1. Controller
Tristan Stumpp, Hauptstraße 4, 75228 Ispringen, Germany · Phone: +49 172 6229953 · Email: wheelwonderland@gmx.de
2. Principle
No tracking or advertising cookies and no third-party analytics. Fonts and preview images are served from our own server; visiting the site creates no third-party connections.
2a. Usage statistics without cookies
Our own server counts page views so we can see which pages are used. We store totals only: date, page, language, referring domain and the type of action (e.g. a click to YouTube). No IP addresses, no cookies, no device identifiers are stored. To count a visit once per day we build a non-reversible check value from IP address, browser string, the current date and a secret key; it is deleted after 60 days. We cannot recompute your IP address from it, and we cannot recognise you again once the date changes. While the value exists we treat it, as a precaution, as pseudonymous and therefore personal data: it is never combined with other data, never passed on and used only for counting. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in simple, privacy-friendly statistics); no information is stored on or read from your device (§ 25(2)(2) TDDDG).
3. Hosting
Our host Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaka, Zypern processes technically necessary data (IP address, time, page, browser). Legal basis: Art. 6(1)(f) GDPR. Log files are kept only as long as needed for secure operation and then deleted automatically. A data processing agreement is in place. Delivery runs through the same provider’s content delivery network; an edge server (in Frankfurt am Main for requests from Europe) processes the IP address in order to deliver the request and to fend off excessive automated access. The provider uses its own sub-processors; edge locations depend on where visitors are, so a transfer to third countries cannot be ruled out. It is based on the European Commission’s standard contractual clauses.
4. YouTube
Links open YouTube in a new tab. Embedded videos load only after your consent via “Play here”, in privacy-enhanced mode (youtube-nocookie.com); data such as your IP address is then sent to YouTube (Google Ireland Limited), possibly also to Google LLC in the US (EU-US Data Privacy Framework).
5. Amazon Associates (affiliate links)
We participate in the Amazon Associates program. Clicking an ad-marked Amazon link takes you to Amazon, where Amazon may set cookies to attribute a commission. No data is sent to Amazon from our site itself.
5a. Merch shop (Fourthwall)
We do not run our merch shop ourselves, and it is not hosted on our server: it runs at wheel-wonderland-shop.fourthwall.com on the platform of Fourthwall, Inc., 2041 East St. Suite 1090, Concord, CA 94520, USA. If you follow a link to our shop, you leave our website; from there Fourthwall’s privacy notice applies. No data is sent to Fourthwall from our site itself. Fourthwall states that its services are hosted in the United States – opening the shop page therefore transfers data to the US; for transfers from the EEA, Fourthwall relies on the European Commission’s standard contractual clauses. According to Fourthwall, the seller of the goods is Fourthwall, Inc. itself (“merchant of record”), not us: ordering, payment, printing and shipping all happen at Fourthwall and its manufacturing and fulfilment partners. You enter your payment details with Fourthwall’s payment providers (Stripe and PayPal among others, according to Fourthwall); we never see payment details. For an order we receive the order and customer details from Fourthwall, such as name, email address, shipping address and the order itself. Questions about Fourthwall’s own processing: privacy@fourthwall.com; as its EU representative under Art. 27 GDPR, Fourthwall has appointed the European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium.
6. Local storage
Garage, parking lot (wishlist), the cars you skipped in the discover stack, your filters there, language and theme are stored only in your browser (localStorage) and never leave your device.
6a. Card scanner (camera)
The scanner reads the toy number from the back of the card. The text recognition is hosted by us and runs entirely in your browser: no image is transmitted and nothing is stored. The camera is switched on only when you open the scanner and your browser has asked for permission; “Camera off” or closing the window ends the access immediately. You can withdraw the permission in your browser settings at any time and type the number instead.
6b. Discover stack
On the “Discover” page we show you a limited daily selection of cars, one at a time. We remember your choice – not for me, I have it or park it – so the same car is not shown again and the next suggestions fit you better. Which cars are suggested is computed by your own browser from your garage and your parking lot, using only data from our database (casting, series, product line, base colour, wheel type). Without a membership all of this stays in your browser. As a member it is stored with your account so it is the same on all your devices (Art. 6(1)(b) GDPR). Skipped cars are strictly private: they never appear on any public profile, in any count on a model page, in any leaderboard or in any trade search. There is no profiling for advertising and no transfer to third parties. You can clear the list at any time via “Show skipped cars again”, and it is deleted together with your account.
