Privacy policy

This page explains what personal data comes up when you use AskForDates, why we need it and what rights you have. It covers askfordates.com with all tools (invitations, date finder, Secret Santa) and guides. It's based on the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This is a translation, the German version is legally binding.

The short version

• Analytics only with consent: without your consent we set no cookies and load nothing from third-party services. If you agree, we use Google Analytics and Microsoft Clarity (through Google Tag Manager) to measure how AskForDates is used. You can change your choice any time with “Cookie settings” at the bottom of every page (see Consent and analytics).
• Never in invitations: on invitations (short links included), personal Secret Santa reveals, poll pages and sign-up pages we don't load any analytics services, not even with consent.
• No ads: no advertising cookies, no social media plugins.
• No account: you don't need an account or an email address.
• We don't read invitations: for a short link, all we store is content your browser encrypted, which we can't read. The key is only in the link. The long link works with nothing stored on our side at all.
• Only three things reach our server: encrypted short links for invitations, date finder polls and Secret Santa rounds where everyone signs up via a link. All three are deleted automatically.
• Everything is local: fonts, app files and QR codes come from us or are created in your browser. There are no requests to Google Fonts. Third-party services only load if you agree to analytics.

Controller

Dometrics GmbH
Stuckgasse 1/10
1070 Vienna, Austria
Email: [email protected]

More details are in our legal notice. We aren't required to appoint a data protection officer. For any privacy question, just email us at the addresses above.

When you visit the website (hosting)

AskForDates runs on Cloudflare (Cloudflare Pages and Cloudflare Workers). When you open a page, Cloudflare processes technically necessary connection data: your IP address, date and time, the address you requested, browser and operating system and, if available, the page you came from. This is needed to deliver the page and protect it against attacks and overload.

• Good to know: for an invitation, only the part before the # reaches the server, for example /en/for/emma. You choose the name in that part when you share. Your browser never sends anything after the # (the actual invitation). For a short link, the part before the # is just /en/e/ plus a random ID, and the key after the # stays in your browser too.
• Abuse protection: to stop anyone from flooding the date finder, short links or Secret Santa with automated requests, our server counts requests per IP address for a few minutes in memory. This count isn't stored and is discarded shortly after. Cloudflare may also block too many requests in a short time.
• No analysis of server data: we don't use this connection data for statistics and never combine it with other data. Analytics only happens with your consent (see Consent and analytics).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is running the website safely and reliably.

Consent and analytics

We'd like to understand how people use AskForDates so we can make it better: which pages get read, where someone gets stuck and which tools work well. For that we use Google Tag Manager, Google Analytics 4 and Microsoft Clarity, but only if you agree.

• Without consent, nothing external happens: until you choose “Accept all” or turn on “Analytics” in the settings, the page loads nothing from Google or Microsoft and no cookies are set. If you choose “Necessary only”, it stays that way.
• Your choice: we save it in your browser's local storage under afd.consent.v1 (whether analytics is allowed and when you chose). It isn't a cookie and is never sent to us. If the services change significantly, we'll ask you again.
• Withdrawing consent: you can withdraw your consent at any time with effect for the future, using “Cookie settings” at the bottom of every page. If you choose “Necessary only” there, we delete the analytics cookies on our domain (_ga, _ga_<ID>, _clck, _clsk) and reload the page so the services stop running. Cookies that Microsoft sets on its own domains can be deleted in your browser.
• Never on personal pages: on invitations, personal Secret Santa reveals, poll pages and sign-up pages we don't load any of these services, not even with consent. No notice appears there either.
• No ads: we use these services for analytics only. In Google Consent Mode, storage and data sharing for advertising stay denied.

Google Tag Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Purpose: managing the analytics services, meaning which services run on our website. Tag Manager only loads after you consent. When it loads, your IP address may be sent to Google, because your browser fetches the file from Google.

Google Analytics 4

Provider: Google Ireland Limited (address above). Purpose: audience measurement, meaning how many visits there are, which pages are viewed, where visits come from and how the tools are used. For this, Google processes usage data such as pages viewed, times, approximate location, device, browser and operating system. According to Google, GA4 doesn't store full IP addresses. Cookies: _ga (up to 2 years) and _ga_<ID> (up to 2 years). More: Google's privacy policy.

Microsoft Clarity

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Purpose: understanding how people use the pages so we can find bugs and confusing spots. Clarity creates heatmaps (where people tap, click and scroll) and session recordings, meaning a replay of the page layout, mouse movements, taps and scrolling during your visit. Masking: input in form fields is masked. In the tools (invite builder, date finder, Secret Santa) we also mask, in our code, every area with names, wishes, texts, links, keys, QR codes and the preview, so their content isn't recorded. Cookies: _clck (1 year) and _clsk (1 day), and cookies on Microsoft domains such as CLID and MUID may be set. More: Microsoft's privacy statement.

