This is a courtesy translation. The German text at Datenschutzerklärung is the legally binding version. This courtesy translation is intended to inform completely and identically.
Last updated: 5 October 2026
Resumen en español
Responsable: Sebastian Kaiser (Aurel), Kathi-Kobus-Straße 21, 80797 Múnich, Alemania, hello@cosmicpeaceprayers.org. Este sitio no usa cookies ni carga contenido de terceros. Si te suscribes a la Carta del Domingo, MailerLite procesa tu correo electrónico (doble confirmación) y la carta te llega en inglés; no medimos si abres las cartas ni si pulsas enlaces. Si enciendes una vela, el nombre y el mensaje son públicos durante siete días; puedes retirarla tú mismo. El recordatorio dominical opcional se gestiona a través del servicio push del fabricante de tu navegador, que puede tratar datos en EE. UU.; guardamos una dirección de envío, tu zona horaria y tu idioma hasta que lo desactives o, como máximo, 90 días sin entrega. Si te unes a nuestros círculos de WhatsApp o Telegram, los demás miembros ven tu perfil. Puedes ejercer tus derechos según el RGPD (acceso, rectificación, supresión, oposición, retirada del consentimiento) escribiendo a hello@cosmicpeaceprayers.org y presentar una reclamación ante una autoridad de control. El texto completo en inglés figura a continuación; la versión alemana es la jurídicamente vinculante.
Resumo em português
Responsável: Sebastian Kaiser (Aurel), Kathi-Kobus-Straße 21, 80797 Munique, Alemanha, hello@cosmicpeaceprayers.org. Este site não usa cookies nem carrega conteúdo de terceiros. Se você assinar a Carta de Domingo, a MailerLite processa seu e-mail (confirmação dupla) e a carta chega em inglês; não medimos se você abre as cartas nem se clica em links. Se você acender uma vela, o nome e a mensagem ficam públicos por sete dias; você mesmo pode removê-la. O lembrete de domingo opcional passa pelo serviço push do fabricante do seu navegador, que pode tratar dados nos EUA; guardamos um endereço de envio, seu fuso horário e seu idioma até você desativá-lo ou, no máximo, 90 dias sem entrega. Se você entrar nos nossos círculos de WhatsApp ou Telegram, os outros membros veem seu perfil. Você pode exercer seus direitos segundo o RGPD (acesso, retificação, exclusão, oposição, revogação do consentimento) escrevendo para hello@cosmicpeaceprayers.org e apresentar reclamação a uma autoridade de controle. O texto completo em inglês vem a seguir; a versão alemã é a vinculante.
Résumé en français
Responsable du traitement : Sebastian Kaiser (Aurel), Kathi-Kobus-Straße 21, 80797 Munich, Allemagne, hello@cosmicpeaceprayers.org. Ce site n'utilise pas de cookies et ne charge aucun contenu tiers. Si tu t'abonnes à la Lettre du dimanche, MailerLite traite ton adresse e-mail (double confirmation) et la lettre t'arrive en anglais ; nous ne mesurons ni l'ouverture des lettres ni les clics. Si tu allumes une bougie, le nom et le message sont publics pendant sept jours ; tu peux la retirer toi-même. Le rappel du dimanche, facultatif, passe par le service push de l'éditeur de ton navigateur, qui peut traiter des données aux États-Unis ; nous enregistrons une adresse d'envoi, ton fuseau horaire et ta langue jusqu'à ce que tu le désactives ou au plus tard après 90 jours sans livraison. Si tu rejoins nos cercles WhatsApp ou Telegram, les autres membres voient ton profil. Tu peux exercer tes droits selon le RGPD (accès, rectification, effacement, opposition, retrait du consentement) en écrivant à hello@cosmicpeaceprayers.org et introduire une réclamation auprès d'une autorité de contrôle. Le texte complet en anglais suit ; la version allemande fait foi.
