Privacy policy

This policy covers the website at denkweg.app and the Denkweg app at go.denkweg.app. It explains what personal data is processed, for what purpose, on which legal basis under the General Data Protection Regulation (GDPR), and which service providers are involved.

1. Who is responsible

Oleg Zayarniy
Rykestr. 7, 10405 Berlin, Germany
contact@denkweg.app

Denkweg is run by one person. There is no data protection officer, and none is required. Write to the address above about anything in this policy.

2. The website (denkweg.app)

Hosting and server logs

The website is hosted by Vercel Inc., USA. When you open a page, Vercel processes the technical data your browser sends: IP address, date and time, the page requested, referrer and browser type. This is needed to deliver the page and to protect the service against abuse (Art. 6 (1) (f) GDPR).

Usage statistics

The website uses Vercel Web Analytics to count page views. It sets no cookies and does not track you across sites or days: a visitor is recognised only by a hash of the request that is discarded after 24 hours, and no IP address is stored. The purpose is to understand which pages are read (Art. 6 (1) (f) GDPR).

Contact form

When you use the contact form, your email address and message are sent to me by email through Resend, Inc., USA, so I can answer you (Art. 6 (1) (b) and (f) GDPR). To keep spam out, the form uses Cloudflare Turnstile from Cloudflare, Inc., USA, which checks signals from your browser and your IP address. Your IP address is also held briefly in the server’s memory to limit how many messages can be sent in a row. It is not stored. I keep your message for as long as our conversation needs it, and delete it on request.

The website sets no cookies and loads no fonts or scripts from third parties apart from Cloudflare Turnstile on the contact form.

3. The app (go.denkweg.app)

Your account

To use the app you create an account with your name, email address and a password. The password is stored only as a hash. Sign-up, sign-in, email verification and password reset are provided by Neon Auth from Neon, Inc., which also sends the verification and reset emails. The app sets a session cookie to keep you signed in. It is strictly necessary for the service you asked for (§ 25 (2) TDDDG, Art. 6 (1) (b) GDPR).

What you create

Your paths, questions, answers, imported articles, bookmarks, highlights, notes, shares and settings are stored in a database run by Neon, Inc. on Amazon Web Services in Frankfurt, Germany (Art. 6 (1) (b) GDPR). Bookmarks, highlights and notes are private: they never appear in a shared path.

Your appearance choice and a few display preferences are stored only in your browser’s local storage. They never leave your device.

AI processing

Denkweg’s answers are written by AI models. To produce one, the text needed for that request is sent to OpenRouter, Inc., USA, which passes it to the provider of the model in use. That text is your question, the passage you asked about, the path that led to it, and the document it belongs to. The models in use today are Google’s Gemini models, provided by Google through Google AI Studio or Vertex AI. When the models in use change, this policy is updated.

Your name, email address and account details are never sent to a model provider. Don’t paste personal data about yourself or others into a question if you don’t want it processed this way.

When you import an article from a link, the Denkweg server fetches that page. When you ask Denkweg to verify a passage, search queries derived from it are sent through OpenRouter to the search provider Exa Labs, Inc., USA.

The legal basis is Art. 6 (1) (b) GDPR: generating answers is the service you use Denkweg for.

Fair-use records

For each AI request, the app records which account made it, what kind of request it was, and what it cost. These records keep usage within fair-use limits and the service affordable (Art. 6 (1) (b) and (f) GDPR). They are never shown to anyone else.

Shared paths

If you share a path, anyone with the link can read the document and the branches you chose to include. Your name and email address are not shown. You can stop sharing at any time.

Hosting, logs and statistics

The app is hosted by Vercel Inc., USA, with the same server logs as the website. It uses Vercel Web Analytics in the cookieless form described above, which never records shared links.

4. Service providers and transfers outside the EU

Vercel, Neon, Resend, Cloudflare, OpenRouter, Google and Exa process data on my behalf under data processing agreements (Art. 28 GDPR). Several of them are based in the USA. Transfers to the USA rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR).

5. How long data is kept

Account data and everything you create are kept while your account exists. When you delete a path, it and everything in it are deleted. You can delete your whole account yourself under Settings in the app: the account and everything in it, including its fair-use records, are deleted at once and cannot be restored, and your share links stop working. A path someone else started from one of your share links is their own copy and stays. If you can no longer sign in, write to contact@denkweg.app and your account will be deleted within 30 days. Server logs are kept by Vercel for a short period and then deleted automatically.

6. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), to receive it in a portable format (Art. 20), and to object to processing based on legitimate interests (Art. 21). To use any of these rights, write to contact@denkweg.app.

You also have the right to complain to a data protection supervisory authority. The one responsible for Denkweg is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

There is no automated decision-making with legal or similarly significant effects on you (Art. 22 GDPR).

7. Changes

This policy is updated when Denkweg changes how it processes data. The date at the top shows the current version.