odd nook

Last updated 6 November 2026

Privacy

Everything on odd nook works without an account, and then nothing about you is stored on our servers. An account is optional. This page says what we keep if you make one, why, and for how long. It covers oddnook.org and every project at an address ending in .oddnook.org.

Who is responsible

odd nook is run by REFLECTOPIA LLC, which is responsible for your data (the “controller” under the EU General Data Protection Regulation, the GDPR). Write to us about anything on this page at privacy@oddnook.org.

Without an account

Each project keeps what you do in your browser, on your device. In the Christmas Market Atlas that means your ratings, notes, lists, favorites, the markets you marked as visited (and when), the real mugs you ticked on your mug shelf, the name on your passport, your starting point and display choices. None of it is sent to us.

Like any website, the pages reach you through our host, Cloudflare, which handles your IP address and the usual technical details of each request in order to deliver them. When a page talks to our server, Cloudflare keeps a technical log of that request for up to 7 days, which we use only to find and fix problems.

The Easter Market Atlas, the Fest Atlas and the Techno Festival Atlas are coming-soon pages for now. They keep nothing about you, set no cookies and run no scripts. When each one opens, it will work like the Christmas Market Atlas, with the same account, and this page will say what it keeps before then.

What we keep if you make an account

  • Your email address, to send you sign-in links and to know it’s you when you sign in. It is never shown to anyone else, and we use it for nothing else: no newsletters, no marketing.
  • What you choose to save in each project, so it follows you to your other devices. In the Christmas Market Atlas: your favorites and lists, your ratings, your notes, the markets you marked as visited and on which days, the real mugs you ticked on your mug shelf (market and year), the name you put on your passport, your rating style and your starting point for distances. A starting point can be an address you typed or your location, if you chose to use it.
  • For each signed-in browser, a scrambled copy of its sign-in code, which can’t be turned back into the code.
  • The dates your account was made and last used, and when each saved item was updated.
  • Lists you choose to share (Christmas Market Atlas): the list’s name and its markets, under a random link. Anyone with the link can see exactly that, never who made it. We count how often the link is opened, as a number. Stop sharing in Settings and the link stops working.
  • Fixes you suggest for a market (Christmas Market Atlas): what you wrote and when, linked to your account so we can stop spam. Only the owner of odd nook reads them, without your email.
  • Mug photos you add (Christmas Market Atlas): the photo, the market, the year on the mug and when you sent it, linked to your account. Your browser redraws the photo before sending it, which leaves out its location and camera details. The owner of odd nook checks every photo, without seeing who sent it, before it appears on the market’s card, and declines photos that show people or number plates. On the card a photo is shown to everyone, never with your name or email. You can remove your photo at any time on your mug shelf.

Santa’s Nice List (Christmas Market Atlas) is a friendly leaderboard you can join if you want to. Joining keeps a name we make up for you (you can draw another), the avatar you pick and when you joined. The list shows that name, your avatar and your counts for the season: different markets and countries stamped, rarity points, accepted mug photos and fixes. It never shows your email or which markets you visited. Leave whenever you like and you’re off the list at once; deleting your account removes it too. The owner of odd nook can hide a name from the list.

Thank-you mugs on your mug shelf are worked out from how many of your photos and fixes were accepted. Only you see them. If you share a mug, the link says only which mug it is and its year: not your name, not your account. A postcard you send from a market you stamped says only which market and the day of your visit.

“Most loved” in the Christmas Market Atlas counts the ratings and favorites that signed-in people sync, as totals per market. A market only shows a count once at least three people have rated or favorited it, so no one’s own rating can be picked out. The owner of odd nook also sees totals across all accounts, such as how many passport stamps or real mugs each market has, to see what people enjoy; never one person’s things.

Accounts are for people aged 16 and over. Everything works without one.

Why we may use it

  • To give you what you signed up for: sign-in and your saved things on every device (Art. 6(1)(b) GDPR).
  • To keep the service safe: limits on how many sign-in links one IP address or one email address can ask for, and the technical logs (Art. 6(1)(f) GDPR, our legitimate interest in a secure service).

Who helps us run it

One provider processes data on our behalf, under a data processing agreement: Cloudflare, Inc., which hosts the sites, stores the accounts and what they save, and sends the sign-in emails. Cloudflare is based in the United States and is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as giving adequate protection; its agreement with us also includes the EU standard contractual clauses as a fallback. We share your data with no one else, and there are no ads. Our fonts are served from our own sites, not from Google.

Two features of the Christmas Market Atlas ask an outside service directly from your browser, only when you use them:

  • Driving times on a market’s card come from the public OSRM routing service (router.project-osrm.org), which receives your starting point, the market’s location and your IP address.
  • Address search and “Use my current location” in Settings use komoot’s Photon service (photon.komoot.io), which receives what you typed, or your coordinates, and your IP address.

Buttons such as “Directions in Google Maps” open another company’s site, whose own privacy policy then applies.

On your device

Each project keeps its things in your browser’s storage, as described above, plus small notes such as which reminders you’ve already seen, cached driving times, your weekend planner choices, which hidden surprises you’ve found and which mugs you’ve already been shown, whether you’ve seen today’s Christmas or New Year greeting, and your own photo and fix counts for the mug shelf. If you use the Christmas Market Atlas offline or add it to your home screen, your browser also keeps a copy of the page, its fonts and icons on your device. While you’re signed in there is also one cookie, shared by all odd nook addresses, which holds your sign-in code and nothing else. All of this is strictly necessary for what you asked for, so under the German law on device storage (s. 25(2) TDDDG) no separate consent is needed. There are no advertising or analytics cookies, and nothing tracks you across sites.

How long we keep things

  • Your account and what it saves: until you delete it. Nothing is deleted for inactivity.
  • A shared list: until you stop sharing it or delete your account. A suggested fix: until you delete your account.
  • Your Nice List name: until you leave the list or delete your account.
  • A mug photo: until you remove it or delete your account. A photo we decline is deleted straight away; a note that it was declined stays with your account, for counting.
  • A sign-in link works for 15 minutes and is removed a day later.
  • A signed-in browser stays signed in for up to a year, or until you sign out.
  • The counters that stop misuse of sign-in delete themselves within an hour.
  • Cloudflare’s technical logs are kept for up to 7 days.
  • We keep backup copies only to recover from a failure: one from each of the last 90 nights, and the first of each month for two years. Sign-ins are not in them. Mug photos are copied to a separate backup store; a removed photo’s copy is kept for 180 days.

Deleting your account

On your account page, choose Delete my account. Your email, everything you saved, your shared lists, your suggested fixes, your mug photos, your Nice List name and your sign-ins are removed from our live systems at once, and from every backup copy the following night. We keep only the account’s random identifier and the date, so that a backup can never bring it back. Things saved only in your browser stay there; to remove them, clear this site’s data in your browser.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict how it is used, to receive it in a portable format, and to object to any use based on our legitimate interests. Your account page lets you download everything we keep for you and delete your account yourself. For anything else, write to privacy@oddnook.org. You can also complain to a data protection authority, for example the one where you live.

Changes

If this page changes in a way that matters, we’ll update the date at the top and say what changed here.