Privacy Policy

This notice explains what personal data In Other Worlds collects, why, and what you can do about it. It is deliberately short and specific: it describes what the site actually does today, not what a shop of this shape might do.

Who is responsible

The data controller for this site is:

Jelte ten Holt
Aroser Allee 81
13407 Berlin
Germany

You can reach us by email at hello@inotherworlds.net, or through the contact form.

What we collect, and why

Your account. If you register, we store your name, email address and a hashed password — never the password itself. This is how we sign you in and attach your orders and preferences to you. Legal basis: performance of a contract.

Messages you send us. The contact form stores your name, email address and message, and emails a copy to us. We use it only to reply, and keep it for up to 12 months. Legal basis: legitimate interest in answering people who write to us.

Newsletter. If you subscribe, we store your email address and the time you confirmed. Every email carries an unsubscribe link. Legal basis: consent, which you can withdraw at any time.

Page analytics. We count page views with Umami, which we run ourselves on the same server as this site — no analytics company is involved, and nothing is sold or shared with anyone. It records the page you looked at, where you arrived from, your browser, operating system, device type and country, plus two things you can choose to do: subscribing to the newsletter and following the Discord link. It sets no cookies and stores nothing on your device. Your IP address is used for a moment to work out the country and to build a rotating anonymous hash that lets us tell one visit from another — it is not stored, and once the hash rotates it cannot be traced back. We cannot see who you are and we cannot follow you to other sites. Legal basis: legitimate interest in knowing which pieces get read.

Event registration. If you claim a seat at an event, we store the name and email address for each attendee so we can confirm the booking and contact you if it changes. Legal basis: performance of a contract.

Orders. If you place an order, we store your shipping and billing address, email address, order contents and order status. Legal basis: performance of a contract, and legal obligations for tax and accounting records.

Payments. We never see or store card numbers. Card details are collected directly by Stripe; we receive a payment reference and the last four digits.

Server logs. Our web server records standard access logs — IP address, user agent, requested URL, timestamp, response status — used to diagnose faults and detect abuse. Legal basis: legitimate interest in keeping the site running and secure.

Analytics. Where analytics is switched on, we use a self-hosted, cookieless installation of Umami on our own infrastructure. It records page views and referrers. It sets no cookies, tracks nobody across sites, and the data never leaves our servers.

Spam protection. The contact form is protected by Cloudflare Turnstile, which receives your IP address and browser characteristics in order to tell a person from a script.

Cookies

We set one cookie, and it is strictly necessary: a session cookie that keeps you signed in and protects forms against cross-site request forgery. There are no advertising or tracking cookies, and none for analytics either — the analytics described above is cookieless, so it stores nothing on your device and reads nothing from it. That is why this site shows no cookie banner: there is nothing to ask you to consent to.

Who else processes your data

• Hetzner Online GmbH — hosting, in a data centre in Germany. This covers the analytics too: it runs on the same server, so no separate analytics provider is involved and no data leaves for one.
• Mailgun — sending email (account, order, event and newsletter mail).
• Stripe — payment processing.
• Cloudflare — Turnstile spam protection on the contact form.

Turnstile and Stripe may involve transfers outside the EU under the relevant standard safeguards.

How long we keep it

Contact messages: up to 12 months. Account data: until you delete your account. Newsletter: until you unsubscribe. Order, payment and invoice records: ten years, as German tax law requires — but when you delete your account, the personal identifiers on them are anonymised and only the commercial record remains.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time. You can also complain to a data protection supervisory authority.

If you have an account, you do not have to ask: Privacy & data lets you export your data or delete your account directly.