Legal / Privacy
Privacy policy
What personal data Bitspark GmbH processes when you use the Slang website, the Slang studio and the programs you publish with it.
Last updated: 24 September 2026
Who is responsible
The controller under the EU General Data Protection Regulation (GDPR) is:
Bitspark GmbH
Gebersdorfer Str. 277
90449 Nürnberg
Germany
info@bitspark.com · +49 911 4947 0667
Dr. Julian Matschinske (Managing Director)
Write to info@bitspark.com with any question about your data. See also the imprint.
This policy covers slang.bitspark.com, slang.run, slangapps.com and design.slang.bitspark.com. Addresses that only redirect elsewhere are covered by the policy of the site they lead to.
Visiting this website
When you open a page, your browser sends our server your IP address, the address of the page, and technical details such as your browser type. The server needs these to deliver the page. It keeps no access log, so none of this is stored afterwards. This website sets no cookies.
If you use the light/dark theme switch, your choice is saved in your browser's local storage under tryslang-theme. It stays on your device and is never sent to us.
Legal basis: our legitimate interest in providing the website (Art. 6(1)(f) GDPR). The theme setting is stored because you ask for it (§ 25(2) no. 2 TDDDG).
Using the studio at slang.run
Your account
To create an account we store your username, a display name (your username unless you choose another), your password and a recovery code. The password and recovery code are stored only as salted one-way hashes (scrypt), never in readable form. We do not ask for your email address.
When you sign up or sign in, your username and display name are passed to other parts of the service on the same servers, for example to apply your deployment limit.
Legal basis: providing the studio you signed up for (Art. 6(1)(b) GDPR). You cannot use the studio without an account.
What you create
Your blueprints and deployments are stored with your account and are private to you, unless you publish a program (see Programs you publish). Our administrators can access account data where needed to run the service or fix a problem.
Cookies and browser storage
The studio sets two cookies. Both are needed to sign you in, are readable only by our server (HttpOnly) and are sent only to slang.run over HTTPS.
| Cookie | Purpose | Lifetime |
|---|---|---|
__Host-slang_access | Proves that you are signed in | 15 minutes |
__Host-slang_refresh | Keeps you signed in between visits | 30 days, or until you sign out |
The studio also keeps your editor state and tutorial progress in your browser's local storage. That data stays on your device.
Legal basis: these are strictly necessary for the service you requested, so no consent is needed (§ 25(2) no. 2 TDDDG); the processing itself is based on Art. 6(1)(b) GDPR.
Request logs
The services behind the studio log each request they receive: the time, the requested address (which includes any search terms you enter in the studio), the response status, the referring page and your browser identification. They do not record your IP address. We use these logs to detect errors, abuse and attacks. Server logs, including these request logs, are deleted after 7 days.
To slow down password guessing, we also keep a one-way hash of your IP address with a counter for failed attempts. It is deleted automatically after at most one hour.
Legal basis: our legitimate interest in running the service securely (Art. 6(1)(f) GDPR).
Programs you publish
If you deploy a program as a REST API, it gets its own address under slangapps.com, and anyone with that address can send it requests. Requests go straight to your program. We do not store what is sent to it or what it returns.
We record execution events (time, deployment and type of event) and anything your program writes to its log, and show them to you in the studio. We keep them for 31 days, and at most 10,000 events and 1,000 log entries per deployment. Test runs in the studio are recorded the same way.
You decide what your program does with the data it receives. If it processes personal data of other people, you are responsible for that processing and for informing them.
The design reference
The design reference at design.slang.bitspark.com is hosted by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, on GitHub Pages. GitHub logs the IP addresses of visitors for security purposes, as described in the GitHub General Privacy Statement. GitHub is certified under the EU–US Data Privacy Framework, which the European Commission has recognised as providing adequate protection (Art. 45 GDPR). We set no cookies there.
Legal basis: our legitimate interest in publishing the design reference (Art. 6(1)(f) GDPR).
Hosting and recipients
Our servers are provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centre in Falkenstein, Germany. Hetzner Online GmbH processes data only on our behalf and under our instructions (Art. 28 GDPR).
We do not sell your data or pass it on to anyone else, except where the law requires us to. Apart from the design reference, no data is transferred outside the EU.
Backups
We make an encrypted backup of the service's databases every day, including accounts, blueprints, deployments and recorded events. Backups are kept for 7 days, on both of our servers. Data you delete can therefore remain in a backup until that backup expires.
Links to other websites
This website and the studio link to other sites, such as our source code and issue tracker on GitHub. Those sites' own privacy policies apply once you follow a link.
Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), and to receive it in a portable format (Art. 20).
You can object at any time to processing based on our legitimate interests (Art. 21 GDPR), on grounds relating to your particular situation.
You can delete your blueprints and deployments yourself in the studio. To delete your account, or to exercise any other right, write to info@bitspark.com. Because we do not know your email address, we may ask you to confirm that you control the account.
You can also complain to a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
No automated decisions
We do not make automated decisions about you or build profiles (Art. 22 GDPR).
Changes
We update this policy when the service changes. The date at the top shows the current version.