Abstract HerbsCommunity Museum
← Back to the museum

Privacy policy (Datenschutzerklärung)

Last updated: 01.11.2026

1. Controller

David-Leon Paul Herbrechter, Martin-Luther-Straße 123, 10825 Berlin, Germany
E-mail: theherbs.herbrechter [at] gmail [dot] com

2. The most important points in short

3. Hosting and server log files

This website is hosted by: ALL-INKL.COM – Neue Medien Münnich, Inhaber René Münnich, Hauptstraße 68, 02742 Friedersdorf, Deutschland. When you visit, the host automatically processes information that your browser transmits (server log files): IP address, date and time, the page or file requested, amount of data transferred, referrer URL, browser type and operating system. This is technically necessary to deliver the website and to keep it secure. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure and functioning operation). The log files are stored only as long as necessary for this purpose and are then deleted or anonymised. A data processing agreement under Art. 28 GDPR exists with the host.

3a. Visitor statistics without cookies

To understand how the website is used, I run a simple visitor statistic of my own on my web space at ALL-INKL. There are no third-party providers and no data is passed on. No cookies are set and no data is stored on your device. The following is recorded: page visited, referring page (domain name only), links and buttons clicked, time on page, device type, browser, operating system and browser language. Your IP address is not stored. At the moment of the visit it is only combined with the browser identifier and a secret value that changes daily into a checksum which makes it possible to count the visits of one day. Recognising you on other days is not possible this way. If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is recorded. The entries are deleted after 13 months. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in data-sparing audience measurement). You can object at any time under Art. 21 GDPR, for example by switching on “Do Not Track” in your browser.

4. Taking part without an account: cookie “hv”

When you for the first time suggest a name or property, vote, mark a work as a favourite, write a story, choose a display name or report content, the website sets a cookie named hv. It contains only a random identifier, no information about you as a person, and is valid for 400 days. It serves exclusively to make sure that each person has only one vote per suggestion, that your own votes and favourites are displayed and that your contributions stay assigned to your display name. Without this cookie the participation function you asked for is not possible. The legal basis is § 25 (2) no. 2 TDDDG (strictly necessary for a service expressly requested by you) in conjunction with Art. 6 (1) (f) GDPR. If you only look around, you get no cookie. You can delete the cookie in your browser at any time.

5. Your contributions

Stored are the names, properties and stories that you enter, your votes, favourites and reports and, if you choose one, your freely chosen display name. There is no account, no e-mail address and no password. Please choose a nickname or first name as your display name, not your full name. Names, properties and stories are publicly visible, together with your display name or “anon”. If you choose a display name, you get a public profile page and appear on the leaderboard; they show only the display name, the number and kind of contributions, your own favourites and the month of your first contribution. If you enter the same display name on another device and confirm that it is you, you continue there as the same person. There is no password for this; therefore choose a display name under which you do not expect anything confidential. Single votes are not shown publicly, only their total; for favourites the number per work is public. Please do not include personal data in contributions. The legal basis is Art. 6 (1) (b) GDPR (use of the participation function) or (f) (operation of the community catalogue). Contributions remain stored as long as the catalogue exists. On request I delete your contributions; please send me the herb number and the text.

5a. Automatic checking of texts

Everything visitors can enter (names, properties, stories, display names, nicknames in the museum, messages in the contact form) is checked automatically for hate, incitement, threats and insults before it is saved (text filter with word lists and patterns). If a text is rejected, a notice appears and the text is not saved. This happens without profiling, without storing the rejected input and without a decision with legal effect; a person reviews reports and doubtful cases. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in an offer free of hate and infringements).

5b. Museum and games (multiplayer)

In the 3D museum and in the games, visitors see each other. For this, your chosen display name (or “Guest”), a random identifier per browser tab, your position and pose are sent to the server every few seconds and shown to other visitors in the same room. The data lies only in a small file on the server, is overwritten after 6 seconds at the latest and is not stored permanently; your IP address is not stored. The legal basis is Art. 6 (1) (b) GDPR (use of the function you started).

6. Protection against abuse

To prevent spam and manipulation I briefly store, for each participation action, the IP address, the random identifier from the cookie, the type of action and the time. These entries are deleted automatically after 24 hours. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a fair voting system free of abuse).

7. Backups

The contents of the catalogue (contributions, votes, display names, random identifiers; no IP addresses) are backed up hourly on the web space so that nothing is lost in case of technical errors. Backups are deleted after 30 days at the latest. The legal basis is Art. 6 (1) (f) GDPR.

8. External links

Links to OpenSea and to the original files on Arweave are plain links. Data is transferred to these providers only when you click a link; their privacy policies apply there.

9. Contact by e-mail and contact form

Through the contact form you submit your name, e-mail address, subject and message (all voluntary, as far as you want to contact me). The information is stored in the database on the ALL-INKL server and delivered to me by e-mail. To protect against abuse, your IP address is stored only as a shortened, encrypted check value (hash) and removed after 30 days. You can withdraw your consent (Art. 6 (1) (a) GDPR) at any time with effect for the future.

When you write to me, I process your information to handle your request (Art. 6 (1) (b) or (f) GDPR) and delete it as soon as the request is dealt with, unless statutory retention obligations apply.

E-mail mailbox: The mailbox in which messages from the contact form, reports and e-mails to the address in the imprint arrive is run at Google (Gmail). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may also be transferred to Google LLC in the USA (basis: EU-US Data Privacy Framework or standard contractual clauses). Google’s privacy policy applies in addition.

9a. Report form for content

Through the report form you can report unlawful content or content that breaks the rules. Stored are: category, your description, the location, the reported content (as evidence, even if it is hidden or changed later), date and time and, if you give them, your name and e-mail address. Name and e-mail are voluntary; without them, however, we cannot tell you how we decided. To protect against abuse, your IP address is stored only as an encrypted check value (hash) and removed after 30 days. Your e-mail address and name are deleted after 12 months; the report itself (without your contact data) is kept for up to three years as proof of how reports were handled. The information may, where legally required, be communicated to the person concerned in the course of the review, without your contact data. The legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 16 and 17 of Regulation (EU) 2022/2065 (DSA) and Art. 6 (1) (f) GDPR.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An informal e-mail is enough.

Right to object (Art. 21 GDPR): Where processing is based on Art. 6 (1) (f) GDPR, you can object at any time on grounds relating to your particular situation.

Right to lodge a complaint: You can complain to a data protection supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.

10a. Retention periods at a glance

11. Encryption and changes

The website uses SSL/TLS encryption (“https://”). I will adapt this policy if the website or the legal situation changes; the version published here applies.