7. Members area (optional)
Sign-in: only your email address; we send a sign-in link (no password). After signing in we set two strictly necessary cookies: “wwsid” (session, 60 days, server-only) and “wwm” (a “signed in” hint without content). Legal basis: Art. 6(1)(b) GDPR.
Profile and collection: member name, optional display name, country, short bio, collecting focus and your “have”, “want” and “trade” entries. If your profile is public (default, can be switched off), others see these – never your email address.
Three separate visibility decisions. “Profile public” is only the first of them, and the other two are off by default: (1) Public profile (on by default) – other visitors can view your profile. (2) Appear in the community feed (off by default) – your actions, such as a new photo, are named in “What is happening” with your member name; without this consent we only count you in anonymous totals. (3) Own profile page for search engines (off by default) – only this gives your profile its own address that Google and other search engines can index. A public profile alone is therefore not findable on Google. You can switch all three on and off individually under “Profile” at any time.
Private details per car: for each entry you may optionally record condition, quantity, purchase date, purchase price, storage place and a note. These details stay private: they never appear in your public profile or in any ranking, are never added up into a collection value and are never passed on. They are part of your data export and are deleted with your account (Art. 6(1)(b) GDPR).
Hints about model data: if you report a wrong detail or add a variant, we store your hint together with your member name so that we can check it and come back to you with questions. Nothing is adopted unchecked, and the hint itself is not shown publicly (Art. 6(1)(b) and (f) GDPR – accuracy of the database).
Messages: stored to deliver them. Chat is for members aged 16+ only. You can block members and report content; we review reports. Optional email notifications (can be switched off).
Photos on model pages: we remove metadata (e.g. GPS) and resize uploads. You confirm the usage rights with the checkbox in the upload dialog; we then review the photo by hand and publish it on the model page with your member name. As proof we store the exact wording of the rights notice shown to you, the time, your email and a hashed IP value. We keep that proof for as long as the photo is published – it is our evidence that we are allowed to show it (Art. 6(1)(f) GDPR).
Collector Showcase: images you post to the showcase are public immediately, without any prior review by us, and visible without signing in. We store the image, your title and description, the category, your member name, the number of likes and the same rights proof as above. Your own likes on other members’ images are stored too. If an image wins the week, that entry remains in the Hall of Fame. Every visitor can report an image, no account needed; we review reports and can hide an image at once.
Trade exchange: for an offer we store the model, condition, packaging, flaws, shipping details, your note and your want list, plus any offer photos. Offers and offer photos are visible only to signed-in members and never appear on model pages; they are not reviewed in advance. Which offers you watch is stored as well.
Completed trades and ratings: when you agree a trade we store who traded which offers with whom, with time and status. After a confirmed trade each side may rate the other once (stars for description, communication and packaging, an overall score and a short text). Ratings appear publicly on the rated member’s profile with the rater’s member name (Art. 6(1)(b) and (f) GDPR – trust within the trading community).
Comments: you can comment on events and individual topics. A comment is public immediately and shown with your member name if your profile is public – otherwise without a name. We do not review comments in advance and remove them on report.
Events you submit: if you submit a swap meet or meetup we store the title, type, dates, location with address, organizer, contact details and links, plus the time and version of the disclaimer you accepted. An event is published only after we approve it; it is then publicly visible.
Case sightings: store, city, country, date and your member name are shown publicly.
Email delivery: via our host’s mail server (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaka, Zypern). Abuse protection: a hashed IP value is stored briefly to limit sign-in and message attempts.
Retention and what deletion removes: we keep your data until you delete your account (any time under “Profile”). Sign-in links expire after 30 minutes.
Deletion fully removes: your profile including your email address, your collection, your messages, your sightings, your comments, your trade offers including offer photos, your watches, your block lists, your showcase images including the image files and likes, the ratings about you, and photos not yet approved.
Three things deliberately remain, in every case without any link to you – your member name and email address are removed: (1) photos already approved for model pages, under the license you granted; we remove these too if you ask. (2) A Hall of Fame entry, if an image of yours won the week – the image itself is deleted, only the entry remains so the list shows no gap without origin. (3) Ratings you wrote about others, completed trades, your hints about model data, events you submitted that were approved, and reports you filed; these concern other people or the accuracy of the database. If your email address was listed as the contact in an event you submitted, it is removed.
Data export: download all your data under “Profile” (Art. 15, 20 GDPR).
8. Your rights
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent; right to complain to a supervisory authority.