Privacy
Visiting the website
The website is served through Cloudflare Pages. To deliver and secure the website, the hosting provider receives technically necessary connection data, in particular the IP address, requested address, time and browser information. The purpose is the reliable and secure delivery of this website; the legal basis is the legitimate interest in providing and securing it (Article 6(1)(f) GDPR).
Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Data processing may take place outside the European Economic Area. Information about safeguards, international transfers and the retention periods set by the provider is available in Cloudflare's privacy policy and Data Processing Addendum.
Registration and sign-in
An account is required for the builder, private projects and export. You can register with a username, email address and password or choose Google sign-in. We use Google's Firebase Authentication. With password registration, your password is sent directly to the authentication service; our own project database does not store a password. Firebase sends verification and password-reset emails.
Our account database processes your Firebase user ID, verified email address, username and technical account/session timestamps. With Google sign-in, Google authenticates your Google account; the authentication service may also supply profile details. We use the user ID, email address and username to associate your account. Firebase also processes connection data to provide and secure authentication. See Firebase privacy information, the Firebase data processing terms and Google's privacy policy. Processing outside the European Economic Area is possible.
The purposes are providing the account, builder and export functions you request (Article 6(1)(b) GDPR) and protecting them against abuse (Article 6(1)(f) GDPR).
Session and browser data
After sign-in, the website sets the necessary session cookie __Host-signal_studio. It contains a random ID, is sent only over HTTPS and cannot be read by page scripts (Secure, HttpOnly, SameSite=Lax). Its validity is at most one hour; reauthentication can establish a new session. Signing out invalidates that server session. The database stores only a hash of the ID. The application keeps authentication tokens in memory during use and does not permanently store credentials or new account projects in local storage.
Existing local design drafts from earlier use may still be read and preserved as unchanged original backups. These include signal-design-v2, older keys and backups with the suffix -raw-before-labels-v1. They are not automatically uploaded to an account. Import requires an explicit action in the site owner's account. No expiry is configured for these browser data; you can delete them through the browser's website-data settings.
Private projects, revisions and exports
Cloudflare D1 stores account associations, project titles, page content, design settings, file references, version numbers, timestamps, saved revisions and export references. The application checks permissions for each project; other registered users do not gain access to your private projects. An account does not permit publishing another account's central website. Technical administrators and the appointed service providers may process data as part of their tasks.
Saved revisions and exports are not overwritten by later project edits. Archiving removes a project from the active list without deleting these data. No automatic deletion period is currently configured for account, project, revision or export data. Please direct access and deletion requests to the contact above. Downloaded or shared export files are additionally within your own responsibility.
Contact form and email
When you submit the contact form, your name, email address and message, together with language and a technical request ID, are processed to handle and deliver your enquiry. Delivery uses Resend (Plus Five Five, Inc.), which also receives the recipient address and delivery metadata. Messages are delivered to the intended mailbox. For processing, international transfers and provider retention rules, see Resend's privacy policy and Resend's Data Processing Addendum. Processing in the United States is possible.
The separate email link opens your own email application. If you send a message, the information you provide is processed to handle your enquiry. For enquiries before entering a contract, the legal basis is Article 6(1)(b) GDPR; otherwise it is the legitimate interest in responding (Article 6(1)(f) GDPR). Messages are retained only for as long as handling them or legal retention obligations require.
Abuse prevention and delivery records
To limit sign-in and sending attempts, the IP address supplied by the hosting provider is processed and hashed for application-side limits. Hashing makes these data pseudonymous, not anonymous. The export contact service also stores export/request IDs, a hash of the delivery payload, timestamps, attempt counts and delivery status. Its D1 table stores no message body, sender/recipient email address or raw IP address. The message itself is nevertheless transmitted to Resend and the recipient's mailbox for delivery.
Expired application sessions and older sign-in limits are cleaned up during later sign-ins. No automatic deletion period is currently configured for export contact records and rate-limit entries. Processed request IDs are retained to prevent the same request being sent again. The purposes are protecting the service and preventing duplicate delivery (Article 6(1)(f) GDPR).
Contact functions in exported websites
An exported website includes its design and files. Its contact function continues to use the central delivery service at oneaisolution.com and works only while that service is reachable and available for the export. Submission sends the details through that service and Resend to the verified account email address of the export's creator. The export contains no mail credentials. Operators publishing an exported site must provide privacy information appropriate to their own controller role and recipients.
Fonts, images and external links
Fonts, images and presentation scripts are loaded from this website. Authentication additionally connects to Google/Firebase. We do not use analytics, advertising or social media scripts or create advertising profiles. Decorative animations run in the browser; motion can be paused and a reduced-motion presentation is provided. Project links open an external website only when clicked; those websites have their own policies.
Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests. You may lodge a complaint with a data protection supervisory authority, particularly the authority responsible for your place of residence or our location. For Neuwied, this is the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate.