Privacy notice

1. Controller

Jonas Heip, Klusenerweg 11, 59494 Soest, Germany. Privacy contact: felixh82006@gmail.com. No appointed data protection officer is currently claimed.

2. Data we process

Account processes email addresses and their verification status, display names, an optional profile image URL, internal identifiers, account and lock status, roles, product grants, invitations and timestamps of security-related actions. Passwords are stored as salted scrypt verification values. MFA uses protected authenticator secrets and recovery codes stored encrypted. Session data includes an identifier, lifetime, IP address and browser information. Authentication tokens and short-lived verification proofs are needed for sign-in and recovery.

For Ostrae.email, we process requested and assigned address names, activation status and technical mailbox identifiers. An activated mailbox stores incoming messages, including content, senders, recipients, attachments and transport metadata. The Ostrae.email website reads and organizes your own mailbox through Account; encrypted OAuth sessions are stored in Neon with a maximum lifetime of 12 hours, and sign-in state expires after five minutes. An address without an active mailbox does not provide this function. If you email the operator, your message and information needed to handle it are processed.

3. Purposes and legal bases

Registration, sign-in, verification, necessary notifications, product connections and requested account functions are processed to perform the contract or take pre-contractual steps (Article 6(1)(b) GDPR). Abuse prevention, limited security logs, access controls and troubleshooting serve our legitimate interest in a secure service (Article 6(1)(f) GDPR), taking your interests into account. Processing required by law is based on Article 6(1)(c) GDPR. Optional processing that requires consent may begin only after separate, withdrawable consent (Article 6(1)(a) GDPR). Acknowledging this notice is not blanket consent.

4. Required information, children and consequences

An accessible email address, password and display name are required for registration. Sign-in is unavailable without verification. MFA is required for accounts subject to that protection. A profile image URL and your own Ostrae address name are optional. The minimum age is 12; minors need any required authorization from their legal guardian. In Germany, consent-based online services generally have an age threshold of 16 under Article 8 GDPR. For younger children, required parental consent must not be replaced solely by an unchecked self-declaration mechanism. Parents may contact the operator to request a review or deletion.

5. Providers and recipients

Vercel provides web hosting; Account functions are configured for Frankfurt. Neon provides the PostgreSQL database. Microsoft Azure Communication Services sends verification, recovery and security messages; an Azure workflow calls protected maintenance endpoints. Recipient delivery diagnostics store email addresses, delivery identifiers, statuses and SMTP errors in Azure Log Analytics in Switzerland for 30 days; engagement tracking is disabled. AWS in Frankfurt provides the Ostrae.email mail server, encrypted volumes, access configuration and backups. AWS SES is prepared for mail transport; production sending is currently restricted by the SES sandbox. These providers may process technical metadata to operate their services. Contact via Gmail is processed by Google.

Connected products receive only information intended for the confirmed connection and grants, such as your identifier, display name and verified email. Grants can be revoked. Optional external profile images are loaded by your browser from their image provider, which may receive your IP address and request metadata. We do not sell account data and currently implement no advertising profiles or analytics trackers.

6. Countries and transfers

EU locations for running infrastructure do not completely rule out processing by internationally operating providers, particularly for support and administration. Transfers outside the EEA require a permitted basis, such as an applicable adequacy decision or standard contractual clauses and, where necessary, additional safeguards. Specific processing agreements, recipient roles and applicable transfer bases must be reviewed and documented before general release. Information about these documents can be requested from the privacy contact; this notice does not claim that this review is already complete.

7. Cookies, local storage and password generator

Account uses necessary session cookies and short-lived cookies for sign-in and MFA flows. Production session cookies are Secure and HttpOnly. They support the sign-in you request; optional tracking cookies are not implemented. Active use renews the session lifetime; without renewal, a session ends within 12 hours. You can revoke sessions in Account.

The password generator uses your browser’s cryptographic random source. Generated passwords are not sent to an external service for checking; they are transmitted only when you expressly register or change a password. Copying writes the password to the clipboard. Downloading creates an unencrypted text file on your device; store it privately. Local password checks cannot prove a password has never been compromised. Address availability checks send only your requested Ostrae name to Account, not passwords.

8. Retention and deletion

Account data is needed while you use the account and is deleted following a verified deletion request, unless a specific legal obligation or necessary legitimate retention reason applies. Secondary email proofs expire after one hour, primary verification links after one hour; password reset links are short-lived and single-use. Expiry and technical removal are different events. Message content in a delivery job is removed after successful delivery; failed jobs remain stored with protection for retry.

An automated, complete deletion and retention process for all security events, delivery metadata, expired proofs and unconfirmed accounts is not yet fully configured. No already implemented blanket deletion period is therefore claimed here. These data are reviewed upon a justified request and must be stored only as long as their purpose requires. The daily AWS backup rule keeps seven recovery points; separate initial or test copies may also exist. Deletions must also be respected when restoring a backup. The privacy contact can answer questions about individual records.

9. Your rights

Subject to statutory conditions, you have rights of access, correction, deletion, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may withdraw consent at any time with effect for the future. Write to felixh82006@gmail.com and provide only information needed to identify the request. If there are reasonable doubts, proportionate identity verification may be required. Requests are handled within statutory deadlines.

You may complain to a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. For the operator in North Rhine-Westphalia, the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia is a contact point: www.ldi.nrw.de.

10. Automated decisions and security

There is no advertising profiling or automated decision with the legal effects described in Article 22 GDPR. Automatic access blocks and request limits protect infrastructure; you may request a review using the contact email. TLS, access controls, password hashing, protected MFA data and encrypted volumes reduce risks but cannot guarantee absolute security. Do not send us passwords or recovery codes.

11. Optional MICA and advertising

When you explicitly ask MICA for help in Codae, the selected lesson, your current code and question are sent to Google Vertex AI through the product backend. In Ostrae.email, only the selected message and/or draft are sent when you request a summary, reply or rewrite. Unrelated messages and attachments are not included. Responses are suggestions; MICA cannot send mail or operate your desktop through this integration. The model endpoint is configured for the EU region. International provider processing remains subject to the transfer considerations above. Do not submit secrets or content you are not entitled to share. Daily request counters are stored to enforce quotas; AI conversation histories are not stored by these website endpoints.

Desktop handoff is optional and requires an explicit, product-specific pairing code. MICA Desktop observes matching browser window titles locally to offer help. The website receives a short-lived presence status. Selected code or mail is transferred only after you explicitly share it; the server stores that context encrypted for up to two minutes of availability and consumes it once. Expired records may remain encrypted until overwritten or revoked. Pairing credentials are tied to the issuing sign-in session and are encrypted locally by the operating system. Sign-out, session revocation or disconnect invalidates access. The two-minute availability period is not a guaranteed physical deletion deadline.

Codae and the public Ostrae.email landing page provide optional advertising placements. Placement preferences are stored locally in your browser and are separate from advertising consent. Ownership metadata and ads.txt do not load advertising trackers. Live Google advertising is enabled only after the necessary provider configuration and applicable consent checks; private inboxes and Account pages do not load ads. A separately configured sponsor video may be shown after a completed Codae lesson, is skippable and can be disabled in settings.

12. Changes

This notice is updated when processing changes. Its date and version appear at the top. New purposes requiring consent are not authorized merely by changing this notice.