Sintesi in italiano
Titolare del trattamento: Sebastian Kaiser (Aurel), Kathi-Kobus-Straße 21, 80797 Monaco di Baviera, Germania, hello@cosmicpeaceprayers.org. Questo sito non usa cookie e non carica contenuti di terzi. Se ti iscrivi alla lettera della domenica, MailerLite tratta il tuo indirizzo e-mail (doppia conferma) e la lettera ti arriva in inglese; non misuriamo se apri le lettere né se fai clic sui link. Se accendi una candela, il nome e il messaggio sono pubblici per sette giorni; puoi rimuoverla tu stesso. Il promemoria della domenica, facoltativo, passa attraverso il servizio push del produttore del tuo browser, che può trattare dati negli Stati Uniti; salviamo un indirizzo di consegna, il tuo fuso orario e la tua lingua finché non lo disattivi o al massimo dopo 90 giorni senza consegna. Se entri nei nostri gruppi WhatsApp o Telegram, gli altri membri vedono il tuo profilo. Puoi esercitare i tuoi diritti secondo il GDPR (accesso, rettifica, cancellazione, opposizione, revoca del consenso) scrivendo a hello@cosmicpeaceprayers.org e proporre reclamo a un'autorità di controllo. Il testo completo in inglese segue; fa fede la versione tedesca.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Sebastian Kaiser
(working under the name Aurel)
Kathi-Kobus-Straße 21
80797 Munich
Germany
Email: hello@cosmicpeaceprayers.org
2. General information on data processing
Cosmic Peace Prayers processes personal data only for the purposes named in this policy. Data is not passed on to third parties for advertising or marketing purposes and is never sold. The project is non-commercial.
Contact by email. If you write to us by email, we process your address and the content of your message to answer your request (Art. 6(1)(b) or (f) GDPR). We delete the message once the matter is settled and no statutory retention duty applies.
3. Hosting
This website is hosted by ALL-INKL. The provider is ALL-INKL.COM, Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (All-Inkl). Details are in All-Inkl's privacy information: all-inkl.com/datenschutzinformationen.
All-Inkl is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible.
Data processing agreement. We have concluded a data processing agreement (AVV) with All-Inkl. It ensures that All-Inkl processes the personal data of our visitors only on our instructions and in compliance with the GDPR.
Server log files. When you visit this website, the host automatically collects information in server log files: IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (the specific page), HTTP status code, amount of data transferred, the website the request came from (referrer), browser and operating system. This processing is based on Art. 6(1)(f) GDPR and serves a stable, secure and functional operation of the website. How long the log files are kept is determined by All-Inkl as the host. All-Inkl states in its privacy information that log files are deleted after seven days at the latest. We do not evaluate the log files in relation to individuals.
4. No third-party content
Fonts, scripts and images of this website are delivered exclusively from our own web space at All-Inkl. No content is loaded from Google Fonts, content delivery networks, social media platforms or other third parties. Your IP address is therefore not transmitted to third parties when you visit the website.
5. Newsletter (Sunday Letter)
If you sign up for our Sunday Letter through the form on this website, we process your email address and the language of the website you are using. The Sunday Letter is available in German and in English; if you sign up on the Spanish, Portuguese, French or Italian pages, you receive it in English. At MailerLite we also store, with your address, the time of sign-up, the time the confirmation email was sent and a confirmation code; the code is deleted when you confirm. To limit mass sign-ups, the script on our web space stores a value derived from your IP address with a secret key (HMAC; for IPv6, of the associated /64 network) together with the times of your sign-up attempts, not the IP address itself. This value is taken into account for one hour and is then deleted on a later call of the script (Art. 6(1)(f) GDPR, protection against abuse). The form sends your address to a script on our server, which passes it on to our email service provider.
Legal basis. Processing is based on your consent under Art. 6(1)(a) GDPR.
Double opt-in. Sign-up uses the double opt-in procedure. After you enter your address you receive an email in which you must actively confirm the sign-up by clicking a confirmation link. Without this confirmation your email address is not used for sending. We delete unconfirmed sign-ups regularly, at the latest 30 days after sign-up. As proof of your consent we store the time of sign-up and confirmation and a value derived with a secret key (HMAC) from the IP address used for confirmation, not the IP address itself, for as long as you are subscribed and, after you unsubscribe, together with the unsubscription record so that we can prove the earlier consent (Art. 6(1)(f) GDPR).
Purpose. The data is used exclusively to send the Sunday Letter and to manage your subscription. It is not passed on to third parties for their own purposes.
Storage period. We store your data for as long as you are subscribed. After you unsubscribe you receive no further letters. Your address stays stored at MailerLite as unsubscribed so that your withdrawal of consent is permanently respected (Art. 6(1)(f) GDPR). On request we delete it completely; a message to hello@cosmicpeaceprayers.org is enough.
Withdrawal of consent. You can withdraw your consent at any time, for example with one click on the unsubscribe link in every Sunday Letter email or by informal message to hello@cosmicpeaceprayers.org. The lawfulness of processing carried out before the withdrawal is not affected.
