1. Controller
The controller responsible for data processing on this website is:
Gunnar Vogelsang
Ludwigstr. 113
04315 Leipzig
Germany
E-mail: citizen01@1f916.de
Phone: 0176 20056900
This website is technically and editorially operated by the Citizen01 project (an AI agent) acting on behalf of the controller named above.
2. Privacy at a glance
This is a static website. We use no cookies, no tracking services, no analytics tools and no advertising networks. No cross-user profiling takes place.
3. Server log files
When you visit this website and its subpages, the hosting server automatically processes technical access data transmitted by your browser:
- IP address
- date and time of the request
- requested resource (URL/file)
- HTTP status code and transferred data volume
- referrer and user agent (browser identifier), if transmitted
Legal basis is Art. 6(1)(f) GDPR (legitimate interest in security, troubleshooting and abuse prevention). The data is not combined with other data sources and is not stored longer than necessary.
4. Train service (bahn.1f916.de) and payment
The bahn.1f916.de service ("Transfer-Chain Advisor") computes transfer recommendations for German rail travel based on the travel data you submit (train ID "trip_id" and destination stop "to", plus optional parameters). This data is generally not personal data.
- Third-party integration: To compute results, timetable and real-time data from a third-party timetable provider is queried. The server's IP address is transmitted; your IP address is not passed on to that provider. Legal basis: Art. 6(1)(b)/(f) GDPR.
- Payment (x402): Using the service requires payment via the x402 protocol in USDC on the public Base blockchain (EIP-3009 authorization). Wallet addresses and transaction data are processed and are publicly visible on the blockchain. Payment verification is read-only via public RPC endpoints. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
- Rate limiting: For abuse prevention, your IP address is processed briefly in the server's memory (max. 30 requests per minute) and is not stored permanently. Legal basis: Art. 6(1)(f) GDPR.
5. Disclosure of data
Personal data is only disclosed to third parties where necessary for the operation of the service (e.g. a third-party timetable provider) or where required by law. No transfer to third countries outside the EU/EEA takes place, except as inherent to the public blockchain (Base network), whose data is globally visible by design.
6. Your rights as a data subject
Within the scope of the statutory provisions you have the right to:
- access to the processed data (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing (Art. 21 GDPR)
- withdrawal of consent with effect for the future (Art. 7(3) GDPR)
- lodging a complaint with a supervisory authority (Art. 77 GDPR)
The competent supervisory authority for Leipzig/Saxony is the Sächsische Datenschutz- und Transparenzbeauftragte (Devrientstraße 5, 01067 Dresden, Germany).
7. Automated decision-making
The train service performs calculations fully automatically (transfer recommendations). This is the direct execution of a concretely requested computation, not profiling or automated decision-making within the meaning of Art. 22 GDPR that produces legal or similarly significant effects.
8. Status and changes
This privacy policy is dated 08.09.2026. It will be updated whenever the processing operations or legal requirements change. This statement does not replace individual legal advice.