Privacy policy pursuant to Art. 13 and 14 GDPR · Last updated: September 2026
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Ayhan Dogan
Zwergstr. 1
89407 Dillingen an der Donau, Germany
E-mail: info@leckersuche.de
No data protection officer has been appointed because the legal requirements for a mandatory appointment (Art. 37 GDPR, section 38 BDSG) are not met. Please send data protection enquiries directly to the e-mail address above.
LeckerSuche is a purely informational recipe search that runs entirely in your browser. This website uses no cookies, no tracking, no third-party analytics (no Google Analytics, no Matomo, no pixels) and embeds no content from external servers – no fonts, no images, no scripts, no maps, no third-party videos. There are no user accounts, no newsletters and no contact forms.
Personal data is only processed to the technically unavoidable extent that arises when any website is accessed (section 3) and – if you rate a recipe – in a greatly reduced form that cannot be traced back to you (section 6). Everything else, such as your bookmark list or your language choice, stays exclusively on your device (section 7).
✓ no cookies · no tracking · no third parties · no accountsThis website is operated on a server managed by the provider at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server location is Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner; Hetzner has no access to the content and merely provides the infrastructure.
When the website is accessed, the web server (nginx) automatically processes information transmitted by your browser and stores it in what are known as server log files:
The purpose of the processing is the technical provision of the website, ensuring trouble-free operation, troubleshooting, and detecting and defending against attacks on our systems. The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6 (1) (f) GDPR).
Retention period: the log files are rotated daily and deleted automatically after 14 days at the latest. They are not combined with other data, not evaluated in relation to you as a person and not passed on to third parties. Longer retention only takes place by way of exception if a specific security incident has to be investigated.
Providing this data is neither required by law nor by contract, but it is technically necessary in order to access the website – without the transmission of your IP address no server can deliver a website.
Before a daily log file is deleted, we create a pseudonymised copy of it: in that copy the IP address is replaced by a random daily identifier which is calculated from the IP address and a random value using a one-way procedure (SHA-256); the random value is discarded immediately after the conversion. The IP address cannot be recalculated from the identifier, and since each day receives a new random value, recognition across several days is not possible either. This copy therefore no longer contains any personal data; it is used for long-term statistics (e.g. visitors per month, most popular recipes over the years) and is kept indefinitely. The original log files containing IP addresses are deleted unchanged after 14 days at the latest.
To protect against automated attacks, password guessing and abusive mass requests, our server uses a protection system (fail2ban) which automatically evaluates the server log files. IP addresses from which clearly harmful requests originate – for example attack patterns of known malware or repeated failed login attempts on the server – are blocked temporarily (usually for 24 hours, and for up to 30 days when known attack tools are detected) and released again automatically afterwards. Normal visits with a common browser are not affected.
In addition, the web server limits the number of requests per IP address to the ratings endpoint (rate limiting). For this purpose the IP address is only counted briefly in memory and is not stored permanently.
The legal basis is our legitimate interest in the security and availability of our systems (Art. 6 (1) (f) GDPR). The blocklists contain only the IP address and the time of blocking.
This site can only be reached over an encrypted HTTPS connection; requests via “http://” are redirected automatically to “https://”. The certificate is issued by the non-profit certificate authority Let’s Encrypt. You can recognise an encrypted connection by the padlock symbol in your browser’s address bar. This means that transmitted data cannot be read by third parties.
In order to know how many people use LeckerSuche and which recipes are popular, we create a summarised statistic from the server log files (section 3) using the GoAccess software (e.g. page views per day, most viewed dishes, distribution by browser and operating system). The IP addresses are anonymised (truncated) before they are evaluated, and known search engine crawlers are filtered out. For periods further back than 14 days the statistics are calculated from the pseudonymised long-term copy without IP addresses (see section 3). No cookies are set, no fingerprints of your device are created and no user profiles are formed; the statistics cannot be traced back to individual persons. The statistics report is accessible only to the provider (protected by a PIN); the login cookie set in that process only affects the provider’s own device, visitors to the website do not receive a cookie.
The legal basis is our legitimate interest in evaluating and improving our offering (Art. 6 (1) (f) GDPR). Since no information is stored on or read from your device, no consent under section 25 TDDDG is required.
You can rate every recipe from 1 to 5 stars without registering. When you tap a star, only the recipe rated and the star value are transmitted to our server (Hetzner, Germany – see section 3). From this the server stores an anonymous overall statistic per recipe (sum and number of votes), from which the displayed average is calculated. No name, e-mail address or comment is requested.
So that a recipe cannot be rated any number of times by the same person, the server creates a one-way hash (SHA-256) from your IP address and a secret random value (salt). The IP address itself is not stored and cannot be reconstructed from the hash. The secret random value is renewed every 30 days, deleting all previous hashes – which means that this data disappears irrevocably after 30 days at the latest. Changes to your own rating within this period are counted as a correction, not as an additional vote.
The legal basis is our legitimate interest in a functioning, manipulation-proof rating function (Art. 6 (1) (f) GDPR). No profiles are created, no tracking is carried out and no data is passed on to third parties. The aggregated rating values (sum/count per recipe) are not personal data and are stored permanently.
