Terms, privacy, cookies, imprint

The service is operated by:

Contact: info@onemilliondrawers.com, phone / WhatsApp +49 155 10247160. Full details are in the Imprint.

One Million Drawers is an exploration experiment: a million permanently numbered drawers that can be opened, discovered and claimed. A claimed drawer shows its owner’s content: a title, a description, a link, social profiles, an image and a chosen country. Drawers claimed by users count towards the country ranking (“World Battle”).

A drawer is a collectible identifier. It is not property or a property right, not an investment, has no resale value and carries no promise of profit. We do not run a marketplace for drawers and do not broker their resale. The service is not gambling, contains no paid random rewards and no cryptocurrency.

Opening drawers needs no account. Claiming a drawer requires an account with an email address, a username and a password. The username is public; the email address is not.

You must be at least 16 to use the service. A paid claim requires you to be of legal age, or to have your legal guardian’s consent.

The account holder is responsible for what is done while logged in. Keep the password safe; if you suspect someone else knows it, change it or use the password reset.

You can delete your account at any time by writing to the address in section 1. When an account is deleted, its drawers are released and their content removed. Data we must keep by law (payment records) is retained to the extent the law requires.

Every account may claim one drawer free of charge during the founding round, for as long as the round lasts and the pool of free claims is not exhausted. A free claim receives a founding number — the next number in the round. The founding round may be closed at any time; drawers already claimed stay claimed.

Every further drawer, and after the round has closed every drawer, can be claimed for a fee. The price is shown on the drawer before payment starts and is the final price.

A claimed drawer is assigned to the account for the lifetime of the service. The drawer number is permanent and never changes. A drawer cannot be transferred to another account.

A drawer already claimed by someone else, a system drawer, or a drawer whose claiming has been locked cannot be claimed. Drawers with special numbers may be excluded from claiming or offered in a different way.

On the website, payment is handled by Stripe. When you press the pay button, the drawer is reserved for the duration of the payment (normally 30 minutes) and you are taken to Stripe, where you enter your payment details. The contract is concluded when Stripe confirms the payment; at that moment the drawer is assigned to your account. If the reservation expires before payment, the drawer returns to the free pool.

In the Android app, payment is handled by Google Play Billing. Google Play’s terms apply to the payment; Google is the seller within the meaning of those terms and handles refunds under its own rules. Once Google confirms the purchase, the drawer is assigned to your account.

Prices are in euro. As a small business under § 19 of the German VAT Act (UStG) we do not charge VAT; the price shown is the final price.

If, exceptionally, a drawer is claimed by someone else between the start and the confirmation of your payment, the payment is refunded in full by the same method.

The purchase confirmation is sent by Stripe or Google. Payment details are visible in your account next to the drawer.

Claiming a drawer is the supply of digital content not on a tangible medium. A consumer generally has the right to withdraw from the contract within 14 days without giving a reason. This right is lost if the consumer has expressly agreed that performance begins before the withdrawal period ends and has acknowledged that they thereby lose the right of withdrawal. You give this consent by ticking the box next to the pay button — the drawer is assigned immediately after payment.

Instructions on withdrawal. You have the right to withdraw from this contract within 14 days without giving any reason. The withdrawal period is 14 days from the day the contract is concluded. To exercise the right of withdrawal, you must inform us of your decision by an unequivocal statement (e.g. a letter sent by post or an email) to:

Email: info@onemilliondrawers.com

You may use the model withdrawal form below, but it is not obligatory. To meet the deadline it is sufficient to send your statement before the withdrawal period has expired.

Effects of withdrawal. If you withdraw from this contract, we shall reimburse all payments received from you without undue delay and no later than 14 days from the day we receive your statement, using the same means of payment you used for the transaction, at no cost to you.

Model withdrawal form (complete and return only if you wish to withdraw from the contract): “To: Andrzej Andelbrat — AllesKlar Service, Lönsweg 30, 21680 Stade, Germany, info@onemilliondrawers.com. I hereby withdraw from my contract for the supply of the following digital content: claim of drawer no. …. Ordered on: …. Name of consumer: …. Address of consumer: …. Signature (only if this form is sent on paper): …. Date: ….”

