Privacy policy

Short version: we store what we need to run your account, operate your apps and bill you. We do not look inside your apps, we use no analytics or advertising services, and your data lives in the EU. Everything else is below.

1. Controller

Ryvelia UG (haftungsbeschränkt) Wasserturmstraße 3 04442 Zwenkau Germany

Represented by the managing director: Kimon Neuhoff Phone: +49 173 1921654 Email: hi@podless.app

Where this policy says “we”, “us” or “Podless”, it means Ryvelia UG (haftungsbeschränkt). Podless is the name of the service at podless.app.

2. Data protection officer

No data protection officer has been appointed; based on our ongoing review there is currently no obligation to appoint one. Send privacy requests to hi@podless.app.

3. Who is responsible for what

For your account, your organisation, billing, platform security and the technical operation of your apps, we are the controller within the meaning of the GDPR.

For the data you or others store inside your apps — photos, documents, contacts, recipes, customer data — you are the controller. We process that data exclusively as a processor under Art. 28 GDPR: we run the infrastructure, we do not open your data and we do not analyse it. If you use Podless for business we sign a data processing agreement with you; write to us for it.

4. Legal bases

• Art. 6 (1) (b) GDPR — performance of the contract with you (account, apps, billing, support).
• Art. 6 (1) (c) GDPR — legal obligations, in particular commercial and tax retention duties.
• Art. 6 (1) (f) GDPR — legitimate interests, in particular security, abuse prevention and error analysis.
• Art. 6 (1) (a) GDPR — consent, where we explicitly ask you; revocable with effect for the future.
• Art. 28 GDPR — processing on your behalf for the content of your apps.

5. Visiting this website and server logs

When you visit podless.app your browser transmits your IP address, date and time, the requested address, the referring link, browser and operating system. We process this data to deliver the site and secure its operation (Art. 6 (1) (f) GDPR). Server logs are usually deleted after 30 days; longer only if an incident needs investigating.

Website and platform run on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany and OVH GmbH (OVHcloud), St.-Johanner-Straße 41–43, 66111 Saarbrücken, Germany. Both process on our behalf under Art. 28 GDPR; the data centres used are located in the EU.

6. Cookies and local storage

We only set strictly necessary cookies (§ 25 (2) TDDDG): a language cookie (“podless_locale”, one year) that remembers the language version you last read, and after sign-in the session cookies of our authentication. The light/dark mode is kept in your browser’s local storage and never transmitted to us.

There are no analytics, tracking or advertising services, no third-party cookies and no consent banners — because there is nothing to consent to.

7. Account and sign-in

For registration we process your email address, name, a password (hash only), the time of registration and session data (session identifier, IP address, browser, time of last activity). Optionally you set up two-factor authentication (secret and recovery codes) or passkeys (public key, device identifier). The legal basis is Art. 6 (1) (b) GDPR; for session protection and abuse prevention Art. 6 (1) (f) GDPR.

If you sign in via Google, GitHub, GitLab or Discord we receive your email address, name, possibly a profile picture and a provider identifier from the provider you chose. The provider learns that you are signing in to Podless. The privacy notices of Google, GitHub, GitLab and Discord apply in addition.

8. Organisations and invitations

Apps belong to an organisation that can have several member accounts. We process the organisation’s name and identifier, memberships and roles, and for invitations the invited person’s email address and the inviting account (Art. 6 (1) (b) GDPR). An invitation is deleted once accepted or expired.

9. Operating your apps

For every app we store its configuration: chosen app, name, size (CPU, memory, storage), address, custom domain, access restrictions (IP ranges), environment variables, backup settings as well as state, start and stop times and resource measurements for billing. Environment variables, database credentials and backup keys are stored encrypted (AES-256-GCM) and decrypted only to start your app.

Apps run in their own containers on servers of Hetzner Online GmbH and OVH GmbH (OVHcloud) in the EU. Bulk storage (uploads, photos, documents) lives on a file system whose blocks are stored with Wasabi Technologies (Wasabi Technologies LLC, Boston, USA; storage location used: Frankfurt am Main, Germany) — as encrypted blocks that cannot be read without the metadata on our server. Data processing agreements under Art. 28 GDPR exist with all three providers; for Wasabi additionally standard contractual clauses in case of access from a third country.

You can view your app’s logs (container logs) in the dashboard. We do not read them routinely; in support we do so only at your request.

10. Custom domains and certificates

If you connect your own domain we set up a hostname and a TLS certificate for it through Cloudflare (Cloudflare, Inc., San Francisco, USA, represented by Cloudflare Germany GmbH). Cloudflare processes the domain name and the data required to issue the certificate. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

11. Backups

Backups of your apps are only created if you configure a destination — an S3-compatible storage of your choice. We store its endpoint, bucket and credentials encrypted and write the backups encrypted, with a password shown only to you in the dashboard. The storage provider is your contractual partner; we only transfer there what you instructed.

12. Balance and payment

Billing runs on a prepaid balance. Balance, consumption per app and invoices are managed with Autumn (Autumn Inc., USA) as our billing service; payments are processed by Stripe Payments Europe, Ltd., Dublin, Ireland. Stripe processes payment data (card or account details, name, billing address, amount) under its own responsibility; full card details never reach us. We receive the payment status, the amount and the last digits of the payment method. We retain invoice data for ten years under § 147 AO and § 257 HGB (Art. 6 (1) (b) and (c) GDPR). Standard contractual clauses apply to Autumn.

13. Emails

We send you the emails the service needs: confirmation of your address, password reset, invitations, notices about upcoming updates of your apps, balance warnings and answers to your requests. We do not send advertising. Delivery runs through Resend (Plus Five Five, Inc., USA) on the basis of standard contractual clauses; Resend processes recipient address, subject, content and delivery status and tells us via webhook whether a message arrived.

14. Contact form and support

If you write to us through the form or by email we process your name, email address, phone number and company where given, and your message, in order to answer it (Art. 6 (1) (b) and (f) GDPR). We delete requests once they are settled and no retention duty applies.

15. Error reports

If an error occurs on the website or in the dashboard we log the time, the requested address, the error message, the browser and — for signed-in users — the account identifier so that we can fix it (Art. 6 (1) (f) GDPR). The error page shows you the same details and a reference; you decide whether to send them to us.

16. Retention and deletion

• When you delete an app, its containers and data are deleted. Backups on your own storage remain until you delete them there.
• When you delete your account we delete the account, sessions, organisations without other members and all apps in them. Invoice data remains stored, restricted, for the statutory period.
• Server logs: usually 30 days. Error reports: until the error is fixed, at most 90 days.
• Contact requests: until settled, otherwise according to statutory periods.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You may withdraw any consent at any time. Much of this you can do yourself in the dashboard: export data, delete apps and your account. For everything else write to the address above.

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Saxon Commissioner for Data Protection and Transparency, Devrientstraße 5, 01067 Dresden, Germany (datenschutz.sachsen.de).

18. Changes

We update this policy when the service or the legal situation changes. The current version is always available at this address; the date above shows its state. For material changes we inform signed-in users by email.