Privacy Policy

limacro is currently operated as a private Beta project by an individual person. The controller responsible for the processing of personal data on this site under the GDPR is:

Frank L.
Erlangen, Germany
Email: l76@gmx.net

limacro is a non-commercial Beta project. Once commercial Pro subscriptions launch, a full business address will be added to this notice and a separate Impressum will be provided.

Account data

When you sign up, we store your email address and an encrypted password (bcrypt hash — we never see your real password). You may alternatively sign in with a magic-link token sent to your email. We also store a boolean is_pro flag indicating whether your account has full access (currently true for all Beta members).

Usage data

Our hosting provider (Vercel) records standard server logs including IP address, user-agent, and request timestamp for the purpose of operating and securing the service. We use Vercel Web Analytics, which is cookie-less and does not track individuals across sites; it loads only after you opt in via the cookie banner.

Advertising measurement (consent-based). When you accept analytics/marketing cookies in our banner, we load Google Ads conversion tracking (gtag.js) to measure whether visits coming from our ads result in a sign-up. Until you opt in, this runs under Google Consent Mode v2 in a cookie-less mode and sets no advertising or analytics cookies. We do not build behavioural profiles and do not show ads on this site.

What we do NOT collect

• No payment data (we do not process payments during the Beta).
• No fingerprinting and no cross-site behavioural profiles.
• No data from third-party social-media platforms.
• No analytics or advertising cookies unless you opt in via the banner (see “Cookies & consent” below).

• Contract performance (Art. 6(1)(b)) — your account email is processed to provide you access to the dashboard you signed up for.
• Legitimate interest (Art. 6(1)(f)) — server logs are processed to operate, secure and debug the service.
• Consent (Art. 6(1)(a)) — analytics and ad-conversion measurement run only after you opt in via the cookie banner. You can withdraw your consent at any time with effect for the future.

We use the following sub-processors. All operate under their published terms which we have accepted on your behalf, and we have selected EU regions wherever possible.

• Supabase (Supabase Inc., USA / EU region) — stores your account email, encrypted password, and is_pro flag. Data is hosted in the EU (Frankfurt / West EU).
• Vercel (Vercel Inc., USA) — hosts the application, processes incoming requests, and provides cookie-less Web Analytics. Standard transfer based on Standard Contractual Clauses.
• Resend (Resend, Inc., USA / EU region) — sends transactional emails such as sign-up confirmations and magic links. Configured to the EU region (Ireland) for data residency.
• Cloudflare (Cloudflare Inc., USA) — DNS provider for the limacro.com domain. Handles DNS lookups only, not user data.
• Google (Google Ireland Ltd., Ireland) — provides Google Ads conversion measurement (gtag.js). Loaded only after you opt in to analytics/marketing cookies; runs cookie-less under Consent Mode v2 until then. Transfers to Google LLC (USA) are based on Standard Contractual Clauses.

We do not share data with the macro-data providers we read from (FRED / BIS). Those are read-only public sources.

Strictly necessary

We use the minimum cookies required to keep you logged in. These are strictly necessary session cookies set by Supabase Auth and do not require consent under TTDSG § 25.

Consent-based (off by default)

For analytics and ad-conversion measurement we use Google Consent Mode v2: on your first visit all such storage is set to denied by default, so no analytics or advertising cookies are set. A banner then lets you choose:

• Accept all — enables Google Ads conversion measurement (which may set cookies such as _gcl_* for conversion linking) and loads Vercel Web Analytics.
• Reject — nothing beyond the strictly necessary cookies above is set or loaded.

Your choice is stored locally in your browser (key lm-consent) so the banner does not reappear. To change or withdraw your decision, clear this site’s data in your browser; the banner will then show again on your next visit.

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — request a copy of the data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate data.
• Right to erasure (Art. 17) — have your account and all associated data deleted.
• Right to data portability (Art. 20) — receive your data in a structured format.
• Right to object (Art. 21) — object to processing based on legitimate interest.
• Right to lodge a complaint with a supervisory authority (Art. 77).

To exercise any of these rights, contact us at l76@gmx.net. We will respond within one month.

The competent supervisory authority in Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach.

Account data is retained for as long as your account exists. After account deletion, all personal data is removed within 30 days, except where retention is required by law. Server logs are retained for a maximum of 30 days for security purposes.

We may update this policy. Any material change will be communicated by email to all registered users at least 14 days before it takes effect.