Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation is:

Tom Schönefeld
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany

Email: contact@priviot.com
Phone: 0156 79814609

Priviot is the project and product name used by the controller.

2. Scope and local processing

This policy applies to priviot.com and priviot.de, communications with Priviot, the Priviot account, and online functions of Priviot applications that refer to it.

Purely local application processing is not processing by Priviot unless content or usage data is sent to Priviot or a service used by Priviot. Opening an application does not automatically upload local documents, text, snippets, or notes.

Network access may be required for website requests, downloads, update checks, sign-in, sync, sharing, collaboration, support, voluntary telemetry.

3. Website, essential storage, and no advertising tracking

The website does not use marketing pixels or advertising profiles. Optional website statistics count blog views and download clicks only with your consent. Fonts and design resources are served locally. The security check additionally loads the Cloudflare script described in section 5.

Essential cookies or comparable browser storage are used to remember your privacy choice, support sign-in and session renewal, save language or appearance, and provide expressly requested account features.

Section 25(2) no. 2 TDDDG applies to strictly necessary device access. Related personal-data processing relies on Art. 6(1)(b) or Art. 6(1)(f) GDPR depending on the function; the legitimate interest is secure and functional operation.

3a. Optional website statistics

Choose “Only necessary” or “Accept cookies”. No measurement events are sent without consent. The choice is saved in local browser storage without a visitor identifier for up to 180 days. “Privacy settings” lets you change or withdraw it at any time with future effect, without losing access to the website.

We store daily totals by event type and published blog path or downloaded product and the chosen file’s target platform (Windows, macOS, other or unknown). We do not read the browser’s operating system for this. No individual browsing histories, account links, document contents, full download URLs, query parameters or referrers are included. A click does not prove a completed download or installation. Views are not unique readers and include only consenting visits. Articles publicly show measured views over the last 365 days; authorised staff see aggregated reports in the support dashboard.

Events go directly to a Supabase Edge Function. Supabase receives the IP address and technically necessary connection metadata. The statistics database does not store raw IP addresses. To limit abuse, the endpoint derives an hourly HMAC identifier from available network metadata using a secret. This identifier is stored separately for up to two days. Daily deletion jobs limit aggregate statistics to 365 days even without new events. Provider technical logs are separate from these statistics. Provider and international-transfer provisions in section 17 also apply.

The legal bases for optional statistics and related device access are Art. 6(1)(a) GDPR and section 25(1) TDDDG. Technical abuse prevention relies on Art. 6(1)(f) GDPR, with the legitimate interest of protecting the measurement endpoint. Withdrawal stops future events. Contributions already aggregated cannot be linked to an individual without a visitor identifier.

3b. Trustpilot link

Our homepage links to our public Trustpilot profile. No Trustpilot scripts or embedded content are loaded. Your browser connects to Trustpilot only when you open the link. Trustpilot's privacy notice applies there.

4. Hosting and server logs

The website and downloads are hosted by ALL-INKL.COM – Neue Medien Münnich. Requests may process IP address, date and time, requested resource, HTTP status, data volume, referrer, browser, and operating-system details.

The purposes are delivery, stability, error analysis, and abuse prevention. The legal basis is Art. 6(1)(f) GDPR. According to ALL-INKL, regular server logs are deleted after no more than seven days. Security incidents, attacks, or abuse may require longer retention.

Where ALL-INKL acts as a processor, an agreement under Art. 28 GDPR is required.

5. Account, authentication, profile, and avatar

A Priviot account processes email address, account ID, confirmation state, authentication and session data, and first and last name used for the account display. Language, appearance and application preferences, organisation membership, and an uploaded avatar with storage path and revision may also be stored.

The purposes are account creation, sign-in, security, administration, and expressly used online services. Art. 6(1)(b) GDPR generally applies; security records may rely on Art. 6(1)(f).

An avatar is held in private storage unless it is expressly used as a public author image for a published blog post.

We use Cloudflare Turnstile (Cloudflare, Inc.) to protect registration, password, passkey and email sign-in, recovery and email resend on the website. The external Cloudflare script is loaded only when such an account action starts, not merely when an information page is visited. Cloudflare processes signals including IP address, TLS fingerprint, browser identifier (User-Agent), site key and associated origin. Our server-side verification sends the security token to Cloudflare; it does not include passwords, email addresses or document content.

Our abuse prevention relies on Art. 6(1)(f) GDPR. Our legitimate interest is protecting expressly requested account functions against automated requests and abuse. For device access strictly necessary for that purpose, we rely on Section 25(2) no. 2 TDDDG. Protected website account actions cannot be completed without a successful security check; information pages remain accessible.

According to the Turnstile Privacy Addendum, Cloudflare processes signals as a processor to secure our website. Cloudflare additionally processes signals to improve its own bot detection as a separate controller and states that it relies on legitimate interests for that processing. This is distinct from our own processing. Privacy requests concerning that separate processing may also be sent to dpo@cloudflare.com. See the Turnstile Privacy Addendum and Cloudflare Privacy Policy. Provider and international-transfer information is in section 16; retention information is in section 17.

