Privacy Policy

Controller

Johann Philipp Strathausen
Berlin, Germany

Contact: hello@candleforrest.com

Data we collect

When you use CandleForrest, we may collect the following data:

• Email address (for account creation and sign-in)
• Display name and profile image
• Comments, reactions, and video submissions you make
• Lists and curated content you create

Legal basis for processing

We process your data based on:

• Consent (Art. 6(1)(a) GDPR) — when you create an account and agree to this policy
• Contract (Art. 6(1)(b) GDPR) — to provide you with the service you signed up for
• Legitimate interest (Art. 6(1)(f) GDPR) — to maintain platform security, prevent abuse, and improve the service

Cookies

We use a single session cookie to keep you signed in. This cookie is essential for the service to function and does not track you across websites. We do not use any tracking cookies or advertising cookies.

Analytics

We use Plausible Analytics, a privacy-friendly analytics tool hosted in the EU. Plausible does not use cookies, does not collect personal data, and does not track you across websites. All data is aggregated and anonymous.

Third-party services

We use the following third-party services to operate the platform:

• Resend (US) — for sending sign-in emails. Your email address is shared with Resend to deliver one-time passwords.
• OpenAI (US) — for AI processing of video content. Submitted YouTube video transcripts and metadata are sent to OpenAI for summarization and content moderation.
• Vercel (US) — for hosting the platform. Request data is processed by Vercel's infrastructure.

Where data is transferred to the US, appropriate safeguards are in place through EU Standard Contractual Clauses (SCCs).

Data retention

We retain your data for as long as your account is active. When you delete your account, your personal data is deleted. Some content (e.g., anonymized comments) may be retained for platform integrity.

Your rights under GDPR

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate personal data
• Request erasure of your personal data
• Request data portability
• Object to processing of your personal data
• Withdraw consent at any time

To exercise any of these rights, contact us at hello@candleforrest.com.

Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin
www.datenschutz-berlin.de