Privacy Policy
Privacy, because apparently even sarcasm needs paperwork.
Last updated: March 9, 2026.
1. Controller
Name: Stefan Wintergerst
Email: wintergerst.stefan@googlemail.com
Website: stefanwintergerst.com
2. What This App Processes
Could've Asked lets you submit one question, get one AI answer, and open or share that answer through a public link. To do that, the app processes the question you submit, the generated answer, a share slug, timestamps, and minimal technical data required to keep the service running.
If you share an answer link, anyone with that link can access the stored question and answer. So maybe do not paste your payroll secrets in here and act surprised later.
Legal basis: Article 6(1)(b) GDPR for providing the requested functionality and Article 6(1)(f) GDPR for secure and reliable operation.
3. Hosting (Vercel)
This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel may process server-side technical data such as IP address, browser information, and access time to deliver the site securely and reliably.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in secure and reliable website delivery).
Data transfer: Data may be processed in the USA.
4. Analytics (Vercel Analytics)
This website uses Vercel Analytics to collect privacy-friendly, aggregated usage statistics such as page views, referrers, and basic device or browser information. It is used to understand how the site is used and whether people are actually clicking the button or just admiring the hostility.
Vercel states that its web analytics product does not use third-party cookies and stores only anonymized, aggregated data.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in analyzing and improving website performance).
5. Bot Protection (Cloudflare Turnstile)
This site uses Cloudflare Turnstile before question submission to reduce abuse and stop bots from burning API credits for sport. Turnstile processes technical signals needed to distinguish human visitors from automated traffic.
Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in abuse prevention and service security).
6. Data Storage (Convex)
Submitted questions, generated answers, share slugs, status information, timestamps, and limited technical metadata are stored in Convex so the app can cache answers, serve shared links, and apply basic rate limiting.
This data is stored until it is deleted, overwritten by operational changes, or no longer needed for the service. In practice, shared question/answer records may remain available for an extended period because that is the whole point of shareable links.
Legal basis: Article 6(1)(b) GDPR for operating the requested service and Article 6(1)(f) GDPR for caching, rate limiting, and reliability.
7. AI Processing (OpenAI API)
When you submit a question, the question text is sent to OpenAI to generate the answer. Please do not submit sensitive personal data, secrets, credentials, or anything else you would regret having processed by a third-party AI provider.
Provider: OpenAI, L.L.C., USA.
Legal basis: Article 6(1)(b) GDPR for responding to the question you chose to submit.
8. Local Storage and Minimal Client Data
This app stores a locally generated browser session identifier in your browser's local storage. It is used for lightweight rate limiting and abuse prevention. It is not used to build user profiles or track you across other sites, because this project is not nearly that ambitious.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in protecting the service against abuse).
9. Cookies
This site aims to avoid unnecessary cookies. Essential technical storage or strictly necessary provider-side mechanisms may still be used where required for security, hosting, or bot protection. You can manage cookies and storage through your browser settings at any time.
10. Your Rights
Under the GDPR, you may have rights to access, rectification, erasure, restriction of processing, data portability, objection, and to lodge a complaint with a competent data protection authority.
To exercise these rights, contact wintergerst.stefan@googlemail.com.
11. Updates
This policy may be updated to reflect legal, technical, or operational changes. Check this page occasionally if you enjoy reading privacy policies recreationally.