Privacy Policy

This policy explains transparently which data is processed when you use serkal.de and SerKal. The website, public desktop release and development previews are described separately.

Last updated: 8 October 2026

1. Scope and principle

This Privacy Policy applies to the serkal.de website, the publicly available SerKal Desktop version 1.1 and – where explicitly identified – non-public development and Android preview versions.

In short: SerKal does not operate a central user account or its own database containing your series. The public desktop release stores the archive, settings and Google access tokens locally on your device. Data leaves your device only where required for a feature you choose to use – in particular TMDB and Google Calendar – or where you place your archive folder inside a folder synchronized by another provider.

2. Controller

Kurt Vogelsaenger
Planiger Straße 26
55543 Bad Kreuznach
Germany

Phone: +49 172 7153997
Email: k.vogelsaenger@t-online.de

You may contact this address at any time with “SerKal privacy” in the subject line. No data protection officer has been appointed because there is currently no statutory obligation to appoint one.

3. Visiting serkal.de

Delivery and server logs

Technically necessary connection data is processed when you access the website. This may include the IP address, date and time, requested file or URL, referrer URL, browser and operating-system details, HTTP status and amount of data transferred. It is used to deliver the pages, maintain stability, diagnose errors and prevent misuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of this website. The hosting provider is INWX GmbH, Prinzessinnenstraße 30, 10969 Berlin, Germany; the hosting locations used for this service are in Germany. Server logs are retained only for as long as necessary for operation and security or as required by contractual or statutory obligations.

Cloudflare

Cloudflare is used for Domain Name System (DNS) and technical protection functions. Where requests are routed through Cloudflare proxy or security functions, Cloudflare processes the IP address and technical request information in particular in order to deliver content and mitigate attacks. The legal basis is Article 6(1)(f) GDPR. For processing outside the European Economic Area, the provider relies on the applicable data protection safeguards. See the Cloudflare Privacy Policy.

No website trackers

As currently implemented, SerKal does not use analytics or advertising services, social-media pixels, externally loaded fonts, embedded videos or contact forms on this website. SerKal itself does not set cookies or write to browser Local Storage merely because you visit the site.

The website contains ordinary links to external sites such as TMDB. Only when you open such a link does the relevant provider receive technically necessary connection data; depending on your browser, the referring page may also be transmitted.

4. Contacting us

If you contact us by email or telephone, we process your contact details, the contents of your message and the accompanying data needed to respond. Processing takes place to answer your request (Article 6(1)(f) GDPR) or, if the request concerns a user or contractual relationship, under Article 6(1)(b) GDPR. The data is deleted once the request has been finally resolved, unless statutory retention obligations or legitimate reasons require further storage.

5. Public SerKal Desktop version 1.1

Local data

SerKal processes locally on your computer in particular:

series and season titles, TMDB IDs, episode counts and broadcast dates;
German and English descriptions, your notes, watched information and status;
settings and TMDB credentials in the Electron user profile;
Google calendar ID and OAuth access and refresh tokens in google_calendar_token.json;
log files named !!SERKAL_LOG_YYYY-MM-DD.txt in the selected archive folder; they may contain process, series, calendar and error information.

You choose the archive folder. If it is located in Google Drive, OneDrive, Dropbox or another synchronized folder, transmission is performed by that provider's synchronization client – not by a direct SerKal cloud feature. The provider's own privacy terms apply.

Security notice: Public desktop files and OAuth tokens currently receive no additional file encryption from SerKal. Protection is provided in particular by your operating-system account, full-disk encryption and file permissions. Do not share these files.

SerKal does not automatically upload the local archive to a SerKal server. There is no fixed automatic deletion period for local archive and log files; you control retention by deleting them. Review logs before sending them to support.

6. Google Calendar in SerKal

The connection is optional and uses Google's OAuth sign-in. SerKal has no field for your Google password and does not receive that password.

Access	Purpose
`calendar.calendarlist.readonly`	List existing calendars to find the SerKal calendar.
`calendar.calendars`	Create and manage the calendar intended for SerKal.
`calendar.events.owned`	Read, create, change and delete series and episode events in calendars you own.

The technical Google permissions are not limited exclusively to one calendar. SerKal uses them for the stated purpose: finding or creating the SerKal calendar and managing the intended series and episode events in it. The series, season, episode and date information needed for those events is transferred to Google and stored in your Google Calendar.