The owner decides what a drawer shows and is responsible for it. Content must be lawful and comply with these terms. In particular, the following is prohibited:

• phishing, malware and links to such sites,
• illegal content, pornography and depictions of sexual violence,
• hate speech, extremism, incitement to violence,
• fraud, misleading claims, false promises of profit,
• impersonating other people, companies or institutions,
• infringing copyright, trademarks or other third-party rights,
• spam and content whose only purpose is to manipulate rankings.

By publishing content you grant us a non-exclusive, royalty-free licence to display, store and technically process it (for example, to resize an image) on the website and in the app for as long as it is published. You confirm that you hold the rights to what you publish.

External links lead to sites we are not responsible for. We check them for safety to a reasonable extent but do not vouch for their content.

Any drawer can be reported with the “Report drawer” button. We review reports without undue delay. A drawer may be hidden while a report is reviewed.

Where the law or these terms are breached we may remove or change a drawer’s content, suspend the drawer, restrict account features and, in serious or repeated cases, block the account. The drawer then stays assigned to the account but without content; if the account is blocked, its drawers may be released. We inform the owner at the account’s email address unless the law forbids it.

You can appeal a moderation decision by writing to the address in section 1. We reply within 14 days.

We aim to keep the service available without interruption but do not guarantee one hundred per cent availability. Maintenance, failures and the actions of third parties may temporarily limit access.

We may develop and change the service’s features, including the exploration mechanics, rankings and design, as long as the essence of claimed drawers is untouched: the number and its assignment to the account remain.

If we decide to close the service, we will announce it on the home page and by email to account addresses at least 30 days in advance. For paid drawers claimed within the 12 months before the announcement we will refund the price paid on request made within 60 days of the announcement.

We are liable without limitation for damage caused intentionally or by gross negligence, for injury to life, body or health, and wherever the law does not permit liability to be limited.

Otherwise we are liable only for the breach of obligations essential to the contract (those you may reasonably rely on being performed), and only up to the damage that was typical and foreseeable when the contract was concluded.

We are not liable for content published by users or for linked sites until we become aware of an infringement; once aware, we act as described in section 8.

We may change these terms for good reason: changes in law, case law, the service’s features or payment methods. We announce a change on the website and by email to the account address at least 30 days before it takes effect. If you do not agree, you may delete your account in that time; if you do not object before the change takes effect, it is deemed accepted, which we point out in the announcement. Changes do not apply retroactively and do not reduce rights to drawers already claimed.

The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods. A consumer residing in another country keeps the protection of the mandatory provisions of the law of their country of residence.

We are neither obliged nor willing to take part in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG). You can always write to us directly — most matters are settled by correspondence.

These terms apply from 4 September 2026. The Polish and English versions are equivalent; for consumer matters, in case of a discrepancy, the version in the language in which the contract was concluded prevails.

Email: info@onemilliondrawers.com, phone / WhatsApp +49 155 10247160. We have not appointed a data protection officer, as the law does not require one of us; for any matter concerning your data, please write to the email address above.

We collect only the data the service needs to work. There are no advertisements, ad networks, social plug-ins or third-party analytics tools. Fonts and scripts are served from our own server. We never derive your country from your IP address — the country on a drawer is the one you chose yourself.

We make no decisions based solely on automated processing and do not profile users.

Visitors without an account. On the first visit the browser receives a random identifier in a cookie (omd_visitor). It keeps a drawer you opened open and lets the server limit request rates. The identifier contains no personal data and is not linked to your IP address. We store the list of drawers opened under that identifier. Basis: our legitimate interest in running and securing the service (Art. 6(1)(f) GDPR).

Account. Email address, username, password as a bcrypt hash (never in plain text), optionally a display name, a short bio, an avatar and a country, and the profile visibility setting. Login sessions are stored as a token hash with an expiry date. Basis: performance of the contract (Art. 6(1)(b) GDPR).

Drawers. Which drawers you opened and claimed, when, and how (founding, paid, by an administrator), and the drawer’s content: title, description, link, social profiles, image, country, content type. The content of a claimed drawer, the username and — if the profile is public — the owner’s profile are visible to everyone, without logging in. Basis: performance of the contract (Art. 6(1)(b) GDPR).

