Privacy Policy

Last updated: May 4, 2026

1. Data Controller

The controller responsible for data processing under the EU General Data Protection Regulation (GDPR) and other applicable national data protection laws is:

Leon Ulicnik
Smoke-Oh Studios
Bahnhofstr. 27
24837 Schleswig
Germany
Email: info [at] smoke-oh.com

2. General Notes

We take the protection of your personal data seriously and treat any personal information confidentially and in line with applicable data protection law and this policy. This document describes what data is processed when you use smoke-oh.com, for which purpose, on which legal basis, and the rights you have.

3. Hosting and Server Logs

This website is operated on a third-party host. Each time a page is requested, the host automatically writes server logs that may contain:

• IP address of the requesting device (truncated where technically possible)
• Date and time of the request
• Name and URL of the requested file
• Volume of data transferred
• HTTP status code
• Browser type, operating system and referrer URL

These data are technically necessary to deliver the website, secure its stability, and defend against attacks.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technically faultless operation).
Retention: Maximum of 14 days, after which logs are deleted automatically.

4. Cookies and Local Storage

This website does not set tracking cookies of its own. The only client-side data we write is:

• Technically required local-storage entry with the key smoke-oh:consent:v1, used to remember your decision regarding embedded third-party players (Spotify, YouTube, Apple Music). Legal basis: § 25(2)(2) TTDSG, Art. 6(1)(f) GDPR.

Embedded third-party players only set their own cookies once you explicitly enable them via the placeholder card (see Section 7).

5. Analytics: Plausible

For audience measurement we use Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia).

Plausible is cookieless by design and builds no personal profiles. Only anonymised aggregate data is collected:

• Page URL
• Referrer (referring page)
• Browser type and operating system (categorised)
• Country (derived from IP, then discarded)
• Device type (desktop/mobile/tablet)

IP addresses are used briefly for geo-resolution and are not stored.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-preserving statistics).
Retention: Aggregated statistics are kept indefinitely as they contain no personal data.

6. Contact Form and Newsletter

When you send us a message via the contact form or sign up for the newsletter, the message and your email are processed by the relay service FormSubmit (FormSubmit, USA), which forwards them to our inbox.

Data collected:

• First and last name (if provided)
• Email address
• Subject and message body

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(a) GDPR (consent given by submitting the form).
Third-country transfer: Processing takes place in the United States. FormSubmit relies on the EU Standard Contractual Clauses (SCC) as a safeguard under Art. 46 GDPR.
Retention: Until your request has been fully handled; for the newsletter, until you withdraw consent. You can unsubscribe at any time by emailing info [at] smoke-oh.com.

7. Embedded Players (Spotify, YouTube, Apple Music)

Several pages embed third-party players. These are blocked by default (two-click solution). Only after you actively confirm via „Allow & load player" does the player load, and only at that moment does the provider set its own cookies and process personal data.

7.1 Spotify

Provider: Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. Activating the player sets cookies and may transmit personal data (IP, device info) to Spotify. Privacy policy: spotify.com/legal/privacy-policy

7.2 YouTube

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. On activation, a connection to Google is established and data is transferred to the United States (Standard Contractual Clauses). Privacy policy: policies.google.com/privacy

7.3 Apple Music

Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland. Privacy policy: apple.com/legal/privacy

Legal basis for activation: Art. 6(1)(a) GDPR (your consent). You can withdraw consent at any time by deleting the local-storage entry smoke-oh:consent:v1 in your browser.

8. Self-Hosted Fonts and Images

Fonts and images are served exclusively from our own server. There is no connection to Google Fonts, Adobe Fonts, or comparable CDN services.

9. Your Rights as a Data Subject

You have the following rights at any time:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restrict processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — the competent authority for our location is the Independent State Centre for Data Protection Schleswig-Holstein, Kiel

To exercise these rights, an informal email to info [at] smoke-oh.com is sufficient.

10. SSL Encryption

For security, this website uses SSL encryption (HTTPS). You can recognise an encrypted connection by the https:// prefix in your browser address bar and the lock icon.

11. Changes to this Policy

We reserve the right to update this privacy policy in line with changes to applicable law or to our services and processing activities. The current version is always available on this page. Current version dated: May 4, 2026.