Privacy

This policy covers this website and nothing else: tryadrift.com, and the email address you can leave here for occasional news. It does not cover the Adrift app. The app handles things this website never sees, such as where you were standing when you released a bottle, and it is covered by its own policy rather than by this one.

Who is responsible

The controller for the processing described here, in the sense of the General Data Protection Regulation (GDPR), is:

Simon Berriman
sole trader (freelance)
Karl-Rothe-Str. 4
04105 Leipzig
Germany

Email: hello@tryadrift.com
Telephone: +49 15207075439

Adrift is operated from Germany, so German and EU data protection law applies. Full provider details are on the Impressum. There is no statutory obligation to appoint a data protection officer at this size, and none has been appointed; write to the address above and it reaches the person responsible.

What we collect, and why

The news list

If you submit the form, we store your email address, the time you sent it, which part of the page you sent it from, the status of your signup, and a copy of the sentence printed beside the field so there is a record of what you agreed to. That is the whole record. We do not ask for and do not store your name, your country, your date of birth or anything about your device.

We use it for one thing and nothing else: to tell you something worth knowing about Adrift, now and then. It is not a newsletter, we run no campaigns against it, we do no profiling and no behavioural targeting, and we will never sell it, rent it, or pass it to anybody else's marketing.

Legal basis: your consent, Art. 6(1)(a) GDPR. Sending marketing or promotional email in Germany also requires consent under § 7 UWG, and this is it.

The confirmation email

Submitting the form does not put you on the list. It stores your address as pending and sends one email asking you to confirm. If you do not click the link, nothing further is ever sent, and the pending record is deleted. Anybody can type somebody else's address into a form, so this step is how we know the person at the address actually asked.

Legal basis: our legitimate interest in checking that an address belongs to the person who submitted it before we treat it as consent, Art. 6(1)(f) GDPR. Once you confirm, the list itself runs on your consent as above.

Server logs

Our hosting provider records the technical detail of requests to the site, which includes your IP address, the time, the page requested, the referrer and your browser's user agent string. This is how a web server is operated and how attacks and faults are investigated. We do not use these logs to build a picture of individual visitors, and we do not combine them with the news list.

Legal basis: our legitimate interest in serving, securing and debugging the site, Art. 6(1)(f) GDPR.

Protecting the form

To stop the form being scripted, and to stop it being used to send repeated email to somebody who never asked, we keep a short-lived count against a hash of the network address a submission arrived from and a hash of the address submitted. The hashes are salted, they rotate daily, and neither the IP address nor a readable email address is written into that counter. The rows are deleted after a day.

Legal basis: our legitimate interest in preventing abuse of the form and in not becoming the means by which a stranger is sent unwanted email, Art. 6(1)(f) GDPR.

The shop

Adrift merchandise is not sold by us. You browse it here and you buy it from Spreadshirt, who print each thing, take the payment, charge the tax, post it and deal with returns. We never see your order, your name, your delivery address or your card details, and there is no checkout and no order record anywhere on tryadrift.com.

The product pictures and prices you see here are fetched from Spreadshirt by our server, not by your browser. That is a deliberate choice: it means looking at the shop tells Spreadshirt nothing about you at all. Their systems learn of you at the moment you press Checkout and are handed the basket you built, and not a moment before.

This matters for who is answerable to you. Spreadshirt is not processing anything on our behalf, so they are not a processor of ours in the sense of Art. 28 GDPR — for your purchase, they are their own controller. If you want to know what they hold about you, or want it deleted, that request goes to them, and their privacy policy is the one that applies from the moment you follow the link.

Spreadshirt runs two separate shops, one printing in Europe and one in North America. To put the nearer one first, our hosting provider tells us which country your request appears to come from, at the level of a two-letter country code and nothing finer. We use it to decide which of two links to print at the top of the page, and then we discard it: it is not stored, not written to the event counts above, not attached to anything and not used to recognise you. The other shop is always shown as well, so a wrong guess costs you a scroll.

Legal basis: our legitimate interest in showing you the shop that can actually post to you cheaply, Art. 6(1)(f) GDPR.

Counting six things

We count that a page was viewed, that the form was submitted, that a signup succeeded, that a confirmation link was clicked, that the shop page was opened and that somebody followed a link out of it to the shop. Each count stores an event name and a page path, recorded by our own server. No IP address, no user agent, no session identifier, no visitor identifier, no cookie and no fingerprint is stored, so these counts cannot be tied to you, joined into a profile or used to recognise you on a later visit.

The two shop counts do not record which shop you chose, what you looked at or whether you bought anything. We cannot see any of that: once you follow the link you are on Spreadshirt's site, and what happens there is between you and them.

Legal basis: our legitimate interest in knowing whether the site works, Art. 6(1)(f) GDPR, to the extent this is personal data at all. Because nothing is stored on or read from your device, § 25 TDDDG does not require your consent for it, and that is why you have not been shown a consent banner.

Cookies and anything stored on your device

No cookies. This site sets none, and reads none.

There is exactly one thing written to your device, and only if you use the shop: your basket. It is stored in your browser's local storage under a single key, and it holds the products you have added and how many of each. That is all it holds. It is not an identifier, it says nothing about who you are, we cannot read it from here, and it never leaves your device except at the moment you press Checkout — when the contents are sent to us so we can build the basket that Spreadshirt's checkout opens with.

Why this needs no consent banner: § 25 Abs. 2 Nr. 2 TDDDG does not require consent for storage that is strictly necessary to provide a service you have expressly asked for. A basket that empties every time you open a new page is not a shop. Nothing else is stored, and nothing stored is used for analytics, advertising or recognising you on a later visit.

