PRIVACY

1. Controller

Patrick Brockhaus
Kätinger Mühlenweg 42b
28816 Stuhr
Germany
E-Mail: hello@onlyabutton.com

2. Concept and principles

Only a Button is a free, non-commercial social experiment on the internet. There are no user accounts, purchases, payments, advertisements or newsletters. No analytics, marketing or profiling services are used, and personal data is not sold.

3. Accessing the website

When the website is accessed, the hosting provider Hostinger processes technically necessary connection and log data, in particular the IP address, time, requested resource, browser information and access status. This is required to provide the website securely, reliably and without errors. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is the secure operation of the project.

4. Starting and voting

When a battle is started, a two-letter country code is stored. When voting, the battle, selection (attack or defend), time, country code and a pseudonymous visitor verification value are stored. The application determines the country code server-side from the IP address technically required for the connection and a locally embedded GeoIP database. No location request is sent to an external service, and the IP address is not stored in the battle database.

To allow only one vote per battle, the website sets the technically necessary HttpOnly cookie “oab_visitor”. It contains a random identifier and is valid for up to one year. Only a SHA-256 verification value derived from it is stored in the battle database. The cookie is not used for advertising or tracking across other websites.

To limit automated or abusive requests, pseudonymous rate-limit verification values are temporarily derived from the visitor identifier or network address. The source data is not stored in the rate-limit table. Expired verification values are removed during subsequent requests.

This processing is necessary to run the experiment, count votes correctly, display aggregated country statistics and prevent abuse. The legal basis is Art. 6(1)(f) GDPR.

In the live ticker, visitors can voluntarily publish a publicly visible name and message. The battle reference, submitted name, message, time and pseudonymous visitor verification value are stored. Do not use real names or personal information that should not appear publicly. The most recently entered ticker name is stored locally in the browser (Local Storage) so it does not have to be entered again; it can be removed by clearing the site data.

5. Community invitations

Visitors may voluntarily create a publicly visible community name and invitation link. The community name, link name, a verification hash of the random invitation code, creation time and status are stored. When joining, the website sets the technically necessary signed HttpOnly cookie “oab_community” for up to 30 days. It contains the community and invitation references and the expiry date. When voting, this attribution is permanently stored with the vote and used only for aggregated community statistics and battle reports. It changes neither the choice nor the weight of a vote.

Community names are user-generated statements and do not constitute verification or an official relationship with an organisation or brand. Community attribution can be ended for future votes by leaving the community; historical attribution already stored remains unchanged to preserve the integrity of battle reports.

6. Service providers and transfers

The website is hosted by Hostinger. Structured battle and voting data is processed through Supabase. Both providers act as part of the commissioned technical provision. Depending on the infrastructure, subprocessors and processing outside the EU/EEA may be involved; the safeguards provided by the respective provider apply, in particular appropriate standard contractual clauses.

Hostinger privacy policy · Supabase privacy policy

7. Retention

Technical server logs are deleted according to the hosting provider’s settings and retention periods. Rate-limit verification values are intended only for the respective protection window. The visitor cookie expires after no more than one year and the community cookie after no more than 30 days. Battle, voting, ticker, community and aggregated statistical data generally remains stored to preserve the public history and integrity of the experiment. It is deleted, archived or anonymised when no longer required for these purposes or where a prevailing legal obligation applies.

8. Your rights

Subject to the statutory requirements, you have rights including access, rectification, erasure, restriction of processing, data portability and objection. You may also lodge a complaint with a data protection supervisory authority under Art. 77 GDPR, in particular the State Commissioner for Data Protection of Lower Saxony.

Privacy requests: hello@onlyabutton.com
Supervisory authority complaint form

Last updated: 28 July 2026