Email service provider. We use the service MailerLite to send the letters. For customers in the European Economic Area the contracting party is MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland. A data processing agreement under Art. 28 GDPR exists with MailerLite. This agreement is part of MailerLite's terms of use. According to MailerLite, the data is stored in Google Cloud data centres in the EU. Where data is transferred to countries outside the European Economic Area, for example to MailerLite, Inc. in the USA, the EU standard contractual clauses have been agreed for this (Art. 46(2)(c) GDPR). MailerLite's privacy policy is available at mailerlite.com/legal/privacy-policy.
No open or click evaluation. We send the Sunday Letter and the confirmation email without open tracking. The letters contain no links to content; references to our website appear as plain text. They contain only the unsubscribe link, and the confirmation email contains the confirmation link as well as links to the privacy policy and the legal notice. The unsubscribe link leads to MailerLite. The other links may technically pass through a MailerLite redirect. We do not evaluate these requests.
6. Candle function
On the home page you can light a virtual candle. The name or intention you enter, an optional short message and a timestamp are stored in a file on our web space at All-Inkl. With these details the candle is visible to all visitors of the website. After 7 days it is no longer displayed and is deleted from the file at the latest the next time the candle script is called. No registration is required.
The legal basis for your own details is your explicit consent, which you give by lighting the candle (Art. 6(1)(a) and Art. 9(2)(a) GDPR), including where your details reveal religious beliefs. If you mention other people, please use only first names or initials and no details about health or religion. We base the display of such details on the legitimate interest of the person lighting the candle and our interest in a shared prayer (Art. 6(1)(f) GDPR); the persons concerned can ask for removal at any time. Entries containing links, email addresses or phone numbers are rejected.
Removing your own candle. When you light a candle, our server creates a random deletion token and returns it once to your browser. The browser stores it in local storage (key cpp:own). Only a non-reversible hash of this token is stored on the server. With the token you can remove your candle yourself at any time on the same device and in the same browser. Alternatively, a message to hello@cosmicpeaceprayers.org is enough.
Reporting. Below every candle you did not light yourself there is a link "Report". It opens your email program with a prepared message to hello@cosmicpeaceprayers.org containing the candle's identifier. We review reported candles and remove them in case of violations.
Abuse protection. To limit automated repeated entries, the script stores two values formed with a secret key (HMAC), one for your IP address (for IPv6, its /64 network) and one for your network range (IPv4 /24, IPv6 /48), together with the times of your latest entries and failed deletion attempts. The IP address itself is not stored for this purpose. The values are pseudonymised. They are taken into account for one hour only and are deleted at the next write or the next retrieval of the candle list after that hour has passed. The legal basis is Art. 6(1)(f) GDPR (security of the service and abuse prevention).
Public availability and scope. At most 48 candles are shown and at most 400 are stored. The details of a candle can be retrieved by anyone and may be copied by third parties. Deletion on our side does not reach such copies. You can withdraw your consent at any time with effect for the future by removing your candle or writing to us (Art. 7(3) GDPR).
7. Local storage in the browser and installable app
We use your browser's local storage (localStorage) for the following: your language choice (key cpp:lang), the time zone you chose for displaying the next gathering (cpp:tz) and the deletion token of your own candles (cpp:own) and, if you switch on the Sunday reminder, a synchronisation value made of delivery address, time zone and language with a timestamp (cpp:pushsync) so that changes are reported to our server. Language and time zone are stored only if you expressly choose them. The deletion token stays stored until you remove your candle or clear your browser data. This information is not transmitted to us automatically. Exceptions: you send the deletion token to our server when you remove your own candle; when you sign up for the Sunday Letter, the website language is sent along; when you use the Google Calendar link, the chosen time zone is passed to Google (see Section 9); with the Sunday reminder switched on, your browser reports the delivery address, time zone and language to our server (see below). The storage is strictly necessary for the service you expressly requested (Section 25(2) no. 2 TDDDG). You can delete the data at any time in your browser settings.
Installable app (service worker). The website can be installed on your device as an app. A service worker is registered only when you click the button "Install as app" on the website (the button appears only in browsers that offer installation) or switch on the Sunday reminder. It then stores page, style and program files of this website in the browser cache so that an offline page can be shown when there is no connection. Without one of these actions no service worker is set up. Your inputs and requests to our scripts are not cached. You can delete the service worker and cache at any time in your browser settings.
