmation times, and the latest newsletter version sent in Supabase. The table is accessible only with a server-side key and cannot be read or queried from a browser.

The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time with effect for the future. Newsletter subscription is voluntary and is not required to download or use the app.

For confirmation and delivery, I send your email address and the relevant email content to Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes this data as my processor. Transfers to the United States rely on the EU–US Data Privacy Framework and, additionally, standard contractual clauses. Open and click tracking remain disabled. Resend states that it retains delivery data for 30 days.

Previous platform entries are not automatically treated as confirmed newsletter subscriptions. A one-off migration message may contain a confirmation link. No further newsletters follow without that confirmation. Old platform entries are deleted after the migration is complete.

You can unsubscribe with one click in any newsletter or contact me informally. I will then delete your address from the newsletter list. Without withdrawal, I retain it only while I offer the Bahnsparer newsletter.

You need no Bahnsparer account to use the app. Saved routes, price limits, price histories, journeys and settings live on your device first. I operate no server that receives or stores your searches or this app data.

On iPhone and iPad, you can explicitly enable iCloud sync. The app then stores price alerts, journeys, saved routes and search settings in the private CloudKit database of your Apple account. Fields are transmitted in encrypted form and stored as encrypted CloudKit values. Apple processes this data under its terms, and it uses your iCloud storage. Bahnsparer operates no separate cloud server for this, and I cannot view your private database. Price histories, notification permissions, local backups and DB sign-in are not synced through iCloud. You can turn sync off or delete all Bahnsparer data on the device and in iCloud.

In the installed app, you can optionally sign in to your DB account. Sign-in opens DB's page and uses OAuth with PKCE; Bahnsparer neither reads nor stores your password. A longer-lived sign-in key remains in the device's protected key store. The app uses it to request current and past journeys directly from DB and imports readable connections into Journeys. Imported journeys remain after the DB account is disconnected. The app changes neither bookings nor your DB account. DB does not publish this journey access as an interface for third-party apps and may change or block it.

The app requests fares directly from Deutsche Bahn's systems on your device. During fare search and optional trip import, your IP address is sent to Deutsche Bahn, as with an ordinary visit to bahn.de or the DB Navigator app. Deutsche Bahn AG's privacy notice applies to that processing. On Android and iOS, your device creates notifications locally; no push messages are sent through third-party servers.

On launch and when you reopen the app, Bahnsparer uses bahnsparer.de/api/app-policyto check whether a newer app version is available. Only the platform (Android or iOS), installed app version and installation channel are sent. Routes, travel days, search options and fares are not transmitted. The response is stored on the device and the app normally waits at least 24 hours before asking again. The update check cannot lock the app. The hosting provider creates the server-log data described above, including the IP address, for this request.

If the app was installed from the App Store or Google Play, it asks once per device for a rating. The operating system shows the dialog: Google processes a Google Play rating request, and Apple an App Store request. I learn neither whether you rated the app nor how many stars you gave it. The app counts launches only on your device so it does not ask too early; this counter is removed with Delete all local data . Under Profile you can open the rating page yourself at any time.

You have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21 GDPR). You may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority. My competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

I update this notice when processing changes. Current as of 31 August 2026. The Legal notice identifies the controller.