Privacy Policy

Last Updated: March 24, 2026

1. Data Controller & Contact Information

The entity responsible for this website (the "data controller") is:

Lorenz Nimmervoll
Gruberstraße 5, Top M407
4020 Linz, ÖSTERREICH
Email: office@nimmervoll.work

For any privacy-specific concerns, you can contact our designated privacy officer at the same address.

2. What Information We Do Not Collect

To maximize your privacy, we have intentionally designed this website to avoid collecting personal data. We do not use:

Cookies: We do not place any cookies on your browser.
Local or Session Storage: We do not store any information in your browser's local or session storage.
Analytics: We do not use any analytics services to track your behavior.
Accounts or Profiles: You cannot create an account or user profile on this website.

3. Information You Voluntarily Provide

The sole function of this website is to allow users to submit anonymous text-based confessions.

Anonymous Confessions: When you submit a confession, the text is stored in our database. We have designed the submission process to be untraceable, meaning the text you submit is not linked to your identity in any way. Please do not include any personal information (like names, addresses, or any other identifying details) in your confessions.

4. Legal Basis for Processing and Data Retention

The legal basis for processing this anonymous data is our legitimate interest in operating an online platform for sharing anonymous experiences and content.

Anonymous confessions are stored in our database for a period of up to five (5) years from the date of submission. After this period, they will be permanently deleted from our systems.

5. Third-Party Services & Data Storage

This website is hosted on Amazon Web Services (AWS) and utilizes the following services:

Amazon S3 and CloudFront: For hosting and delivering the website content.
Amazon DynamoDB: For storing the anonymous confession text.
Amazon CloudWatch: For monitoring, metrics, and log aggregation related to the operation and security of the service.

All data and services are located within the eu-central-1 (Frankfurt, Germany) region. AWS acts as our data processor and is responsible for the physical security of the infrastructure.

5a. Amazon CloudFront (CDN)

We use the Amazon CloudFront Content Delivery Network (CDN), provided by Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg (AWS), to increase the security and delivery speed of this website. This processing is based on our legitimate interest in secure and efficient content delivery (Art. 6(1)(f) GDPR).

A CDN is a network of distributed servers that can deliver content to website users in a technically optimized way. For this purpose, AWS may process personal data in technical server log files as our processor. This can include your IP address, the requested URL, date and time of access, user agent, referrer, and an internal request identifier. We do not use cookies or browser storage in connection with CloudFront.

Recipient and location: AWS is the recipient of the data and acts as our processor. We configure CloudFront to serve content from EU-based edge locations and to process and store data within the EU/EEA to the extent technically possible and appropriate for operating the service.

Necessity: The processing described in this section is neither legally nor contractually required. However, without CloudFront the full functionality, stability, and performance of the website cannot be guaranteed.

Objection: You have the right to object to this processing. Whether an objection is successful must be determined based on a balancing of interests in the individual case.

Retention: We do not enable CloudFront access logs on our side. AWS may retain short-lived technical service logs as necessary to operate and secure the CDN according to AWS policies.

Further information and AWS GDPR commitments can be found here: AWS Privacy Notice and here: AWS GDPR DPA.

5b. Amazon CloudWatch (Monitoring & Logs)

We use Amazon CloudWatch, provided by Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg (AWS), to collect and view technical logs, metrics, and alerts required to operate and secure this website. This processing is based on our legitimate interest in ensuring reliability, security, and performance (Art. 6(1)(f) GDPR).

What is collected: CloudWatch receives machine-generated technical events from our backend and infrastructure components. Depending on the event, these logs can contain timestamps, request paths/URLs, internal identifiers, error messages/stack traces, performance metrics, and IP addresses included in standard HTTP access logs or upstream service headers. We do not use CloudWatch for user profiling, and it does not place cookies or use browser storage.

Recipient and location: AWS is the recipient of the data and acts as our processor. We configure CloudWatch to store logs and metrics in the EU (Frankfurt, eu-central-1) region.

Necessity: The processing described in this section is neither legally nor contractually required. However, without CloudWatch, we cannot adequately ensure system reliability, incident response, or abuse prevention.

Retention: We retain CloudWatch log groups and metrics only for limited periods necessary to operate and secure the service, after which they are automatically rotated and deleted according to defined retention policies.

Objection: You have the right to object to this processing. Whether an objection is successful must be determined based on a balancing of interests in the individual case.

Further information and AWS GDPR commitments can be found here: AWS Privacy Notice and here: AWS GDPR DPA.

6. International Data Transfers

We explicitly state that no data is transferred outside the European Economic Area (EEA). All data processing and storage occurs within the AWS Frankfurt region.

7. Your Rights Under the GDPR

Under the General Data Protection Regulation (GDPR), you have certain rights regarding your personal data. We are obligated to inform you of these rights, which include:

The right to access: You have the right to request copies of your personal data.
The right to rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
The right to erasure (the "right to be forgotten"): You have the right to request that we erase your personal data, under certain conditions.
The right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
The right to object to processing: You have the right to object to our processing of your personal data, under certain conditions.
The right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

Important Limitation: Because we do not collect any personal information that could identify you, and the confessions submitted are anonymous and untraceable, it is not technically possible for us to identify, access, rectify, or erase data associated with a specific individual. We hold no mechanism to link a submission back to you.

Despite this technical limitation, if you have any questions or concerns about our privacy practices, you have the right to lodge a complaint with a supervisory authority in your country of residence.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. Any changes will be posted on this page, and the "Last Updated" date at the top of this policy will be revised. We encourage you to review this policy periodically. Your continued use of the website after any changes are posted will constitute your acceptance of such changes.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: OFFICE@NIMMERVOLL.WORK

Privacy Policy.