Privacy Policy

Hosting, payments, and the Telegram bot, at a glance.

Controller

SW labs – Felix Winkel
Email: lark@sw-labs.de
Postal address: see our legal notice

General

We only process personal data to the extent necessary to provide a functioning product and our services. This website does not use cookies and does not require a separate registration — your account is created through Telegram when you start using the bot.

Hosting & Infrastructure

This website and the underlying application are operated via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), using Cloudflare Workers with static assets (website and application logic) and Cloudflare D1 (database). Cloudflare processes technical connection data (IP address, date, time, page accessed, browser information) to deliver the website and application. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Transfers to the US are based on the EU-US Data Privacy Framework (adequacy decision of the EU Commission, 10 July 2023). Cloudflare is certified under the Data Privacy Framework. Privacy policy: www.cloudflare.com/privacypolicy

We also use Cloudflare Web Analytics (same provider) to measure reach and page load performance. This service is cookieless: it sets no cookies, writes nothing to your device, and does not create an identifier that would recognise you across visits or across websites. Your IP address, user agent and request headers are hashed and discarded rather than stored; what remains is aggregate data — page views, referrer, country, browser, operating system and performance measurements. Because no information is stored on or read from your device, this does not require consent under § 25 TDDDG. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how the site is used). Processing is governed by Cloudflare’s Data Processing Addendum under Art. 28 GDPR; US transfers rest on the EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses. Retention: six months.

The source code is managed via GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA), used exclusively for version control and the build process. User data is not transmitted to GitHub. Privacy policy: docs.github.com/privacy

Telegram Bot

Lark Goals is operated through a bot on Telegram. When you use the bot, Telegram (Telegram FZ-LLC / Telegram Messenger Inc.) processes your messages as the platform through which the service is delivered. We store your Telegram user ID and, where available, your Telegram username, to operate your account, assign you to challenges, and deliver check-in and verification messages. We do not have access to your Telegram account, contacts, or messages outside of your interaction with our bot. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Telegram's own privacy policy applies to your use of the Telegram platform: telegram.org/privacy

Payments

Payment processing is handled by Stripe. Card details are entered directly on Stripe's hosted checkout page and are never transmitted to or stored on our servers — we only store a tokenized reference (customer ID and payment method ID) that allows us to charge your card for a confirmed missed check-in. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Stripe's privacy policy: stripe.com/privacy

Email Communication

If you contact us by email, your message is processed via Zoho Mail (Zoho Corporation Pvt. Ltd., Estancia IT Park, Plot No. 140 & 151, GST Road, Vallancherry Village, Chengalpattu District, Tamil Nadu 603202, India). Zoho has Standard Contractual Clauses in place for international data transfers and is GDPR-compliant. Your information is stored to process your request and is not shared with third parties. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Privacy policy: www.zoho.com/privacy

What we store

In connection with your use of Lark Goals, we store: your Telegram user ID and username, your chosen timezone, the challenges you create or are verifying, your check-in and verification history, and a tokenized reference to your payment method at Stripe. We never store your card number, expiry date, or CVC.

Your rights

You have the following rights regarding your personal data:

– Right of access (Art. 15 GDPR)
– Right to rectification (Art. 16 GDPR)
– Right to erasure (Art. 17 GDPR)
– Right to restriction of processing (Art. 18 GDPR)
– Right to data portability (Art. 20 GDPR)
– Right to object (Art. 21 GDPR)
– Right to withdraw consent (Art. 7(3) GDPR)

To exercise your rights: lark@sw-labs.de

Supervisory authority

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach
www.lda.bayern.de

Last updated: August 31, 2026