Legal basis: for all three services, your consent under Art. 6(1)(a) GDPR and, for storing and reading information on your device, Section 165(3) TKG 2021 (in Germany Section 25(1) TDDDG).

Transfers to the US: Google and Microsoft may also process data in the US. Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework, covered by the European Commission's adequacy decision of July 10, 2023 (Art. 45 GDPR). Standard Contractual Clauses apply in addition (Art. 46 GDPR).

Retention: the cookies last as long as stated above, unless you delete them earlier or withdraw consent. Google and Microsoft keep the analytics data according to the settings we chose in each service.

Date invitations (builder and invitation)

• Two kinds of links: the default is the short link. Its content is encrypted in your browser and stored with us without us being able to read it (see Short links for invitations).
• Long link, no server at all: if you pick the long link in the builder, texts, names, dates and choices are compressed into the part after the # of the address. Browsers don't send that part to the server, so we never receive the content and store nothing. The long link is only compressed, not encrypted.
• For both: anyone who has the whole link can open the invitation. So only send it to the person it's meant for.
• Drafts: what you build is stored locally in your browser (see local storage). You can delete drafts any time under “My invites” or in your browser settings.
• Your date's answer: at the end, your date can send the answer via WhatsApp, copy it as text or save a calendar file (.ics). The calendar file is created right in the browser. WhatsApp answers go through WhatsApp (see sharing), we don't see them.

Short links for invitations

When you send an invitation as a short link (for example askfordates.com/en/e/Ab3dE5gH7k#…), your browser encrypts the invitation before it reaches our server (AES-GCM with a random 128-bit key). We store the following in the Cloudflare D1 database (located in the EU):

• the encrypted content of the invitation. Without the key we can't read it, so we can't see names, texts or dates either.
• the link's random ID, the language (German or English), when it was created, last changed and when it expires, plus a check value (hash) of the key for editing

The key stays with you two: it's only in the link after the #. Browsers don't send that part to the server, so it never reaches us. Anyone who has the whole link can open the invitation. Your browser keeps the key for editing with your draft (see local storage).

Changing and deleting: if you change your draft and send it again, your browser replaces the encrypted content. The link stays the same. When you delete the draft, you can delete the short link along with it. Otherwise we delete it automatically one year after the last possible day of the date, for invitations without a date one year after it was created or last changed, and at the latest two years after the last change.

Nothing stored at all: in the builder you can pick the long link instead of the short link (“Long link, no server at all”). Then the invitation is compressed into the link itself and nothing is stored with us (see Date invitations). If a short link can't be created right now, the builder switches to the long link on its own.

Legal basis: Art. 6(1)(b) GDPR (providing the service you use).

Date finder (find a date for your group)

Polls are stored on our server, otherwise several people couldn't vote together. Unlike short links, they aren't encrypted. We store in the Cloudflare D1 database (located in the EU):

• the poll's title and type, the time window and settings such as the trip length
• the name of the person who creates the poll and the names of participants (nicknames are totally fine)
• the days people marked (“works” or “if need be”) and the final date, if set
• optionally a short note per person (up to 140 characters, for example “Only after 6 pm”) and a voting deadline
• when entries were created and changed, plus check values (hashes) of the edit keys. The keys themselves stay in your browser or in your personal link.

Who sees what: anyone with the poll link sees the title, the names, the marked days and the notes. So only share the link with your group. When you share the link in a messaging app, that app fetches the poll title for the preview.

Personal links: after you add your days you get a link to change your entry, and whoever creates a poll gets an admin link. The key only sits in the part after the # and in your browser's local storage, the server only stores a check value. Anyone with such a link can change the entry or the poll, so only send it to yourself or to people you want to allow that. Whoever manages a poll can also add entries for others (say, a grandparent without a smartphone) and change or remove entries.

Deletion: a poll is deleted automatically 60 days after the end of its time window or after the final date. Whoever created the poll can delete it right away. Participants can change or remove their entry at any time.

Legal basis: Art. 6(1)(b) GDPR (providing the service you use). For showing other participants' names also Art. 6(1)(f) GDPR: finding a date together only works if everyone can see who has already joined.

