Last updated: 23 October 2026
Orange Teddybear makes small web apps, such as the campaign calendar Freya, and runs this website. This statement covers the personal data we process on orangeteddybear.com and for your Teddybase account (the one login for all our apps): what we collect, why, and what your rights are.
Each app has its own privacy statement for the data you put into it. You'll find it in the app's footer.
Who we are: Orange Teddybear
Questions or requests: support@orangeteddybear.com
What we process
When you visit this website
- Basic visit statistics, without cookies. We count page views, how far a page is read and the type of device. To tell visits apart we use a code made from your IP address and browser plus a random value that changes every day and is deleted after two days. That code can't be traced back to you.
- Statistics, only with your permission. If you accept Statistics in the cookie banner, we load our own statistics (Teddybase) and Google Analytics. Our own statistics record which pages you visit, where you came from, your browser, device and IP address, and the approximate location derived from it (country/city). If you're signed in to one of our apps, we may link these visits to your account. This data is stored on our own server. Google Analytics places cookies, and Google receives information about your visit, such as the pages you view and your device.
- Server logs. Our servers keep technical logs (IP address, time, requested page, browser) for security and troubleshooting.
When you contact us or leave a comment
- Contact form: your name, e-mail address, subject and message, used only to answer you.
- Comments: your name, your e-mail address if you give it (never shown publicly) and your comment. To fight spam we store a hashed code of your IP address, not the address itself.
When you have a Teddybase account
- Account details: username, name, e-mail address (confirmed with a code), password (only as a secure hash, never readable) and, if you add one, a profile photo.
- Sign-ins and devices: for each device you use we store a device name, IP address and when it was last seen. When you sign in from a new device, we send you an e-mail so you can spot misuse. We also log requests to the account service, with IP address, for security.
- Signing in to our apps: when you use "Log in with Teddybase" in an app such as Freya, that app receives your username, name and confirmed e-mail address.
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Your account, signing in to our apps, new-device alerts | Performance of a contract |
| Answering messages, showing comments | Legitimate interest |
| Basic visit statistics without cookies | Legitimate interest |
| Our own statistics and Google Analytics | Your consent, which you can withdraw at any time |
| Security, spam prevention, troubleshooting | Legitimate interest |
We don't sell your data and we don't use it for advertising.
Who else processes your data
- Hetzner Online (Germany/Finland): servers, databases and backups, in the EU.
- Mailgun: sending e-mail, such as confirmation codes, password resets, device alerts and replies.
- ipapi.co: looks up the approximate location (country/city) of an IP address for our statistics. This service is based outside the EU.
- Google (only after you accept Statistics): Google Analytics. Google may process this data outside the EU.
We only share data with anyone else if the law requires us to.
How long we keep it
- Teddybase account: until you ask us to delete it. We then delete your account, sessions, devices and photo.
- Statistics: 14 months, then deleted.
- Contact messages: as long as needed to handle your question, and at most 12 months after that.
- Comments: as long as the post is online, or until you ask us to remove them.
- Server logs and account request logs: a few weeks at most.
- Backups: encrypted and kept for at most 12 months.
Security
All connections are encrypted (HTTPS), passwords are stored only as secure hashes, sessions expire after 8 hours, and you get an e-mail when someone signs in from a new device. Our apps are still in a test phase (see the terms of use), but we do our best to keep your data safe.
Your rights
You can ask us to show, correct or delete your data, to limit how we use it, or to give it to you in a portable format. You can also object to processing based on legitimate interest. You can change your name and e-mail address yourself in your account. For anything else, including deleting your account, e-mail support@orangeteddybear.com. We'll answer within one month.
For data you or your team entered in one of our apps, see that app's privacy statement.
You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
If we change this statement in a meaningful way, we update the date at the top and, where it affects you, let you know by e-mail or in the app.
See also our cookie statement and terms of use.