Privacy policy

The controller under the GDPR is Benjamin Mann, c/o Friedhofstraße 2, 32602 Vlotho, Germany. Write to hello@jellysuite.com about anything on this page.

jellysuite.com is served from a server we rent from Hetzner Online GmbH in Germany. When you open a page, the server receives what every web server receives: your IP address, the page you asked for, the time, and what your browser says about itself. That is used to deliver the page (Art. 6 (1) (f) GDPR) and isn't written to a log.

To see which pages are read, we count visits with Pirsch, a service of Emvi Software GmbH in Germany. When you open a page, your browser sends Pirsch the page's address, the page you came from, and what your browser says about itself, such as its name, your system, screen size and language. Pirsch uses your IP address to tell one day's visits apart and to work out a rough location; it is turned into a value that can't be turned back, and the address itself isn't stored. Pirsch sets no cookies, keeps nothing in your browser and doesn't follow you to other websites. We do this to learn what on the site is useful (Art. 6 (1) (f) GDPR), under a data processing agreement with Pirsch.

The website sets no cookies and loads no advertising, no tracking scripts and no fonts from other companies. If you switch between the light and dark theme, or make a character on the Jellyfolk page, that is kept in your browser's local storage and never sent to us. The footer's status dot asks our own status page, status.jellysuite.com, whether everything is running; that request carries no cookies.

The website is separate from the apps and runs on a server of its own. What you keep in jellysuite is stored on other servers, described below.

If you email us, we keep your address and what you wrote so we can answer (Art. 6 (1) (b) and (f) GDPR). We don't add you to a newsletter. Tell us to delete your message and we will.

What you write, upload, send or say in jellysuite is encrypted on your device before it reaches us, and we never receive the keys. That covers the contents and titles of your mail, pages, spreadsheets, files, events, tasks, contacts, messages and calls. We can't read it, so we can't use it, share it or hand it over.

To run the service, our servers do hold and see some things:

• Your handle, your public keys, and your private keys in a form only your password or recovery key opens.
• What a server needs to store and route your things: who something is shared with, when it was made or changed, and roughly how big it is.
• For mail to and from other providers, the addresses and the times, as with any mail service.

The transparency page lists all of it, app by app and row by row, and is checked against the code we run. We process this to provide the service you signed up for (Art. 6 (1) (b) GDPR).

Your IP address is used in memory to slow down password guessing and isn't written to a log or a database. The exception is a call, where the media server needs your address to send you sound and video. Where we need to tell visitors apart, for share links and reports below, we keep a keyed hash of your network (the first part of your address, shared with your neighbours), never the address itself. The apps contain no analytics or tracking scripts.

Mail between jellysuite accounts is end-to-end encrypted. Mail that arrives from another provider reaches our mail server the way that provider sent it, and is encrypted with your key the moment it arrives. Mail you send to an outside address is readable in our server's memory only while it is signed and handed on. In both cases nothing readable is stored. The security page has the details.

To see which apps are used, plan how many servers we need and notice abuse, our servers count. Nothing is sent from your device for this, and nothing about what you write is counted.

• Daily totals for the whole service, such as sign-ups, active accounts, changes per app, mails sent and stored bytes. They name no account and are kept as long as we run the service.
• Which days an account was used, and in which apps, so we can count active accounts. Kept for 35 days.
• For each account, per day: how many mails it sent to other providers, how many minutes it spent in calls, and how much it stores. We need these to keep mail sending and storage fair and to answer questions about your account. Kept for 90 days.

Who writes to whom, what you open or search for, and what anything is called are never counted. Only the people who run jellysuite see these numbers, in an admin tool that can't be reached from the internet. We process them to run and plan the service and to keep it free of abuse (Art. 6 (1) (f) GDPR).

When you share something with a public link, our servers count, per hour, how often the link is opened and its files are downloaded, and from how many different networks (as a keyed hash, see above). An unusual rush pauses the link until we have looked at it, so links can't be used to spread illegal content at scale. The counts are deleted after 30 days. We do this to protect the service and the people who use it (Art. 6 (1) (f) GDPR).

