Last updated: 2026-11-06 · Deutsche Fassung (maßgeblich)

Privacy policy

In short: You don't need an account. Your learning progress and the name on your badges stay in your browser. Only if you choose to sign in with your email do we store your email and which lessons you finished, so your progress is on all your devices. With an analytics service in the EU and a cookie, we measure which lessons are used and how easy they are to use; this recognises your browser across pages and visits, but not who you are.

1. Controller

rainmaker labs GmbH
Hopfengarten 7, 35423 Lich, Germany
Email: hello@rainmakerlabs.dev

We are not required to appoint a data protection officer. For privacy questions, write to the address above.

2. Hosting and server logs

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered through its network. When you open a page, Vercel processes technically necessary data: IP address, date and time, the address requested, referrer, browser and operating system. This is needed to deliver the page and to protect it against abuse and attacks.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure, working website). We have a data processing agreement with Vercel. Transfers to the USA are based on the EU Standard Contractual Clauses or, where Vercel is certified, the EU-U.S. Data Privacy Framework. Vercel deletes the logs automatically after a short time.

3. Analytics with PostHog (EU)

To understand which lessons are used and where learners get stuck, we use PostHog. The data is processed on PostHog servers in the EU (Frankfurt am Main); the provider is PostHog Inc., 2261 Market St #4008, San Francisco, CA 94114, USA. The data travels to PostHog through our own domain (kiwisketch.com).

Recognition: PostHog sets a cookie and a local storage entry in your browser (the name starts with ph_). They hold a random ID for your browser and one for your visit, so we can see the page views, learning events and recordings of one visit together and recognise returning visits. The cookie lasts up to one year; you can delete or block it in your browser settings at any time. The ID is not linked to your name, an email address or an account.
Page views are sent by your browser: the page requested (without parameters, except campaign tags such as utm_source), the referring page, browser, operating system, screen size and IP address. PostHog derives an approximate location (country, region, city) from the IP address. Our server also counts every page view with the same details but a new random ID, so that count is not linked to you.
Learning events are sent by your browser: lesson started, step done, lesson completed, badge shared or downloaded, each with the topic, lesson and language.
Session recordings: your browser records how the page is used (mouse movements, clicks, scrolling and what is shown on screen), so we can see where a lesson is hard to use. A recording can cover several pages of one visit. Every input field and the name on your badges are masked in your browser before anything is sent; pages whose link contains a name are not recorded at all. Recordings are deleted after 30 days.
Team notifications: when a visit ends, a short summary goes to our internal team chat (Slack, by Salesforce, Inc., USA): approximate location, browser, the pages and lessons of the visit and a link to its recording, without your name, email or IP address. Transfers to the USA are covered by the EU Standard Contractual Clauses.
We do not store your individual answers, the name on your badges or anything else you type as data; addresses are stripped of their parameters before sending.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in understanding and improving our free service). You can object at any time by writing to us. We have a data processing agreement with PostHog; any access from the USA is covered by the EU Standard Contractual Clauses.

4. Progress and badges in your browser

Which lessons you completed, your points and, if you enter it, the name on your badges are stored only in your browser's local storage. This data does not leave your device and we cannot see it. You can delete it at any time with "Reset progress" or in your browser settings.

This storage is strictly necessary for a feature you asked for (§ 25 (2) no. 2 TDDDG); no personal data is sent to us.

5. Optional account

You can choose to sign in with your email address so your progress is available on all your devices. There is no password: you get a 6-digit sign-in code by email. Every course works without an account.

Data: your email address, a random account ID, when you signed up and signed in, the IP address and browser used to sign in (in security logs), and which lessons you finished when, plus your points. The name on your badges is not stored; it stays in your browser.
Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992, as our processor. The database is in Frankfurt am Main (EU). Any access from outside the EU is covered by the EU Standard Contractual Clauses. Sign-in emails are sent through Supabase.
In your browser: while you are signed in, your browser keeps your session in local storage (ml:auth). This is strictly necessary for the sign-in you asked for (§ 25 (2) no. 2 TDDDG). Signing out removes it.
Not linked to analytics: we do not link your account to PostHog, and the account page is not recorded.
Team notification: when an account is created, our internal team chat (Slack) gets a message with your email address, your language and the number of accounts, so we know who joined and can help if sign-in goes wrong (Art. 6(1)(f) GDPR). Transfers to the USA are covered by the EU Standard Contractual Clauses.

The legal basis is Art. 6 (1) (b) GDPR (providing the account you create). You can delete your account yourself at any time on the account page; we then delete your email address and saved progress immediately. Supabase deletes security logs automatically after a short time. If you are under 16, please ask a parent before creating an account.

6. Sharing badges

When you share a badge, your browser creates a link that can contain the name and date on the badge. You decide whether and with whom to share it. The WhatsApp, LinkedIn and X buttons are plain links: data only goes to that service when you click, and then its privacy policy applies.

7. Fonts and external content

All fonts and graphics are served from our own server. Nothing is loaded from Google Fonts, ad networks or social media plugins.

8. Contacting us by email

If you write to us, we process your email address and message to reply (Art. 6 (1) (f) GDPR). We delete the data once your request is dealt with and no legal retention duty applies.

9. Children

Kiwi Sketch never requires personal data; the account is optional. Children under 16 should only create an account with a parent's permission. We ask children not to email us personal data, but to talk to their parents or teachers instead.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Just send us an email. You can also complain to a data protection supervisory authority, in particular in the EU member state where you live or where we are based.

11. Changes

We update this policy when the website or the law changes. The version published here applies. The German version is binding.