Back to home

Privacy Policy

Last updated: October 2026

1. Controller

Long Bui, Rotlintstraße 20, 60316 Frankfurt am Main, Germany
Email: hello@long-bui.de

2. Overview

Simple Fund Manager lets you track a private fund: its members, the invested amount, the current value and the resulting profit or loss. You can load and save the fund as a JSON file on your disk or in your Dropbox app folder. Your fund data stays in your browser and in the files you save. There is no account, no tracking, no analytics and no advertising. Fonts are served from our own server.

3. Hosting

The website runs at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centers in Germany (Nuremberg) and Finland (Helsinki). We have a data processing agreement with Hetzner under Art. 28 GDPR. Only the website runs there; it has no database and stores no files.

4. Visiting the website

When you visit the website, the server processes technically necessary data: IP address, date and time, requested address, HTTP status code, browser identifier (user agent) and referrer. This is needed to deliver the site and fend off attacks. The legal basis is Art. 6(1)(f) GDPR. This data only ends up in short-lived, automatically rotated server logs and is not analyzed or combined with other data.

Cloudflare

For fund-manager.long-bui.de we use the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. All requests to the website pass through Cloudflare servers, which process the connection data listed above to deliver the site and protect it from attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA rely on the European Commission's adequacy decision (Art. 45 GDPR). We have a data processing agreement with Cloudflare. More: https://www.cloudflare.com/privacypolicy/

5. Connecting Dropbox

If you choose to connect Dropbox, you sign in with Dropbox, Inc. via OAuth (PKCE). We only request access to the app folder (App Folder access); we cannot see any other files in your Dropbox. We keep only the refresh token; Dropbox does not send us your name or email address.

On each request to list, download or upload files in the app folder, the server exchanges the refresh token for a short-lived access token and uses it for that request. File names and contents you list, open or save are transmitted to Dropbox (USA); Dropbox is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(b) GDPR (providing the function you want to use).

Processing by Dropbox itself is governed by Dropbox's privacy policy: https://www.dropbox.com/privacy

You can disconnect at any time by revoking the app in your Dropbox settings (connected apps).

6. Cookies

After you connect Dropbox, we set the cookie fm_dropbox_refresh in your browser, which holds the refresh token. It is strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG) and expires after 400 days.

During the connection, a short-lived OAuth state cookie (fm_dropbox_oauth) is set; it is likewise strictly necessary (§ 25(2) no. 2 TDDDG) and expires after 10 minutes. We set no other cookies.

7. Your fund data

Your fund data is never stored on our server. File contents pass through the server only in transit to and from Dropbox; they are not logged or retained.

8. Retention

We keep no server-side data beyond short-lived, automatically rotated server logs. The cookies expire as described above.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Just email hello@long-bui.de.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany, https://datenschutz.hessen.de

10. Obligation to provide data, automated decisions

You are not required by law or contract to provide your data. Without connecting Dropbox you can still load and save your fund as a file on your disk. No automated decision-making or profiling takes place.