Back to the projects

Privacy – Sublarr

This policy covers the website sublarr.de, the statistics service stats.sublarr.de and the voluntary (opt-in) usage statistics of the self-hosted Sublarr application. Like all privacy policies of my projects, it is hosted on www.abrechen2.de; for requests to this page itself, the privacy policy of www.abrechen2.de applies.

Sublarr is operated from Germany under the EU General Data Protection Regulation (GDPR). The legally authoritative version of this notice is the German one; what follows is an English translation for international visitors.

1. Controller

Dennis Wittke
Gögging 18a
83083 Riedering
Germany
E-Mail: [email protected]

2. Hosting and data processing

The website sublarr.de runs on private home hardware in Germany (a Linux container in a private Proxmox environment) and is made reachable through a Cloudflare Tunnel. No external hosting provider is involved.

Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) terminates the TLS connection and in doing so processes IP addresses and request headers in order to provide the reverse-proxy service. A data processing agreement under Art. 28 GDPR is in place with Cloudflare.

Transfer to third countries: Cloudflare is a US company; a transfer of personal data to the United States is therefore not excluded. Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission, 10 July 2023), and Standard Contractual Clauses (SCC) under Art. 46 (2) lit. c GDPR additionally apply. An adequate level of data protection is therefore ensured.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in the secure and stable provision of the website).

3. Server log files

When you access the website sublarr.de the web server automatically collects data your browser transmits:

These data are evaluated to ensure operation, to analyse errors and to produce aggregate traffic statistics, and are deleted after 14 days at the latest. They are not combined with other data sources.

The traffic statistics (page views, referring sites, browser and operating-system groups) are generated once a day on our own server from these truncated log files (software: GoAccess). No cookies are set, no JavaScript is served for it, and no data is passed to third parties. The evaluation is purely aggregate; individuals cannot be identified in it. It is recomputed from whichever log files exist at the time and does not outlive their 14-day retention.

Legal basis for processing log files is Art. 6 (1) lit. f GDPR (legitimate interest in stable, secure operation of the website and in detecting and defending against attacks).

4. Cookies, local storage, and tracking

The website sublarr.de sets no cookies for tracking or analytics purposes. There are no tracking pixels, no Google Analytics, and no advertising networks embedded.

The search built into the docs pages (Pagefind) runs entirely in the visitor's browser; no data is sent to a server for it.

The website sublarr.de uses a single Local Storage entry sublarr-lang to remember your chosen language (German/English) across sessions. This information is not transmitted to any server.

5. Pseudonymous usage statistics of the Sublarr application

This section concerns not the website sublarr.de but the self-hosted Sublarr application. If you choose to, Sublarr sends usage statistics once a day to a collector service we operate (stats.sublarr.de) to prioritise development, gauge compatibility and show adoption.

Legal basis: exclusively your consent (Art. 6(1)(a) GDPR). Sending is off by default and only starts once you explicitly agree in Sublarr. You can withdraw consent at any time without any disadvantage.

What is collected: coarsely grouped metrics (version, platform, database type, enabled providers, use of individual features as yes/no, size classes instead of exact numbers) and a randomly, locally generated identifier (install_id). This identifier links the reports of the same install to each other; the collector also stores the time of the first and the last report. The data is therefore pseudonymous, not anonymous. We do not attempt to link installs to a person. No hostname, file paths, series or movie titles or API keys are transmitted. The full field list is in the usage-statistics documentation.

IP address and Cloudflare: your IP address is necessarily transmitted when connecting. The collector runs on our own server and, like the website sublarr.de, is reachable via Cloudflare; section 2 applies accordingly. We do not store or log the IP address ourselves.

Retention: an install's record is deleted once that install has stopped sending data for 180 days. The daily snapshots behind the public trend charts contain only totals without install_id and are kept for 24 months. Deleted records may remain in system backups for up to four weeks before they are overwritten.

Withdrawal and erasure (Art. 7(3), Art. 17 GDPR): turning it off in Sublarr (Settings → About → Usage statistics) withdraws consent and at the same time triggers deletion of the corresponding install record on the server (POST /v1/forget). If that request fails, for instance because your server is offline, the record is deleted at the latest after 180 days without reports. You can also request deletion at any time by email to the address in section 1.

The website sublarr.de links to external services, in particular GitHub, plus the Sublarr community spaces on Discord, Reddit and HuggingFace, and PayPal for donations. When you follow an external link the third-party site is opened; from that point on the privacy policy of the respective provider applies. No external fonts, JavaScript libraries or iframes that would silently establish third-party connections are embedded.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3)). An informal e-mail to the address above is enough.

Right to object (Art. 21 GDPR): where data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time.

You can also lodge a complaint with a supervisory authority. The competent authority is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

8. Right to object (Art. 21 GDPR)

The right to object to processing based on legitimate interests (section 7) applies in particular to the processing described in section 2 (hosting, Cloudflare Tunnel) and section 3 (server log files).

In the event of an objection, your data will no longer be processed unless there are compelling legitimate grounds for the further processing (e.g., to assert, exercise or defend legal claims). An informal email to the address listed under section 1 is sufficient.

9. SSL/TLS encryption

For security reasons, the website sublarr.de uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser starts with https:// and a lock symbol is shown. With SSL/TLS encryption active, data you submit to the website cannot be read by third parties.

10. Changes to this policy

This privacy policy may be amended if the data processing on the website sublarr.de changes or new legal requirements demand it. The latest version is always available here.

Last updated: 22 October 2026