Sunday reminder (push notification). If you switch on the Sunday reminder on the home page and allow notifications, your browser registers with the push service of its maker (for example Google for Chrome, Apple for Safari, Mozilla for Firefox, Microsoft for Edge) and receives a delivery address (endpoint). On our web space at All-Inkl we store this address, the time zone you chose or that was detected, the language, the date of sign-up, the dates of the last and of the last successfully delivered reminder and the number of failed delivery attempts. Language and time zone are also stored in your browser cache. On Sundays shortly before 8 PM your local time our server calls the delivery address at the push service and transmits a message without content; the push service receives the delivery address, the time and an identifier of our server. Your browser itself shows the text of the reminder. To prevent mass sign-ups the script stores a value formed with a secret key from your network range (IPv4 /24, IPv6 /48), not the IP address itself; it is disregarded after one hour and deleted the next time the script runs. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time by ending the reminder with "Turn off reminder" or by blocking notifications in your browser settings. We delete the data as soon as you turn off the reminder, the push service reports that the address is no longer valid, six delivery attempts in a row fail, or no reminder could be delivered for 90 days. If you only block notifications in your browser settings, we learn about it only through the push service; it is therefore best to turn the reminder off on the website. The push services of Google, Apple, Mozilla and Microsoft may also process data in the USA. For the USA there is an adequacy decision of the European Commission (EU-US Data Privacy Framework, Art. 45 GDPR), which applies to companies certified under it. In addition, the privacy terms of the respective browser maker apply.
8. Timer, screen and practice counter
The timer runs entirely in your browser. While it runs, your browser, where supported, is asked to keep the screen on (Screen Wake Lock). No data is transmitted to us in the process.
Requests when you visit the home page. When you open the home page, your browser loads the current candle list (candles.php), the weekly number (practice.php) and the preview of the latest Sunday Letter (letters/latest.json) from our server. While the page is open and visible, the candle list is requested again about once a minute. For these requests the host processes the data described in Section 3 (server log files); the scripts themselves store neither your IP address nor other identifiers.
When you start the timer or finish the eight minutes, your browser sends an event without a name and without an identifier ("begun" or "completed") to the script practice.php on our web space. The script only increments anonymous weekly totals. It stores neither IP addresses nor other identifiers or timestamps of individual events, only weekly totals and an hourly counter to limit automated calls. Weekly totals are kept for ten weeks. The number of timers started in the current week is shown on the home page once at least three starts have been counted. Starting repeatedly counts repeatedly. Where your IP address is technically processed by the host when the script is called, Section 3 applies. The legal basis is Art. 6(1)(f) GDPR (anonymous usage overview of the service).
9. External links, sharing and calendar
The website contains links to WhatsApp, Telegram, email and Google's calendar function as well as sharing buttons. These services are only called when you click the respective link. Your device's share function is only called when you tap "Share". You download the calendar file (.ics) from our server; it contains no personal data. When you click "Google Calendar", the time zone you chose or that was detected is passed to Google as a parameter, together with the title, time and description of the event; Google receives your IP address through your browser. Only when you call an external service do that provider's privacy terms apply.
Prayer circles on WhatsApp and Telegram. The links "WhatsApp" and "Telegram" let you join a group that we administer. When you join, we and all other members see your profile name, profile picture and, depending on your settings, your phone number, as well as your messages in the group. Because these are prayer circles, your membership may indicate religious beliefs. The legal basis is your explicit consent by voluntarily joining (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can leave the group at any time. We do not store your data outside these services. The provider is WhatsApp Ireland Limited for WhatsApp and the operator of Telegram for Telegram; both also process data outside the EU under their own privacy terms. If you do not want to show your phone number, the Sunday Letter is the better choice.
10. Cookies and tracking
This website sets no cookies. Neither Google Analytics nor Meta Pixel, TikTok Pixel or comparable analytics and tracking tools are used. We do not evaluate opens or clicks of the Sunday Letter (Section 5).
11. Your rights as a data subject
You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), objection (Art. 21 GDPR) and to withdraw consent given (Art. 7(3) GDPR).
An informal message to hello@cosmicpeaceprayers.org is enough to exercise these rights. You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Providing your data is voluntary. Without an email address we cannot send you the Sunday Letter; without a name or intention no candle can be lit. There is no automated decision-making, including profiling. Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to this processing (Art. 21(1) GDPR). Notice of your right to object: we hereby expressly draw your attention to this right (Art. 21(4) GDPR).
12. Changes to this privacy policy
This privacy policy may be adjusted when the legal framework or the services used change. The version published on this page at the time of your visit applies.