Backups: the rating data is backed up daily on the same server; backups are deleted automatically after 30 days.
Your own rating is additionally stored in your browser so that it can be shown to you on your next visit – see section 7.
Some convenience functions remember your input. This data is stored exclusively locally in your browser (web storage, “localStorage”) and is not transmitted to us. We cannot view it. It consists of:
| Entry | Content | Purpose |
|---|---|---|
ls-sprache | selected language (e.g. “de”) | keep your language choice on your next visit |
ls-merkliste | identifiers of bookmarked recipes | bookmark list (“♥ Saved”) |
ls-einkaufsliste | recipes on the shopping list including ticked ingredients | shopping list |
ls-bewertungen | your own star ratings per recipe | display of your rating |
Storage only takes place once you use the respective function (for example bookmarking a recipe or changing the language). It is strictly necessary for the service you have expressly requested (section 25 (2) no. 2 TDDDG) and therefore does not require consent; a cookie banner is not needed. These are not cookies: the data is not sent to the server when pages are requested.
The data remains on your device until you delete it. You can remove it at any time using your browser’s “clear site data” or “clear browsing data” function, or reset individual entries in the app (e.g. “empty shopping list”, tapping the heart again).
On your first visit the app reads the preferred languages set in your browser
(navigator.languages) and selects the first supported language. This check takes place exclusively
on your device; no location lookup (no GeoIP) is carried out and nothing is transmitted to the server. A manual
language choice always takes precedence.
LeckerSuche can be installed on your device’s home screen as a “progressive web app”. To do so the website registers a service worker in your browser which stores pages and images in a local cache (Cache Storage) so that the app loads faster and remains usable without an internet connection. This cache is located exclusively on your device, contains no personal data and is renewed automatically with new versions. Ratings are never cached but always fetched live. You can remove the cache via your browser settings (“clear site data”) or by uninstalling the app.
Search, filtering and the portion calculator work entirely in your browser. Search terms are not sent to the server.
Next to individual ingredients you will find a small Amazon icon. It is a plain link to the product search for that ingredient on amazon.de. As long as you do not click the link, no connection to Amazon is established and no data is transmitted to Amazon. Only when you click do you leave our website; from then on the privacy policy of Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg applies. The links contain no partner identifier (no affiliate programme); we receive no commission and no information about your purchases.
The same applies to the WhatsApp share link (WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) and to e-mail links: they are only opened when you expressly click them.
Links to the static recipe pages (for example when sharing) lead back to leckersuche.de, where the same rules apply as here.
If you write to us at info@leckersuche.de, we process your e-mail address, the content of your message and, where applicable, your name in order to answer your enquiry. The legal basis is the handling of your enquiry (Art. 6 (1) (b) GDPR, insofar as the enquiry is of a contract-like nature) or our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).
The e-mail mailbox is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (processing on our behalf pursuant to Art. 28 GDPR, server location Germany). Please note that unencrypted e-mails could in principle be read by third parties in transit; please therefore do not send us confidential information that you would not want to transmit by e-mail.
We delete your messages as soon as your enquiry has been dealt with conclusively and no statutory retention obligations or ongoing matters prevent deletion, and after 12 months at the latest.
Recipients: personal data is not sold and not passed on to third parties. The only processors that store the data technically on our instructions are Hetzner Online GmbH (server) and ALL-INKL.COM (e-mail mailbox), both located in Germany. Data is only disclosed to authorities where we are legally obliged to do so.
Third countries: we do not transfer personal data to countries outside the European Union or the European Economic Area. If you open external links yourself (section 9), the respective provider may process data outside the EU – we have no influence over this.
Automated decisions: there is no automated decision-making in individual cases and no profiling within the meaning of Art. 22 GDPR.
Children: our service is aimed at the general public and does not process any data that would require an age check. No accounts are created and no data is specifically collected from children.
With regard to your personal data you have the following rights:
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) (f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
An informal e-mail to info@leckersuche.de is sufficient. Please understand that, in the case of access or erasure requests, we will generally not be able to identify you: we store no names, accounts or plain-text IP addresses, and the data stored in your browser (section 7) is not accessible to us – you can delete it yourself at any time. The server log files are deleted after 14 days in any case, and the rating hashes after 30 days.
Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for the provider is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
You are under no legal or contractual obligation to provide us with personal data. However, without the technically necessary transmission of your IP address the website cannot be delivered; without using the convenience functions (sections 6 to 8) only those functions are unavailable to you.
We take technical and organisational measures in accordance with Art. 32 GDPR: encrypted transmission (HTTPS), a hardened server with automatic security updates, a separate service with minimal privileges for the ratings endpoint, server access only via key authentication, regular backups, and data minimisation as a basic principle – we collect as little as possible from the outset.
We adapt this privacy policy whenever the website, the legal situation or the technology used changes – for example when new functions are added. You can always find the current version at www.leckersuche.de/privacy-policy.html; the date of the last change is given at the top of the page.
This privacy policy is provided in German and English. The provider is based in Germany and German law applies; in the event of any discrepancy between the two versions, the German version shall prevail.