OAuth tokens and the calendar ID are stored locally. You may revoke SerKal's access in your Google Account security settings. Revocation does not delete existing calendar events or local SerKal files; these must be deleted separately.

SerKal's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. SerKal does not sell Google user data, use it for advertising or disclose it for unrelated purposes.

7. TMDB

To search for series, seasons, episodes and images, SerKal sends direct requests to api.themoviedb.org; images are loaded from image.tmdb.org. Search terms, TMDB IDs, language setting, API credentials and technically necessary connection data such as the IP address may be processed. The local SerKal archive is not automatically uploaded to TMDB as a whole.

The service is provided by The Movie Database (TMDB). The TMDB Privacy Policy also applies. SerKal uses TMDB data but is not an official TMDB product.

8. Development and Android preview versions

Important: This section applies only to versions explicitly identified as alpha, development or Android preview builds. The Google Drive functions below are not part of public Desktop version 1.1.

These preview builds may additionally use the Google permissions drive.appdata, openid and userinfo.email. SerKal then processes the Google account ID, email address and verification status to associate the account and can use only its own app data area (“appDataFolder”), which is not visible to other apps. This does not provide SerKal with general access to “My Drive”.

Shared TMDB credentials

A TMDB key may be stored in the app data area as serkal-tmdb-key-v1.json with a schema value and Google account ID. SerKal currently adds no end-to-end encryption to that cloud file. The Android app encrypts its local key cache with AES-GCM and Android Keystore; the desktop preview stores a local cache in tmdb.json and a separate Google token in google_shared_key_token.json.

Archive snapshot

The desktop preview may write serkal-archive-v1.json to the Google app data area. It may contain account and source ID, timestamp, title, year, season, TMDB ID, episode count, start and end dates, German and English descriptions, free-form notes and watched status. It excludes raw TXT lines, local file paths and API or OAuth credentials. Free-form notes may still contain personal or confidential information; enter only content that you want stored in your Google Account.

Android reads this snapshot into memory and discards it when the account changes. Writing from Android and protection against simultaneous writes have not yet been implemented.

There is currently no automatic expiry and no confirmed complete in-app deletion function for data in the Google app data area. Uninstalling the app alone does not delete this cloud data. Preview users may revoke Google access and contact the address above for version-specific deletion help. Until a verified deletion function exists, preview builds must not be advertised as automatically deleting cloud data.

9. Recipients, legal bases and international processing

Data is disclosed only to providers needed for the relevant feature, in particular INWX (hosting), Cloudflare (DNS/security), Google (OAuth, Calendar and, for preview builds, app data) and TMDB (series metadata and images). SerKal does not sell personal data.

Depending on the feature, processing is based on your voluntary consent or activation (Article 6(1)(a) GDPR), provision of the function you request (Article 6(1)(b) GDPR), or our legitimate interest in a secure and functional service (Article 6(1)(f) GDPR).

Google, Cloudflare and TMDB may also process data outside the European Economic Area. Where required, this is based on an adequacy decision or appropriate safeguards, in particular Standard Contractual Clauses. Please also consult the respective provider's privacy information: Google, Cloudflare and TMDB.

10. Retention and deletion

Website logs: only as long as necessary for operation, security or legal duties; details also depend on the hosting configuration.
Contact requests: until finally resolved, then only where statutory or legitimate retention reasons apply.
Local SerKal data: until you delete archive, log, settings and token files or reset SerKal accordingly.
Google Calendar data: until you delete the relevant events or calendar in Google Calendar. Revoking permission does not delete them.
Preview Google app data: no automatic period; uninstallation and permission revocation do not automatically delete it. Use deletion options in your Google Account or contact us for version-specific guidance.

11. Your data protection rights

Subject to the applicable statutory conditions, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with future effect. Where processing is based on Article 6(1)(f) GDPR, you may object for reasons arising from your particular situation.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for the controller is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate.

Much SerKal data exists only on your device or in your own Google Account. Because we do not possess a central copy, we cannot inspect or delete that data without your participation, but we will gladly provide concrete steps for your version.

12. Security and changes

The website and connections to Google and TMDB use encrypted HTTPS/TLS transport. Absolute security cannot be guaranteed. Keep your operating system and SerKal up to date, protect your user account and do not share token, archive or log files without checking them.

This policy will be updated when features, providers or legal requirements change. The current version is permanently available at https://serkal.de/privacy-en.html.