You can clear it at any time by emptying your basket, or by clearing site data in your browser. Nothing else on this site — the homepage, the app pages, the legal pages — writes anything at all.

A banner would ask you to consent to something that either is not happening or that you cannot meaningfully decline without the shop ceasing to work, which is worse than no banner: it teaches people that clicking accept is meaningless. If anything non-essential is ever added, the banner arrives at the same time as the thing that needs it, and nothing non-essential will run before you have agreed to it.

Fonts and other third parties on the page

The two typefaces this site uses are stored in the project and served from tryadrift.com. Your browser makes no request to fonts.googleapis.com, fonts.gstatic.com or any other font service, so your IP address is not disclosed to one. There are no third-party analytics scripts, no advertising or conversion pixels, no session recording, no chat widget, no embedded video and no external image or script CDN. Loading any page on this site, the shop page included, contacts our own domain and nothing else.

The map of the ocean on the front page is worth being specific about, because maps usually are not like this either. It contacts no tile server. The coastline is a file stored in this project, drawn from Natural Earth's public domain data and served from tryadrift.com like everything else, and the map software itself is served from here too. No map provider learns that you looked at it.

The shop page is worth being specific about, because shops usually are not like this. It loads no script, no image and no font from Spreadshirt. There is no embedded storefront and no product feed. It is a page we wrote, with two links on it, and Spreadshirt learns nothing about you until you choose to follow one.

The footer links to our profiles on X and Instagram, and the shop page links to Spreadshirt. Those are ordinary links, with the icons drawn in the page rather than fetched: no follow button, no embedded timeline, no follower count and no storefront widget, so nothing from any of those companies runs here or sees you unless you choose to click through. If you do, you are on their site and their privacy policy applies, not this one.

Who else processes this data

A small number of providers process data on our behalf, as processors under Art. 28 GDPR and under their own data protection terms:

• Vercel — hosting for this website. Serves the pages and generates the server logs described above.
• Supabase — the hosted Postgres database that stores the news list, the event counts and the abuse counters. The database itself is in Ireland.
• Resend — sends the confirmation email, and any news email after it. Receives your address in order to deliver to it.

That is the complete list. We disclose data to nobody else, except where we are legally required to.

Spreadshirt is deliberately not on that list. They do not process anything for us and we send them nothing — not your address, not your email, not a customer record, not an identifier. If you buy something, you gave it to them yourself on their site.

Transfers outside the EEA

We chose where we could. The database holding the news list runs in Supabase's Ireland region, so the addresses themselves sit inside the European Economic Area rather than crossing it.

All three providers are nonetheless US companies, and a US parent can reach its own infrastructure for support and administration. Where personal data does leave the EEA, the transfer is covered by the European Commission's standard contractual clauses or another mechanism permitted by Chapter V GDPR, including the EU-US Data Privacy Framework where the provider is certified under it. You may ask us which applies to a given provider and we will tell you.

How long we keep it

• Unconfirmed signups. A confirmation link lasts 72 hours. If it is not used, the pending record is deleted 30 days after it expires. An address nobody confirmed is an address nobody proved was theirs, and there is no reason to hold it.
• Confirmed signups. Until you unsubscribe or ask us to delete you, and in any case no longer than we need the list for the occasional news it exists for.
• Unsubscribes. If you unsubscribe, we keep your address marked as do-not-email so that a later send cannot pick it up again. That note is kept on the basis of our legitimate interest in honouring your objection, Art. 6(1)(f) GDPR. Ask us to delete it outright and we will.
• The consent record. Kept for as long as we hold the address, because Art. 7(1) GDPR requires us to be able to show what you agreed to.
• Abuse counters. Deleted after a day.
• Server logs. Kept for the short period our hosting provider retains them for security and diagnostics, and not copied anywhere by us.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15)
• have inaccurate data corrected (Art. 16)
• have your data erased (Art. 17)
• have processing restricted (Art. 18)
• receive your data in a portable form (Art. 20)
• object to processing based on legitimate interests (Art. 21)

Write to hello@tryadrift.com and we will do it. We do not require you to prove your identity beyond replying from the address in question, and we will not make you explain why.

Withdrawing your consent

You can withdraw your consent to the news list at any time, and it is as easy to withdraw as it was to give. Every email we send carries an unsubscribe link that works in one click and needs no login. You can also simply write to hello@tryadrift.com.

Withdrawing does not affect the lawfulness of anything processed before you withdrew, Art. 7(3) GDPR. There is no consequence to withdrawing: there is nothing to lose access to.

Complaining about us

If you think we have handled your data wrongly, please tell us first, at hello@tryadrift.com. You do not have to. You have the right under Art. 77 GDPR to complain to a data protection supervisory authority, either the one where you live or work, or ours, which is:

Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner)
Maternistraße 17
01067 Dresden
Germany
www.datenschutz.sachsen.de

Automated decisions and children

Nothing here makes an automated decision about you and nothing profiles you. The site is not aimed at children, we have no reason to think children are signing up, and if you believe a child's address has been submitted, tell us and we will delete it.

The app

None of what the app does happens here. This website never sees an account, a position, a bottle or a photograph, and nothing described on this page is shared with the app or fed by it.

The app has its own privacy policy, which covers your position, what you write, photographs, notifications and what happens when you delete your account. If you use both, both apply, separately.

Changes to this policy

The date at the top says when this version was written. If we change something material we will change that date, and if the change affects the news list we will say so in the next email rather than quietly editing the page.

Contact

hello@tryadrift.com, for anything on this page.

This policy describes what the site actually does, written by the person who built it. It is not a lawyer's work and has not been reviewed by one.