🔒 Privacy Policy

Data Controller under GDPR:

IT-Service Matthias Tichý Einzelunternehmen
Lindenufer 39
13597 Berlin
Deutschland

Contact:
E-Mail: support@encipher.me
Website: Contact Form

🔐 Encrypted Messages

What: Encrypted data blocks of your messages

How long: Maximum 30 days or until configured access limit

Purpose: Providing encryption services

Special note: Zero-Knowledge - we cannot decrypt this data

👤 Registered Users (optional)

What: Email address, encrypted password, usage statistics

How long: Until account deletion

Purpose: Account management and extended features

Legal basis: Art. 6 para. 1 lit. b GDPR (contract performance)

🍪 Technical Cookies

What: Session cookies, CSRF protection, theme settings

How long: Session end or up to 30 days

Purpose: Security and functionality of the website

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest)

🛡️ Security Data (all users)

What: IP addresses, browser information (User-Agent), timestamps of security events, failed access attempts

How long: IP bans up to 24 hours (depending on violation), security logs up to 30 days

Purpose: Protection against brute-force attacks, bot detection, spam protection, abuse prevention

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in IT security and abuse protection)

📍 Note: This data is automatically stored when suspicious activities are detected (e.g. repeated invalid requests). IP bans serve to protect all users.

📊 Performance and SEO Data (all users)

What: Referer URL (where you came from), Browser type, Language, Screen resolution, Page load times, Memory usage, Number of database queries

How long: Performance logs up to 30 days, automatic cleanup of older data

Purpose: Improving website performance, troubleshooting, Search Engine Optimization (SEO), analyzing traffic sources to improve service

Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest in optimization and improvement of the service)

ℹ️ Note: This data is processed anonymously and is used exclusively for technical optimization. NO tracking cookies or external analytics services are used.

👤 Additional Data for Registered Users

What: Session IDs, login times, 2FA settings

How long: Active sessions up to 1 hour, account data until deletion

Purpose: Account security, session management, security dashboard

Access: Registered users can view their security logs in the internal area.

• ❌ No Tracking Cookies - No analytics or advertising
• ❌ No Message Content - Zero-Knowledge architecture
• ❌ No Metadata - Who, when, how often accesses remains unknown

🔑 Client-Side Encryption

All encryption operations take place in your browser. Encryption keys are never transmitted to our servers.

🔗 URL Fragment Technology

Decryption keys are transmitted in the URL fragment (#). Browsers never send these fragments to servers.

🚫 Server-Side Blindness

Our servers only receive encrypted data blocks. Even in case of a complete server hack, your messages remain protected.

You have the following rights:

• Art. 15 GDPR: Information about processed data
• Art. 16 GDPR: Rectification of incorrect data
• Art. 17 GDPR: Erasure ("Right to be forgotten")
• Art. 18 GDPR: Restriction of processing
• Art. 20 GDPR: Data portability
• Art. 21 GDPR: Objection to processing
• Art. 77 GDPR: Complaint to supervisory authority

🔒 Zero-Knowledge Notice: Since we cannot decrypt your messages, providing information about specific message content is technically impossible. We can only provide metadata (number of messages, creation times).

🚫 Important Notice about IP Bans: In case of repeated security violations (e.g. brute-force attacks), your IP address will be automatically banned. Contact us via the contact form from another IP address if you were incorrectly banned.

🔐 Encryption

AES-256-GCM encryption, TLS 1.3 for all transmissions, secure hash procedures for passwords.

🛡️ Security Measures

CSRF protection, rate limiting, secure session management, regular security updates.

🗑️ Automatic Deletion

All data is automatically deleted after expiration - no backups, no recovery possible.

Cookie	Purpose	Duration
PHPSESSID	Session management for login	Session end
csrf_token	Protection against CSRF attacks	Session end
theme	Light/dark mode setting	30 days (localStorage)
cookieConsent	Stores cookie consent	1 year (localStorage)

Data Protection Officer:

E-Mail: support@encipher.me
Contact: Contact Form

Supervisory Authority:

You have the right to complain to the competent supervisory authority:

The Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Str. 153
53117 Bonn
Phone: +49 (0)228-997799-0
Website: www.bfdi.bund.de

This privacy policy may be updated as needed. Changes will be published on this page and take effect immediately.

Last updated: 10.10.2025