Privacy

Who is responsible

The controller for the processing of personal data on this website and in connection with the Morgenwunder newsletter is:

triebkraft GmbH
Ahornstr. 5
15732 Schulzendorf
Germany

Managing Director: Dennis Kluge
Register court: Amtsgericht Cottbus · HRB 17659
VAT ID: DE365797928
Email: dkluge@triebkraft.com

Further company details are in the imprint.

An email to the address above is enough for any question about data protection or to exercise your rights. No data protection officer has been appointed, as the conditions of § 38 BDSG are not met.

What this is about

Morgenwunder sends one Wikipedia article by email each day. To do that we need an email address, the time the mail should arrive, and the topics it may be chosen from. Everything else on this page describes what arises beyond that.

Signing up

What we store

• Email address — without it there is nothing to send to.
• Name — optional. It is used only to address you in the mail.
• Language, time and time zone — so the mail arrives at the hour you chose, where you are.
• Chosen topics, along with the "surprise me" and "include difficult subjects" settings.

Double opt-in and its record

After signing up you receive an email with a confirmation link. Nothing is sent until you click it. The link is valid for fourteen days.

To evidence your consent we record the IP address, browser identification (user agent) and time both at signup and at confirmation. These show that the signup genuinely came from you, should anyone dispute it. They are visible to us only in connection with your subscription and are not analysed for any other purpose.

Legal basis

Sending the newsletter rests on your consent, Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future; every mail contains an unsubscribe link, and the lawfulness of processing carried out before withdrawal is unaffected. We keep the confirmation record in addition, because Art. 7(1) GDPR requires us to be able to demonstrate consent; the legal basis for that is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

How the article is chosen

So that no article repeats, we store which article was sent to you and when. That history is also your archive: you can see it on your settings page.

Two links at the foot of each article let you say whether it landed. If you click one, we store the article and the direction of your response. From that we work out which topics should come up more often for you and which less. The result stays with you — it shapes your own selection only, never anybody else's.

In fairness: such a click also tells us that you opened and read the mail. That is unavoidable, and it is why there are two links rather than an automatic channel — you decide whether we learn it. Anyone who never clicks tells us nothing and receives the same mail as before.

The legal basis is Art. 6(1)(b) GDPR, as this processing directly serves the service you asked for.

No open tracking

Our emails contain no tracking pixels and no redirects that measure whether or when you open a mail or click a link. We therefore do not know whether a mail was read. This is a deliberate decision rather than an oversight: open rates are interesting for a daily newsletter, but not worth fitting every mail with an invisible measurement.

Delivering the emails

We send mail through Postmark, a service of ActiveCampaign, LLC (formerly Wildbit, LLC), 400 N. Ashley Dr., Tampa, FL 33602, USA. Postmark processes your email address, the content of the mail and the technical delivery data.

The delivery service reports back whether a mail could be delivered. Where an address permanently fails (a bounce) or a mail is reported as unwanted (a complaint), we store the address with the reason and time and stop sending to it. That list prevents us from continuing to write to addresses that cannot or do not want to receive us.

Server logs and cookies

This website sets two cookies, both technically necessary and both expiring after two hours:

• morgenwunder-session — holds the state of the signup form between clicks.
• XSRF-TOKEN — prevents a foreign form from submitting in your name.

Both are required to operate the site, store nothing about you and are not analysed. There is therefore no consent banner: § 25(2) no. 2 TDDDG exempts cookies strictly necessary for a service the user has expressly requested. We set no advertising or analytics cookies.

When the site is called up, the usual log data arises on the server (IP address, time, address requested, browser identification). It serves secure operation and fault finding; the legal basis is our legitimate interest in running the service without disruption under Art. 6(1)(f) GDPR.

Audience measurement

On the public pages we count visits with Umami. The software runs on our own server; the data goes to no third party. Umami sets no cookies, builds no cross-device profiles and stores no full IP addresses. What is collected is the page requested, the referring address, approximate origin at country level, and device type and browser.

The count respects your browser's Do Not Track setting: if it is on, nothing is measured. No measurement takes place at all on the pages where you manage your settings, confirm, or unsubscribe — those addresses contain your personal access key, which has no business appearing in any statistic.

The legal basis is our legitimate interest in frugal audience measurement under Art. 6(1)(f) GDPR.

Where the data sits, and who else sees it

Data processing agreements under Art. 28 GDPR are in place with all of the above. Transfers to the United States rely on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR or, where the provider is certified, on the adequacy decision for the EU-US Data Privacy Framework.

What artificial intelligence does here — and what it does not

The short introductions to each article, and the sorting of articles by topic, are produced using language models from Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA.

Only the title and extract of the Wikipedia article are sent. No personal data whatsoever is transmitted to Anthropic — no email addresses, no names, no record of who receives which article or how anyone responded to it. The texts are written before it is known who the article will go to.

Wikipedia and Wikidata

The articles themselves come from Wikipedia and Wikidata. Those requests are made from our server only, in advance, and with no connection to any person. Nothing is loaded from there when you read the mail. Only when you click a link to Wikipedia do you leave our service; the Wikimedia Foundation's privacy policy then applies.

How long we keep what

• Unconfirmed signups are erased in full after thirty days, including the address and the confirmation record. Someone who never clicked the link gave us no permission, and then there is nothing to keep.
• Confirmed subscriptions are kept for as long as the subscription lasts.
• After unsubscribing we keep the address on a suppression list so that you are not written to again by accident. If you would rather be erased entirely, one click on your settings page or an email to us is enough; address, history, responses and confirmation record then go together.
• Suppression lists from bounces and complaints are kept as long as needed to prevent further sending.

One point most privacy policies leave out: encrypted backups of the database are taken continuously and kept for thirty days. Deleted data is therefore gone from live operation immediately, but may persist in backups for up to thirty days until those expire on schedule. Backups are restored only in an emergency.

Your rights

You have the following rights in relation to us:

• Access (Art. 15 GDPR) — what we hold about you. You can download this yourself at any time from your settings page as a file; it contains everything, including the confirmation record.
• Rectification (Art. 16 GDPR) — name, topics, time and time zone are yours to change on your settings page.
• Erasure (Art. 17 GDPR) — likewise directly there, or on request by email.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) — the downloadable file is machine-readable.
• Objection to processing based on legitimate interests (Art. 21 GDPR).
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR).

You may also lodge a complaint with a data protection supervisory authority, Art. 77 GDPR — the authority for your habitual residence, your place of work, or the place of the alleged infringement.

Automated decisions

Which article reaches you on a given morning is decided by an automated process, drawing on your topics, what you have already received and your responses. This is not an automated decision within the meaning of Art. 22 GDPR: it produces no legal effect for you and nothing similarly significant. What is at stake is which Wikipedia article sits in your inbox.

Changes to this policy

We amend this policy when the underlying processing changes. The version available on this page at the time you read it is the one that applies.

Last updated: October 2026