✦Best Day To Ask

Privacy notice

Datenschutzerklärung. Information under Articles 13 and 14 GDPR.

The short versionYour birth date, time and place are used to calculate your chart and then thrown away. They are never written to a database, never logged, and never sent to anyone. There are no accounts, no advertising and no cross-site tracking. Visits are counted with a cookieless statistics tool that stores nothing personal — so there is no cookie banner either.

Controller

Ľubomír Eröš, Jarná 65, 082 52 Dulova Ves, Slovakia. Email: lubomir.eros@gmail.com.

Birth data

To rank days for you, Best Day To Ask needs your date of birth, time of birth and place of birth. This is personal data, and it is handled as follows:

  • It is sent to our server, used to compute your chart, and included in the response.
  • It is not stored — there is no database table holding it, and no file is written.
  • It is not written to application logs.
  • It is not transmitted to any third party.

Once the response has been sent, the data is gone from our side. If you reload the page it is recalculated from what you type in again. Legal basis: Article 6(1)(b) GDPR — performing the service you asked for.

Place search

When you type a place name, that text alone is sent to Open-Meteo’s geocoding API to obtain coordinates and a time zone. No identifier, cookie or other detail about you accompanies it. If you prefer not to use it, the form lets you enter coordinates and a time zone by hand.

Passes and payment

If you buy a pass, payment is handled entirely by Stripe on Stripe’s own pages. We never see or store your card details.

What we store for a pass is deliberately minimal, and contains nothing personal:

  • a randomly generated pass code;
  • which plan it is and when it expires;
  • the timestamp at which you confirmed immediate access;
  • the Stripe checkout session reference, so one payment cannot yield two passes;
  • how many searches it has run on each day, so that a code passed around widely can be capped.

There is no email address, name or address in that record — which is also why we cannot look your pass up for you if you lose the code. The pass code is held in a strictly necessary cookie (bdta_pass) so your browser stays unlocked; its lifetime matches the pass. Legal basis: Article 6(1)(b) GDPR. Stripe retains payment records independently for as long as tax law requires.

You can delete the stored pass record at any time from the restore page. That is immediate and irreversible.

Server logs

Our host records technical request data, including IP address, timestamp, requested URL and user agent, to deliver the site and defend against abuse. We do not combine these with anything else or use them to build profiles. Legal basis: Article 6(1)(f) GDPR — legitimate interest in a functioning, secure service.

On the pricing page, the country your IP address belongs to — as estimated by our host — is used for one thing: showing prices in US dollars to visitors in the United States and in euros to everyone else. It is used for that page view and not stored.

Visitor statistics — and what we count

There is no advertising, no social plugins and no cross-site tracking of any kind. The only cookie that is ever set is the pass cookie described above, and only once you have bought a pass.

To see which parts of the site are useful, we use Umami, a privacy-focused statistics service. Its script counts page views and a few actions — a search being started or finishing, a date on a wedding calendar being clicked, a checkout being opened, a pass being bought — together with the occasion or plan concerned. It sets no cookies and stores nothing on your device. It records the page address without its query string, the referring site, browser, operating system, device type, screen size, language, and the country estimated from your IP address; the IP address itself is not stored. Visits are grouped by a pseudonymous identifier that is not shared across websites. Your birth details, places, the dates you check and your pass code are never sent to it. Legal basis: Article 6(1)(f) GDPR — legitimate interest in knowing how the site is used.

What we do keep, on the server, is a daily tally of searches: how many were run, for which occasion, roughly how long a window was asked for, and whether it was on the free tier or a pass. It holds no birth details, no IP address and no pass code — nothing that could identify you — and exists so we can tell whether the site is being used at all. The server log line for each search carries the same details plus a short one-way fingerprint of the pass, so misuse of a single code can be spotted; it cannot be turned back into the code. Legal basis: Article 6(1)(f) GDPR — legitimate interest in knowing whether the service is used.

Security

  • All traffic is encrypted with HTTPS. Plain-HTTP requests are redirected, and browsers are told to use HTTPS for this site only.
  • Card details are entered on Stripe’s own pages and never reach our server. Stripe is certified to PCI DSS Level 1, the highest standard for handling card data.
  • Your birth details are never stored, so there is no collection of them that could be lost or breached.
  • A pass code is generated by a cryptographic random number generator, from about 36 quadrillion possible codes. It is kept in a cookie that is only ever sent over HTTPS and cannot be read by scripts on the page.
  • The search statistics contain nothing that identifies you, and where a log refers to a pass, it does so by a one-way fingerprint that cannot be turned back into the code.
  • Access to the hosting and payment accounts is limited to the operator.

If you believe you have found a security problem, please write to lubomir.eros@gmail.com.

Processors and recipients

  • Netlify (USA / EU) — Hosting and delivery of the website and its serverless functions. Server logs including IP address. Netlify acts as processor under an EU data processing agreement.
  • Stripe (Ireland / USA) — Payment processing. Receives the payment data you enter directly on Stripe’s own checkout page. We never see or store your card details.
  • Open-Meteo (Germany) — Converting a place name into coordinates and a time zone. Receives only the place name you type. No identifier and nothing else about you is sent.
  • Umami (USA / EU) — Cookieless visitor statistics. Receives page views and a few named actions, never birth details or pass codes. The IP address is used to estimate a country and is not stored.

Transfers outside the EU

Netlify, Stripe and Umami may process data in the United States. Both are engaged under contractual arrangements based on the European Commission’s standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.

Your rights

Under the GDPR you may request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and object to processing (Art. 21). You may also lodge a complaint with a supervisory authority.

Please note honestly what this means here: because we hold no identifying data, we usually have nothing to give you in response to an access request. The one exception is a pass record, which you can inspect and delete yourself with your pass code.

Changes

This notice will be updated as the service changes. The date below reflects the current version.

Last updated: 2026-10-30