Anyone can report a share link they think breaks the law, with a reason and, if they like, a message and an email address. As the Digital Services Act requires, we look at every report and decide on it.

• The reported link and the message are encrypted in the reporter's browser to the people who review reports, so only they can read them.
• We keep the reason, the time, a keyed hash of the reporter's network (to spot many reports from one place) and the email address if one was given. The address and the hash are deleted 180 days after the case is closed.
• For the case itself we keep which link and whose account it concerns, what we decided, and a record of the steps we took, so we can show what we did and why.

If you report, we use your address only to tell you what we decided. If your link is reported, we can't read the shared files any more than before: to decide, a reviewer opens the link like any visitor. We process reports to meet our duties under the Digital Services Act (Art. 6 (1) (c) GDPR) and to keep the service free of illegal content (Art. 6 (1) (f) GDPR). Where the law requires it, we inform the authorities.

The apps run on servers we rent from Hetzner Online GmbH in Germany and Finland. Hetzner provides the machines under a data processing agreement and has no keys to what's stored on them. Nothing you keep in jellysuite leaves the EU.

Every hour our servers make a backup, so that a broken disk doesn't lose your work. A backup is a copy of what the servers hold, so your content in it is as encrypted as it is on the servers, and the whole backup is encrypted again with a key only we hold. Backups are stored with Hetzner, in the EU, on a separate storage server.

We keep hourly backups for two days, daily ones for two weeks, weekly ones for two months and monthly ones for a year. Something you delete therefore stays in older backups for up to 12 months, unreadable to us like everything else you store, until the last backup holding it is deleted.

You pay on a checkout page run by Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe receives and keeps what a payment and an invoice need: your name, your billing address, your email address, your payment details and, for a business, the company name and VAT ID. Stripe also sends you your invoices and tells you when a payment fails. None of that is stored on our servers, and we never see your card number.

Our servers keep a reference to your Stripe customer and subscription, your plan, whether you pay monthly or yearly, the number of seats, whether the subscription is paid up, and the dates that go with it.

This means that paying links a real name and address, held by Stripe, to your jellysuite handle. It changes nothing about your content: we still can't read it, and neither can Stripe.

We process this to take payment for your subscription (Art. 6 (1) (b) GDPR) and to keep the invoices tax law requires (Art. 6 (1) (c) GDPR). Stripe may process data in the United States; it is certified under the EU-US Data Privacy Framework and bound by the EU's standard contractual clauses.

Only the three companies named above, each for its part: Hetzner for the servers, Pirsch for counting visits to this website and Stripe for payments. The subprocessors page lists them with what each one receives. We don't sell or rent personal data, and we don't share it with advertisers.

If an authority requires us by law to hand over data, the most we can hand over is what our servers can see. Every such request will be reported on the transparency page.

• Emails to us: until your question is settled, or until you ask us to delete them.
• Account data and everything you store: for as long as your subscription runs.
• After a subscription ends, the account is locked for 30 days and then deleted: your content, mail and sessions are removed and your keys are wiped. Your handle stays reserved and your public keys are kept, so that nobody can take your name and things you signed can still be checked.
• Invoices and the billing details on them: kept at Stripe for as long as tax law requires, which is up to ten years.
• A payment nobody has created an account with yet: kept so we can sort it out if you write to us.
• Statistics, share-link counts and reports: as set out in their sections above, from 30 days to 180 days after a case is closed; totals without an account, for as long as we run the service.
• Backups: up to 12 months, as set out above.

Under the GDPR you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct data that is wrong;
• delete your data, or restrict what we do with it;
• give you your data in a form you can take elsewhere;
• stop processing that rests on our legitimate interests, or on a consent you have withdrawn.

Write to hello@jellysuite.com. Because your content is encrypted with keys only you hold, a copy of it comes from your own apps, not from us.

You can also complain to a data protection authority. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen; you may instead go to the one where you live.

When what we do changes, this page changes first, and the date at the top with it. If you have an account, we'll tell you about changes that matter before they take effect.