Secret Santa

• “I'll add everyone”: names are drawn in your browser. Each draw lives in its link and isn't stored on our server. Your browser saves the round locally so you can open it again later.
• “Everyone signs up via a link”: these rounds are stored on our server (Cloudflare D1, located in the EU). We store the round's name, budget, date and the organizer's message, plus each participant's name, wish and “no thanks” and, after the draw, who gives to whom. For rounds created in the English version we also store the time zone offset of the device that creates the round (just a number of minutes), so “Sign up by” ends at the end of the local day.
  • Who sees what: everyone with the sign-up link sees the names of all participants. Only the person who drew you sees your wish and your “no thanks”. Only you see who you give to, via your personal link. The organizer only sees names, no wishes and no pairs. After the draw they see who has already opened their draw, but not who gives to whom.
  • Honestly: wishes and pairs aren't additionally encrypted. Technically we as the operator could look at them. We don't, and we don't analyze them.
  • Access without an account: access only works with keys in the link (personal link or admin link). The server only stores check values (hashes). The keys themselves stay in your browser's local storage.
  • Deletion: a round is deleted automatically 30 days after the gift exchange date, without a date 120 days after it was created. You can leave at any time (even after the draw) and change your wish at any time. The organizer can delete the whole round at any time.

Legal basis: Art. 6(1)(b) GDPR (providing the service you use), for showing names in the round also Art. 6(1)(f) GDPR.

Local storage in your browser

For the tools we use your browser's local storage (localStorage) instead of cookies. It stays on your device and is never sent to us. We only store what the tools you actually use need, plus your analytics choice:

• hk.drafts.v1 and hk.current.v1: your invitation drafts, for short links including the ID, the key and the key for editing
• afd.termin.v1 and afd.termin.studio.v1: your date finder polls, the keys to edit them, an unfinished draft and which entries you've already seen (for “New since your last visit”)
• hk.wichteln.v1, afd.wichteln.studio.v1 (English version: afd.wichteln.studio.v1.en) and afd.wichteln.rounds.v1: your Secret Santa rounds, an unfinished draft and the keys to rounds with a sign-up link
• afd.consent.v1: your analytics choice and when you made it (see Consent and analytics)

Under Section 165(3) TKG 2021 this needs no consent because it is strictly necessary for the service you asked for. You can delete this data in the tools themselves (for example “My invites”) or any time in your browser settings (clear site data).

Offline mode (service worker)

So AskForDates loads fast and even starts without a connection, your browser caches app files and pages (service worker). This isn't personal data. Polls, sign-up Secret Santa rounds and the content of short links are never cached.

Sharing, WhatsApp and other apps

When you tap “Send via WhatsApp”, “Share” or a similar button, the app opens (for example WhatsApp via wa.me, Signal or SMS) with a prepared text. From then on, that app's privacy policy applies. We don't send anything to these services and don't learn whether or to whom you send something. QR codes are created by your browser.

Contacting us by email

When you email us, we process your email address and your message to reply. The legal basis is Art. 6(1)(b) GDPR when it's about using AskForDates, otherwise Art. 6(1)(f) GDPR (our interest in answering questions). We delete the message once it's handled, unless the law requires us to keep it.

Recipients and transfers outside the EU

We don't sell your data. To run the service we use one processor: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (hosting, delivery, attack protection and the D1 database). We have a data processing agreement with Cloudflare under Art. 28 GDPR. The database for short links, polls and Secret Santa rounds is located in the EU. Because Cloudflare is a US company with a global network, connection data may also be processed outside the EU. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR), and the EU Standard Contractual Clauses apply as well (Art. 46 GDPR). More: Cloudflare's privacy policy.

Only if you agree to analytics do Google and Microsoft also receive data. Providers, purposes and transfers to the US are described under Consent and analytics.

How long we keep data

• Invitations as a short link: encrypted, automatically one year after the last possible day of the date (without a date one year after creation or the last change, at the latest two years after the last change), or right away when you delete the short link.
• Invitations as a long link: not on our server. Drafts stay on your device until you delete them.
• Date finder polls: automatically 60 days after the time window or the final date, or right away when deleted.
• Sign-up Secret Santa rounds: automatically 30 days after the gift exchange, without a date 120 days after creation.
• Abuse protection count: a few minutes in memory.
• Analytics (only with consent): cookies _ga and _ga_<ID> up to 2 years, _clck 1 year, _clsk 1 day. Analytics data according to the settings in each service.
• Your analytics choice: on your device until you change it or clear site data.
• Emails: until the request is handled, unless the law requires longer.

Do you have to provide data?

No. You can read all guides and use the invitation builder without giving any data. For a poll or a sign-up Secret Santa round you need a name so the others know who joined. A nickname is fine. We don't use automated decision-making within the meaning of Art. 22 GDPR.

Age

AskForDates is meant for people aged 14 and up. If you're younger, please ask a parent before you create a poll or a Secret Santa round.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7(3) GDPR), most easily with “Cookie settings” at the bottom of every page. Email us at [email protected]. Since we store no accounts or email addresses, please include the link to the poll or round so we can find it.

You can also lodge a complaint with a supervisory authority, for example:
Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria, phone +43 1 52 152-0, email [email protected], www.dsb.gv.at

Changes

When we add features to AskForDates, we update this policy. The current version is always here.

Last updated: October 25, 2026

← Back to the home page