Privacy policy
This is a translation; the German version is authoritative.
In short
- No cookies, no tracking, no analytics tools, no ads.
- The site loads nothing from third-party servers; fonts and graphics are hosted on our own server.
- We don't ask for your name, email or photo.
- We only store what is needed to report a sock – and only for as long as needed. Exception: your sock story, if you agree to its publication (section 3a).
- Wallet addresses and transactions on the blockchain are public and permanent (see section 6).
1. Controller
Benjamin Beelitz
Kuseler Str. 36, 66869 Kusel, Germany
Email: project-socke@mailbox.org
No data protection officer has been appointed; a private project without employees is not required to have one (Art. 37 GDPR, § 38 BDSG).
2. Hosting and server logs
The website and its backend run on Microsoft Azure (Azure Static Web Apps). The pages themselves are delivered via Microsoft's global delivery network; the backend parts that process your report run in the data centre region USA (East US 2). When you visit, Microsoft processes technically necessary data, in particular your IP address, date and time, the requested page and browser details, to deliver the site and protect it against attacks. Legal basis: Art. 6(1)(f) GDPR (secure, stable operation).
Microsoft is our processor; the data processing agreement is part of the Microsoft product terms (Data Protection Addendum). Contracting party: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Because your report is processed in the USA, this data is transferred to the USA. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Microsoft is certified (Art. 45 GDPR). We have no access to these server logs and do not analyse them. How long Microsoft keeps them is decided by Microsoft; we have no influence on it.
3. “Report sock” form
| What | Why | How long |
|---|---|---|
| Wallet address, quiz answers, optional sock story, chosen language, time | Checking the report and sending 1 SOCKE to this address | Until processed (sent or rejected), at most 30 days |
| Encrypted fingerprint (HMAC) of the wallet address and time of the last report | At most one report per wallet per week | 7 days |
Without a secret key known only to the server, the fingerprint cannot be traced back to the wallet address. Data is stored in Azure Table Storage in the EU, region Germany (Frankfurt, “Germany West Central”). Please don't put names or addresses into your sock story.
Required or optional? The wallet address, the quiz answers and the 18+ confirmation are needed to report a sock; without them we cannot send SOCKE. The sock story and the consent to publish it are optional. There is no legal or contractual obligation to provide any data.
Legal basis: Art. 6(1)(b) GDPR (processing your report) and, for the weekly limit, Art. 6(1)(f) GDPR (preventing abuse).
3a. Sock stories (only with consent)
If you tick “My story may appear …”, the operator may publish your sock story on the “Sock stories” page after review. Only the following is published and stored for this purpose: the text of the story, your three quiz answers, the chosen language and the month of the report. Your wallet address and the exact time are not published or stored for this purpose; the published story is not linked to your report. There is no entitlement to publication.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future – a short message to the email address above quoting the story is enough (no wallet address needed, since the story is not linked to it). The story will then be removed. Unless withdrawn, it stays stored as long as the site exists. Please don't include names, places or other details that could identify you or others.
4. Abuse protection
- IP limit: To prevent too many reports from one connection, your IP address is briefly processed in the server's memory – only as an encrypted value with a changing random key, for at most one hour, never written to disk and never logged.
- Emergency brake: Only the total number of requests per hour is counted – no IP address, no wallet. If there are too many requests, the site temporarily closes itself.
- Invisible field: A form field invisible to humans detects automated submissions.
Legal basis: Art. 6(1)(f) GDPR.
5. Notifying the operator
When new reports arrive, the operator receives a push notification on their phone. It contains only the number of pending reports – no wallet address, no story. Reports are processed in a protected area that only the operator can access after logging in. A human, not a machine, decides whether SOCKE is sent.
6. Blockchain – public and permanent
SOCKE is a token on the public blockchain “Base”, currently on the “Base Sepolia” test network. A test network is public too: entries there are just as visible to everyone and permanent as on the main network. If you receive SOCKE, the transfer to your wallet address is recorded there, visible to everyone and permanently. Nobody can delete or change these entries – not even us. The right to erasure (Art. 17 GDPR) cannot technically be applied to blockchain entries.
If you don't want your wallet to be linked to SOCKE, use a separate wallet or don't take part.
7. Sock rate and sock counter
To show the sock rate and sock counter, our server queries public balances of the SOCKE contract from a public Base node (currently sepolia.base.org for the Base Sepolia test network, mainnet.base.org after a switch to the main network). No visitor data is transmitted; your browser does not contact this service.
8. Wallet guide and sticker
- The buttons “Add Base” and “Show SOCKE in wallet” only talk to the wallet extension or app on your device. The site does not read any accounts or addresses. Your wallet may contact its own servers; its privacy policy applies to that.
- The personal sticker is created only in your browser. Nothing is uploaded or stored. When sharing, you decide where the image goes.
9. Links to other sites
Links to the block explorer Basescan lead to third-party sites, where their operator's privacy policy applies. Our links do not send referrer information.
9a. Donations
The link “Chip in for detergent” leads to PayPal (paypal.me), provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Only if you donate there does the provider process your data under its own privacy policy. Our site loads nothing for this and transmits no data.
When you donate, the payment service gives us your name, possibly your email address, the amount and any message. We use this only to process the donation and don't store it outside PayPal. It stays in the PayPal account as long as statutory retention rules require (up to 10 years, § 147 German Fiscal Code), otherwise we delete it once the donation is complete. Legal basis: Art. 6(1)(b) and (c) GDPR. A donation has no effect on reports – you get no SOCKE for it.
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Contact the email address above and include your wallet address – that is the only way we can find your report. You can withdraw any consent you have given (sock stories, section 3a) at any time with effect for the future.
Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR – server logs, weekly limit, abuse protection), you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless there are compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal message to the email address above is enough.
You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz), Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.
11. Age
Participation is only allowed from age 18.
12. Contact by email
If you email us (e.g. to withdraw consent, request access or ask a question), we process your email address, your name if given, and the content of your message to answer your request. The legal basis is Art. 6(1)(c) GDPR where your data protection rights are concerned, otherwise Art. 6(1)(f) GDPR (answering enquiries). We delete the message once your request is settled; records of handled data protection requests are kept for up to three years (limitation period). Our mailbox is hosted by Heinlein Hosting GmbH (mailbox.org), Berlin, which processes the messages as a processor under an agreement pursuant to Art. 28 GDPR; the data stays in Germany.
13. Encryption
The site can only be reached over an encrypted connection (HTTPS/TLS), so data you send to us cannot be read by third parties in transit.
14. Changes to this privacy policy
We update this policy when the site or the law changes. The version published here applies.
Last updated: 18 October 2026