6. Browsers, devices, and application preferences

Connected browsers and physical devices may process random device or session ID, display name, platform, browser or Priviot application, app version, creation time, last contact, last successful sync, and revocation or sign-out time.

Several Priviot applications on one physical device may be combined into one device display. The purposes are account security, session display, revocation, and sync control.

Supported preferences such as language, accent colour, appearance, or reduced motion may be stored with the account and synced between applications.

7. Organisations, members, and invitations

Organisation use processes organisation name, description, logo, creator, roles, permissions, membership, join time, and related account and email identifiers.

A member's name, email address, avatar, role, and join time may be visible to authorised members of the same organisation. Administrators can manage roles and membership.

Invitations process recipient email, a token stored only as a hash, inviter, intended role, expiry, and acceptance or rejection. Pending invitations are generally valid for seven days. The inviter may receive a transactional notice about acceptance or rejection.

Art. 6(1)(b) GDPR applies to expressly used organisation functions. Security, evidence, and abuse-prevention data may rely on Art. 6(1)(f).

8. Optional sync

Optional sync for supported content in Priviot PDF, Write, Paste, and Notes requires a paid Pro or Suite subscription and a Priviot account. PDF and Write documents are synchronized only after individual selection; without it they remain local on the device.

Private content, attachments, and content metadata are encrypted client-side before transfer. Additional devices are authorized through the designated device-approval or recovery procedures. Cryptographic key material on the devices is additionally used for content encryption. Operations still require account/object IDs, product and object type, schema, revision, device ID, server time, deletion marker, ciphertext hash, size, and encrypted blob references.

Disabling a service stops future sync for that service. It does not automatically delete content stored locally.

The next generation of synchronization is being prepared for Paste, Notes, and Tasks. PDF and Write are outside this planned scope. Sign-in or an account password reset alone does not provide content keys. Device approval, independently confirmed fingerprints, and valid recovery information are separate from account sign-in.

Shared Paste libraries use separate organization and team keys. Membership or an administrative role alone does not provide decryption keys. Organization recovery is limited to the current owner using the separate backup for each library; this path has not been publicly released.

This description of new data flows does not confirm general service activation. Availability and supported scope depend on the published app version and an approved service. Website/account encryption and local file encryption are not automatically the same as the new sync encryption.

9. Sharing and collaboration

Where sharing or collaboration is used in a supplied version, room or share ID, members, roles, invitation token or hash, devices, change times, and status may be processed. Content updates and snapshots may be encrypted; organisational metadata and access control remain visible to the service.

Art. 6(1)(b) GDPR applies to the requested share or collaboration. Abuse prevention and access evidence may rely on Art. 6(1)(f).

10. Voluntary Priviot Write telemetry

Priviot Write may offer voluntary technical telemetry. It is disabled by default and sends events only after explicit activation.

Events may cover app start, opening and saving with format, outcome, duration and size classes, feature use, collaboration, performance, DOCX compatibility, and technical app, platform, and version details. Document content, filenames, and complete paths are not part of the intended events.

For abuse prevention, the forwarded IP address and an hourly value may be transformed with HMAC into a short-lived rate-limit key. Telemetry events are retained for up to 180 days and rate-limit keys for up to two days. Disabling telemetry stops future collection and clears the local queue.

The legal basis is consent under Art. 6(1)(a) GDPR, which can be withdrawn in Priviot Write with future effect.

11. Support, feedback, tickets, and attachments

Requests may process product or area, category, subject, message, optional email, account ID, page URL, status, message history, and timestamps.

Voluntary attachments use private storage. Filename, path, type, size, and uploader assignment are also processed. Access is limited to the account holder and authorised administrators.

Art. 6(1)(b) GDPR applies to contractual requests and Art. 6(1)(f) to other requests, error analysis, and abuse prevention.

12. Transactional email

Priviot may send transactional email for registration and security, organisation invitations, invitation acceptance or rejection, account deletion, ticket creation, ticket replies, and stopping sync.

Recipient, language, message type, ticket number or product reference, creation time, delivery attempts, delivery status, and technical error details may be processed. Failed deliveries may be retried automatically and held for technical review after repeated failure.

Art. 6(1)(b) GDPR applies to requested account and service communication and Art. 6(1)(f) to security and delivery evidence. These are not advertising emails.

13. Public blog author profiles

Published posts may show an author name and selected author image publicly. Author account ID, language, title, excerpt, content, publication state, and timestamps are also processed internally.

Publication occurs only for posts expressly released for publication. Public information is available worldwide and may be indexed by search engines.

14. Downloads and update checks

Manual downloads and automatic update checks create ordinary web requests containing the connection data described in Section 4. Packaged non-store builds may check shortly after startup and periodically thereafter.

Priviot Proof may also retrieve signed dictionary manifests and packages. These requests do not contain document content.

