Privacy Policy
The authoritative privacy policy is the German Datenschutzerklärung. The summary below is a courtesy translation of the key points; in case of any conflict, the German text prevails. For the encryption architecture see Security and the Trust Center.
Key points (summary, not binding)
- Controller: arrowhacks GmbH & Co. KG, Julius-Hatry-Straße 1, 68163 Mannheim, Germany (see legal notice).
- Zero-knowledge by design: drop contents are encrypted in your browser before they leave; we never see plaintext or keys. Drops self-destruct after reading or expiry.
- What we process: visitor data on the website (hosted by Netlify, US provider certified under the EU-US Data Privacy Framework); account data (email, organization) if you sign up; audit metadata (IP addresses stored only as SHA-256 hashes); billing data via Stripe.
- Service hosting: the application itself (accounts, encrypted drops, audit metadata) runs at Hetzner Online GmbH in German data centers.
- Sign-in options: single sign-on via Microsoft, Google or GitHub; transactional emails (verification, password reset) are delivered via Brevo (EU).
- No tracking: no advertising trackers, no analytics services, no third-party scripts on drop pages. Only technically necessary cookies (login sessions).
- Your rights: access, rectification, erasure, restriction, portability and objection under the GDPR; contact privacy@ashnote.io.