LLink pls
Open in Zirkles

Privacy Policy

1. Who is responsible

hubre, Guddenstrasse 74, 80807 Munich, Germany. Contact for everything about your data: sam@hubre.de.

2. What we process, why, and on what basis

  • Your account or guest session. Making Drops works with an anonymous guest session (a random id). If you create an account we store your e-mail address or phone number, the way you sign in (password hash, or the Google, Apple or GitHub account id) and when you accepted the Terms. Basis: the contract with you, Art. 6(1)(b) GDPR.
  • Your Drops, Zirkles and Library. The links you send, the Drops we make from them, the Zirkles you create and the Creators in them. With Pro also the links, notes and documents you save. A Drop is private to you until you publish it; other users never see your documents. Basis: the contract.
  • AI processing. To write a summary we send the text of the source (a video transcript, or your document) to AI providers (section 4). Your documents are sent only after you have allowed it (Library, or Account); you can withdraw that at any time, and then no further document is sent. Do not upload documents that contain other people's personal data unless you may. Basis: the contract, and your consent for documents, Art. 6(1)(a).
  • Visit counter on the public pages (no cookie). Which public page was opened, on which site, and whether the visit came directly, from a search engine, an AI assistant or another site. We count them per day. We store no IP address, no user agent, no user id and no cookie, and we do not recognise you across visits. Your browser tells us to skip it with Global Privacy Control or Do Not Track. Basis: our legitimate interest in knowing which pages are read, Art. 6(1)(f). You may object at any time (section 7).
  • Live map (no cookie). The map on the home page and on each app's page shows how many people are online and what was made in the last 24 hours, per country. For that, the page sends a random id that exists only while the page is open, the country your connection comes from (read by our host, never your IP address) and the app you are on. We keep it for about two minutes, never store your IP address, user id or city, and show only counts. Countries with fewer than 3 people are folded into "other". Global Privacy Control or Do Not Track means you only see the map and are not counted. Basis: our legitimate interest in showing live activity, Art. 6(1)(f). You may object at any time (section 7).
  • Usage analytics (our own, no third party). Which Drops you open and how far you read, which features you use and from which app. They carry your user id and a random id that exists only while the page or app is open. We use them to see what works; they are not shown to other users. Basis: our legitimate interest in improving zirkle, Art. 6(1)(f). You may object at any time (section 7).
  • Security. A bot check (Cloudflare Turnstile) runs when a session starts or you sign in; servers log requests for a short time to keep the service safe. Basis: legitimate interest, Art. 6(1)(f).
  • Reports. If you send us a report we keep what you wrote, your name and e-mail if you gave them, and our decision, to answer you and to document what we did. Basis: legal obligations and legitimate interest, Art. 6(1)(c) and (f).

3. People named in the content we summarize

Zirkle summarizes public videos and writes about the people who made them: their channel name and what they said in the video. This is information about them that we did not collect from them. Source: the public video on its platform. Purpose: to write the summaries you ask for. Basis: legitimate interest, Art. 6(1)(f). It is not practical to inform every person individually (Art. 14(5)(b) GDPR), so this notice is the information. If you are a Creator or are named in a video, you can ask us to stop summarizing you, to delete what we hold, or to correct a Drop: see For Creators or write to sam@hubre.de.

4. Who receives data (processors)

  • Supabase (database, sign-in, files, server functions). Region: Frankfurt, Germany.
  • Vercel (serves this website; receives your IP address in server logs).
  • AI providers: OpenRouter, Inc. (USA), which passes requests to the AI model provider chosen by us, and Google (Gemini API, USA), which reads public YouTube videos to produce a transcript. They process the content to be summarized, not your account details. We ask OpenRouter to route requests only to endpoints with zero data retention that do not collect or train on data.
  • YouTube API Services. Zirkle uses YouTube API Services to read the title, channel and length of public videos. By using zirkle you agree to be bound by the YouTube Terms of Service; Google's Privacy Policy applies to that data. What we store from YouTube API Services is refreshed or deleted within 30 days. We show YouTube channel images, and YouTube and TikTok video thumbnails, as the platform provides them, loaded directly from its servers; we do not copy or change them. TikTok and Instagram profiles get no picture, Instagram videos no thumbnail.
  • Cloudflare (Turnstile bot check). Google, Apple or GitHub only if you choose to sign in with them.
  • While the closed test runs we also use Supadata (Dumpling Software UG, Germany) and ScrapeCreators (USA) to read content from other platforms.

With these providers we have data processing agreements. Where data goes to the USA, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses.

5. Storage on your device

Only what the service needs: your sign-in session, your language choice and whether you left the sidebar open or collapsed (the cookie sidebar_state, kept for 7 days). No advertising or tracking cookies, no third-party analytics.

6. How long we keep data

  • Your account and what belongs to it: until you delete the account (Account, Delete account). Private Drops, Zirkles, the Library and your documents are deleted with it; published Drops stay, without your name.
  • Source text we fetched to write summaries (transcripts, pages): never shown to other users, and deleted automatically about 30 days after it was fetched, earlier when the owner of the content asks us to or when the source is blocked. Your own documents stay until you delete them.
  • Abuse prevention: for guests (accounts without sign-in), a device fingerprint from your browser and your IP address, both stored only as salted hashes, to limit how many Drops or checks one device or network can make a day. Deleted after 30 days. This applies to Link pls too.
  • Usage analytics: without your user id once your account is deleted.
  • Reports: as long as needed to document our decision.

7. Your rights

You may ask for access, correction, deletion, restriction and a copy of your data (Art. 15 to 20 GDPR), and object to processing based on our legitimate interest (Art. 21). You can delete your account yourself. Where processing rests on your consent you may withdraw it at any time. You can complain to a data protection authority, for example the one of your federal state or country. Write to sam@hubre.de.

8. No automated decisions

Summaries are written by AI, but no decision with legal or similar effect on you is made automatically.