Privacy Notice

This notice explains how DiveCalc processes personal data when you visit divecalc.app, use its tools, contact us, or ask for email updates. It also explains your rights under the General Data Protection Regulation (GDPR).

The controller is:

1. At a glance

• You do not need an account to use DiveCalc.
• Calculator inputs and results are processed in your browser and are not intentionally sent to us by the calculators.
• We do not use advertising trackers or analytics cookies, and we do not sell personal data. A strictly necessary first-party cookie remembers your privacy choice.
• Hosting providers necessarily process request data, and — only with your consent — we use cookieless analytics, sampled session replays, and heatmaps to understand use and performance.
• If you submit a form, we process the information you choose to send.

2. Hosting and server logs

DiveCalc is hosted by Vercel Inc. When your browser requests a page or asset, Vercel may process the IP address, request URL, date and time, referrer, user-agent information, response status, and similar technical data needed to deliver and secure the site.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are reliable delivery, abuse prevention, troubleshooting, and the security of the service. Technical logs are retained according to the applicable Vercel account settings and then deleted or aggregated, unless an incident requires longer retention.

3. Calculators and storage on your device

DiveCalc stores unit preferences, the dismissed state of install suggestions, and a completed PWA migration marker in browserlocalStorage. The c15t consent manager stores your privacy choices, their time, and a randomly generated browser subject identifier in a first-party c15t cookie and mirrors that record in localStorage. This local-only configuration does not send the consent record to a c15t backend. If the offline app restarts during an update, current form values may be placed briefly in sessionStorage so they can be restored. The offline app also uses browser Cache Storage and a service worker to keep the app shell and selected pages available without a connection.

These values and the consent record remain on your device and can be removed through your browser settings or DiveCalc's offline-app reset control. Storage is used to provide functions you request; where § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies, it is based on the strictly necessary exception in § 25(2) no. 2 TDDDG.

4. Cookieless analytics, session replays, and heatmaps

With your “Analytics & performance” consent, we use a self-hosted Umami instance, Vercel Web Analytics, and Vercel Speed Insights to understand site use and performance. These tools do not set analytics cookies, and their browser components load only after you enable that category. Until then, they do not collect browser usage or performance data. Reports may include the page path, referrer, approximate location derived from the request, browser, operating system, device type, screen size, language, and performance measurements. Query parameters are excluded from standard Umami pageview reports; replay and heatmap data may contain the current page URL.

Separately, if you enable “Session replays & heatmaps,” Umami may sample the visit for session replay. A replay records the page's visual structure and changes together with interactions such as mouse movement, clicks, scrolling, selections, and viewport changes. It does not create a camera or microphone recording. Heatmaps use page URLs, click positions, scroll depth, and page and viewport dimensions to show where visitors interact. Entire calculator workspaces — including calculator inputs and rendered results — are blocked from recordings. Other form input values are masked before replay data is sent; canvas content and cross-origin iframe contents are not recorded.

Umami is configured to respect browser Do Not Track signals. The c15t consent manager prevents each optional script from loading unless its category is enabled and reloads the page when an enabled category is withdrawn, so the corresponding recorder or tracker no longer runs. Vercel's analytics products create privacy-preserving request hashes and provide aggregated reports rather than identifying individual visitors.

After a successful contact message, signup, or suggestion, our server may send Umami an event name and coarse details such as a text-length bucket, whether an optional email was supplied, or the requested tool name. Names, email addresses, subjects, messages, and suggestion text are not included in these events. With Analytics & performance consent, browser events may also describe the offline app installation flow, such as whether an install prompt was available, clicked, accepted, dismissed, or completed. These events do not include calculator inputs or results.

The legal basis for each optional category described above is your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw either category or change your choices at any time with effect for the future via “Cookie Settings” in the footer; withdrawal does not affect the lawfulness of processing before it. The server-sent form events described in the previous paragraph involve no script or storage on your device and are based on Article 6(1)(f) GDPR — our legitimate interest in measuring form reliability with limited, cookieless data. Analytics records are deleted or aggregated when they are no longer needed for trend analysis.

5. Messages, suggestions, and email updates

5.1 Contact messages

The contact form collects your name, email address, subject, and message. We use them to receive, answer, and follow up on your request. The legal basis is Article 6(1)(b) GDPR when the message concerns steps toward a contract, and otherwise Article 6(1)(f) GDPR based on our legitimate interest in responding to communications.

5.2 Tool suggestions

A tool suggestion contains the suggestion text and, if you provide it, your email address. We use it to evaluate the suggestion and may use the optional address for follow-up questions. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in improving DiveCalc and replying to voluntary feedback.

5.3 Newsletter and tool notifications

If you subscribe to general updates or request notice about a specific tool, we process your email address and, for a tool notification, the tool name. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time by emailing us. Withdrawal does not affect processing that occurred before it.

Form submissions are sent through our server to Resend, our email delivery provider, and delivered to our administrative inbox. We do not maintain a separate form-submission database.

6. Service providers and international transfers

Vercel and Resend may process data in the United States and through their subprocessors. Their data-processing terms provide transfer safeguards including the European Commission's Standard Contractual Clauses; certified recipients may also rely on the EU–US Data Privacy Framework. Details are available in the Vercel Data Processing Addendum and Resend Data Processing Addendum.

7. Retention

• Contact messages and suggestions are retained only as long as needed to respond, handle follow-up, or establish and defend legal claims, subject to any statutory retention duty.
• Subscription and notification addresses are retained until you withdraw consent or the requested service ends, unless limited retention is required to document or honor the withdrawal.
• Analytics and technical data follow the periods or deletion criteria described in sections 2 and 4 and the relevant provider settings.

8. Your rights

Subject to the conditions in the GDPR, you may request access to and rectification or erasure of your personal data, restriction of processing, and data portability. You may object on grounds relating to your situation to processing based on Article 6(1)(f) GDPR. You may withdraw consent at any time for future processing.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for private-sector controllers in Bavaria is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. Required information and automated decisions

You are not legally or contractually required to provide personal data to use the calculators. Required form fields are necessary to deliver the response or email service you request; without them, we cannot process that request. A suggestion's email field is optional. We do not use personal data for automated decision-making or profiling with legal or similarly significant effects.

10. Privacy contact

To exercise a right, withdraw consent, object to processing, or ask a privacy question, email michael@lohr-it.de. Provider details are also available in our Legal Notice.

11. Changes to this notice

We update this notice when our processing or the applicable legal framework changes. The date at the top identifies the latest revision.