Privacy · Datenschutz
Privacy policy.
Holibase needs no account and stores no personal data in its database. This page explains what happens when you visit holibase.org or use the API.
1. Controller
Alexander KrauseHeidestraße 1, 27333 Bücken, Germany
hello@holibase.org
2. Hosting and server logs
The website and the API (api.holibase.org) are delivered by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page or call the API, your browser sends technical data such as your IP address, the requested address, date and time, browser type and referrer. Cloudflare processes this data to deliver the content, to protect the service against attacks and, for the API, to enforce the rate limit of 120 requests per minute per IP address. Short-lived request logs are kept for operation and troubleshooting.
Legal basis is Art. 6 (1) (f) GDPR: our legitimate interest in a secure and reliable service. Cloudflare is certified under the EU-US Data Privacy Framework; we have a data processing agreement with Cloudflare.
3. Holiday data
The holiday data is stored in a database hosted by Supabase in the EU (Ireland). It contains holidays, school calendars and public directories of school authorities, but no data about visitors or API users. Your searches on the calendar page are sent to the API to find results; they are not stored in the database.
4. Storage in your browser
The website stores your cookie choice in your browser’s local storage, and the country list in session storage so that search is faster. Both stay on your device and are not sent to us. This storage is strictly necessary for the functions you use (§ 25 (2) TDDDG).
Fonts are served from holibase.org itself; no font service is contacted.
5. Google Analytics, only with your consent
If you agree in the cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies (named _ga and _ga_*, stored for up to two years) and sends information about your use of the website, such as pages viewed, approximate location, device and browser, to Google. IP addresses are not stored by Google Analytics 4. Data can be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework.
We use this to see which pages and countries are used, to improve the website. Legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Without consent, Google Analytics is not loaded at all. You can withdraw your consent at any time with ; the Google Analytics cookies are then deleted. More information: Google’s privacy policy.
6. API reference viewer
The API reference page loads its viewer (Redoc) from the jsDelivr content delivery network. Your browser then sends your IP address to jsDelivr. Legal basis is Art. 6 (1) (f) GDPR: our interest in a reliable reference page. All other pages load nothing from third parties unless you consent to analytics.
7. Calendar subscriptions and external links
When you subscribe to a calendar feed, your calendar app fetches it from api.holibase.org at regular intervals, as described in section 2. If you use Google Calendar or Outlook on the web, Google or Microsoft fetch the feed from their servers. Links to GitHub, for example to suggest a calendar, take you to GitHub, where GitHub’s privacy policy applies.
8. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. To exercise your rights, write to hello@holibase.org.
You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection of Lower Saxony.
Last updated: October 2026