Privacy policy | The Omnigoal

What we know about you, and why

This site is a framework you can read from end to end without telling anyone anything. There is nothing to sign up for and nothing to buy. Personal data comes into it only in the few narrow cases set out below — and this page says for each of them what is collected, what allows it, how long it stays, and what you can require of us.

Last written 2026-08-23

Who is responsible

Controller: Andreas Baggesen
Capacity: An individual, not a company. The Omnigoal is run privately, so there is no company registration number.
Address: Grinden 27, 8960 Randers
Denmark
Contact: info@theomnigoal.com

One person decides what happens to this data and answers for it. There is no data protection officer, because the processing is not on a scale that requires one — and the address above reaches the person who makes the decisions rather than a department.

What is collected, and what allows it

Nothing is collected “just in case”. Each row below is a separate purpose with its own legal basis, and none of them is used for a different one later.

A closed list of people who asked to be told

What: For a period this site invited people to leave a name, an email address, which of three groups they belonged to, and anything they chose to add. That form is gone. The entries already given are still held.
Why: To tell those people, once, if what was being built ever becomes available to them. Nothing else is done with it, and no new entries are being taken.
What allows it: Their consent, given by submitting the form at the time (GDPR Article 6(1)(a)). The wording each person agreed to is stored word for word alongside their entry.
How long: Until they have been told, or until they ask to be removed — whichever comes first. If it never becomes available, until the list is deleted.

Having an account

What: Your email address, your name if you gave one, and a cryptographic hash of your password. Never the password itself.
Why: To let the few people who have one sign in. Accounts are made by hand; nobody can create one here.
What allows it: Necessary to provide what you asked for (GDPR Article 6(1)(b)).
How long: While the account exists. Deleted with the account.

Keeping the site up and safe

What: Ordinary server logs: IP address, browser, the page requested, the time. Held by the host.
Why: To keep the site running, to find faults, and to stop abuse.
What allows it: Legitimate interests in operating and securing the service (GDPR Article 6(1)(f)). The interest is narrow, the data is not used for anything else, and it is not combined with anything that identifies you.
How long: A short period set by the host, and not longer than needed to investigate a problem.

Counting visits

What: The page seen, the time, whether the browser was a phone or a computer, the country the host passes along, and a rolling pseudonym. The pseudonym is a one-way hash of a secret, the day, your IP address and your browser string. Your IP address itself is never written down, and the secret is replaced every night, so two days of counting cannot be joined back together into a person.
Why: To see how many people come, which pages they read, and whether the site works. Nothing is sent to Google or to anyone else — the counting is done by the site itself and the numbers never leave it.
What allows it: Not personal data once the pseudonym is rolled and the address is discarded, and nothing is stored on your device, so no consent is required and none is asked for. If that ever changes, this page changes first.
How long: A little over a year, then deleted.

Cookies beyond the necessary ones

What: Whatever the categories you agreed to actually collect. Set out in full in the cookie policy.
Why: Only the purposes you agreed to.
What allows it: Your consent (GDPR Article 6(1)(a)), which you can withdraw at any moment.
How long: As stated per item in the cookie policy.

Who else touches it

Two companies, both under a written data processing agreement, both acting only on instruction. Nothing is sold, and nothing is shared for anyone else’s purposes.

Supabase

Database and sign-in

Frankfurt, Germany (eu-central-1)

Holds the closed list and the few accounts that exist. Chosen with an EU region so the data stays in the EU.

Vercel

Hosting

Served from EU edge locations; the company is US-based

Serves the site and runs the code behind it. Transfers outside the EU rest on the EU Standard Contractual Clauses.

Where data reaches a company outside the EU or EEA, the transfer rests on the European Commission’s Standard Contractual Clauses. You may ask for a copy of them.

What you can require

Write to info@theomnigoal.com and you will have an answer within a month. It is free, and you do not have to give a reason.

See it

Ask for a copy of what is held about you, and why.

Correct it

Have anything wrong put right.

Delete it

Ask for it to be erased. Where it rests on consent, that is nearly always straightforward.

Limit it

Ask that it be held but not used, while something is being sorted out.

Take it with you

Receive what you gave in a machine-readable form, and have it sent elsewhere.

Object

Object to anything resting on legitimate interests, and it stops unless there is a compelling reason it should not.

Withdraw consent

Change your mind, at any time, as easily as you gave it. What was done before stays lawful; nothing further happens.

Two things this site does not do

No decisions made by machine alone

Nothing here decides anything about you automatically, and there is no profiling in the legal sense. Nothing on this site builds a picture of you, scores you, or sorts you into a group on the basis of what you have read.

Not for children

The site is meant for people working or studying in business. It is not directed at children, and accounts are not knowingly made for anyone under 16.