Payments. Amount, currency, status, Stripe session and payment identifiers or the Google Play purchase token, and the drawer number. We never see or store card details — you enter them directly with Stripe or Google. Basis: performance of the contract (Art. 6(1)(b) GDPR) and tax and accounting obligations (Art. 6(1)(c) GDPR).

Reports. The reported drawer, the reason, the description, the account or visitor identifier that filed the report, and the review note. Basis: legitimate interest in the safety of the service and our obligations regarding illegal content (Art. 6(1)(f) and (c) GDPR).

Email. We send only necessary messages: the password reset link and, where needed, notices about moderation, changes to the terms or closure of the service. No newsletter, no advertising. Messages are sent from our own mail server in the European Union.

Drawer statistics. For each drawer we count opens, link clicks and shares per day. These are numbers only — no personal identifiers. The click or share signal carries no information about who sent it.

Server logs. The web server records the IP address, time, requested address, response code and browser identifier (user agent). Logs help detect attacks and failures and are rotated; we keep them no longer than about five weeks. Basis: legitimate interest in security (Art. 6(1)(f) GDPR). Request-rate limits are counted in server memory and are not stored.

We process data on our own virtual server in Poland (European Union), hosted by cyber_Folks S.A. Drawer owners’ images are stored on the same server.

Stripe Payments Europe, Ltd. (Ireland) handles payments on the website. Stripe receives the data needed for the payment and the purchase details, and may transfer data to Stripe, Inc. in the USA under the European Commission’s adequacy decision (Data Privacy Framework) and standard contractual clauses. Stripe’s policy: stripe.com/privacy.

Google Ireland Limited handles payments in the Android app (Google Play Billing). We receive a purchase token from Google, which we verify; Google processes payment data under its own privacy policy.

Beyond that, we disclose data only where the law requires it (for example, at the request of a competent authority).

• Account and drawers: until the account is deleted. On deletion, drawers are released and their content and images removed.
• Visitor identifier: up to 12 months from the last visit (the cookie’s lifetime).
• Login sessions: 30 days, or until you log out.
• Payment records: 10 years from the end of the year of payment (§ 147 AO, § 14b UStG), to the extent required by law; after account deletion without a link to the account data.
• Reports: 12 months after review, to document moderation.
• Server logs: rotated, up to about five weeks.
• Password reset tokens: briefly after use or expiry.

You have the right to access your data, to have it rectified or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest. Most account data can be viewed and changed in the “Account” section; the profile can be set to private. Other requests — including account deletion — go to the email address in section 1. We reply within a month at the latest.

You may lodge a complaint with a supervisory authority, in particular with the one competent for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany (lfd.niedersachsen.de) — or with the authority in your country of residence.

Connections are encrypted (HTTPS). Passwords are stored only as bcrypt hashes. Session and visitor cookies are HttpOnly, Secure and SameSite. Uploaded images are checked for their real type and links for safe schemes. Only the people who administer the server have access to it, by SSH key.

This policy applies from 4 September 2026. We will update it when the service or the law changes; the current version is always at this address, and we announce significant changes on the website.

Because all of these are strictly necessary to provide the service you explicitly request, or store your own choice, they do not require consent (§ 25(2) of the German TDDDG, Art. 5(3) of Directive 2002/58/EC). That is why the service shows no cookie banner.

During payment on the website you are taken to Stripe (checkout.stripe.com), which sets its own cookies under Stripe’s policy. In the Android app, payment is handled by Google Play under Google’s terms.

You can delete cookies in your browser settings. After deleting omd_visitor the service will no longer recognise the drawers you opened without an account; after deleting omd_session you will need to log in again.

Email: info@onemilliondrawers.com

Phone / WhatsApp: +49 155 10247160

Contact is for technical matters, payments, accounts, content reports and complaints.

Tax number (Steuernummer): 43/101/28539

VAT identification number (§ 27a UStG): DE462649219

Small business under § 19 UStG — no VAT is charged or shown.

Andrzej Andelbrat, address as above (§ 18(2) MStV).

Drawer content is published by its owners — the users of the service — who are responsible for it. Content that infringes the law can be reported with the “Report drawer” button on the drawer’s page or at the email address above; we review reports without undue delay.

We are neither obliged nor willing to take part in dispute resolution proceedings before a consumer arbitration board (§ 36 VSBG). Please contact us directly — we aim to settle matters by correspondence.