14a. Apps for iPhone and iPad

Priviot Notes and Priviot Tasks are available as apps for iPhone and iPad. Both apps work fully on the device without a Priviot account.

Notes, tasks, attachments, lists, and settings are stored only on the device and encrypted there with a key held in the device keychain. The apps currently do not sync with Priviot; Priviot receives no content from the apps.

Signing in with an existing Priviot account using a passkey or password is optional. Email address and account ID are then processed as described in section 5. Registration and account deletion take place on priviot.com.

The apps request permissions only when a function needs them; they can be revoked at any time in iOS Settings. Camera (Notes): scanning documents and taking photos. Microphone (Notes): audio notes. Calendar (Notes): showing events in "Today"; events are read only on the device. Location (Tasks, while using the app): choosing a place for a reminder; saved places stay encrypted on the device, iOS handles arriving and leaving, and the app does not track the location. Face ID or Touch ID: optional access protection; the biometric check is performed by iOS and Priviot receives no biometric data. Notifications: reminders scheduled locally on the device.

Widgets and extensions receive only the data they display through a protected area on the device. With access protection enabled, widgets and notifications show no titles. Inclusion in iPhone search is off by default.

The apps contain no advertising and no analytics or tracking tools and send no usage or crash data to Priviot. Apple's privacy terms apply to downloads, updates, and purchases through the App Store; Apple provides Priviot only with aggregated statistics where sharing with developers has been enabled in iOS.

The legal basis for optional sign-in is Art. 6(1)(b) GDPR. Device functions are accessed only at the user's express request (Section 25(2) no. 2 TDDDG).

15. Optional calendar features

If a Notes calendar feed is offered and activated, a secret feed token or hash and a deliberately reduced calendar projection containing date/time and a generic title may be processed. Disabling the feed removes server-provided entries. The secret feed URL must be protected like a credential.

16. Providers, recipients, and international transfers

For website security checks, Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, receives the data described in section 5. Cloudflare identifies its EU-U.S. Data Privacy Framework certification as a basis for transfers from the EEA to the United States; where its conditions are not met, Cloudflare describes Standard Contractual Clauses and supplementary measures where necessary. Information about transfer mechanisms and contractual safeguards is available in the Cloudflare Privacy Policy and Cloudflare Data Processing Addendum. Further information about the safeguards we use can be requested from contact@priviot.com.

Priviot uses ALL-INKL for website/download hosting and Supabase for authentication, database, Storage, Edge Functions, Realtime, accounts, organisations, tickets, and sync. Processor activities require agreements under Art. 28 GDPR.

Depending on the provider, subprocessor or support access, data may be accessible outside the EU or EEA. Where Priviot is responsible, transfers rely on an adequacy decision under Art. 45 GDPR or safeguards under Art. 46, in particular the EU Standard Contractual Clauses. An EU project region does not by itself rule out all non-EEA access.

17. Retention and account deletion

Personal data is deleted when no longer needed and no statutory duty or overriding legitimate ground applies.

• CAPTCHA replay protection: In the active database, we store only a SHA-256 fingerprint of the verified security token and its expiry time, without an account identifier or IP address in that record. The protection period is ten minutes. An independent cleanup job runs every minute to remove expired entries, even if no further CAPTCHA requests arrive. Following technical interruptions, cleanup resumes with the next successful run; backup copies follow their separate technical lifecycle.
• Cloudflare verification signals: The ten-minute period above applies only to our replay records. Cloudflare applies its separate retention rules to its signals. Its stated criteria include processing purpose, data volume and sensitivity, abuse risks and legal obligations; see the Turnstile Privacy Addendum and Cloudflare Privacy Policy. The technical validity of a CAPTCHA token is not a deletion deadline for all provider information.
• Regular website logs: no more than seven days; potentially longer for security incidents.
• Account, profile, device, organisation, and sync data: generally for the life of the account, membership, or expressly used function.
• Pending organisation invitations: generally valid for seven days; status and security data may be needed longer.
• Write telemetry: up to 180 days; rate-limit keys up to two days.
• Tickets, attachments, and delivery records: while required for handling, delivery, security, or statutory evidence.
• Public blog information: while the post or author profile is published.

The account area provides an account-deletion function. It starts deletion of the active authentication account and directly associated product data. Data linked to organisation responsibilities, authorship, support, security, statutory duties, time-limited logs, or backups may require additional review, transfer of responsibility, or technical expiry. Users may contact contact@priviot.com for access or complete erasure requests.

18. Data-subject rights and objection

Subject to statutory conditions, users have rights of access, rectification, erasure, restriction, portability, withdrawal of consent with future effect, and complaint to a supervisory authority.

Where Priviot relies on legitimate interests, you may object at any time on grounds relating to your particular situation.

Requests may be sent to contact@priviot.com.

19. Changes to this policy

This policy is updated when processing, providers, or legal requirements change. An update does not replace required consent or create a unilateral contractual amendment right.