Privacy Policy

1. Controller

Mindoo GmbH
Karpfenweg 12, 76189 Karlsruhe
E-mail: please enable JavaScript
Contact for data protection: Karsten Lehmann

2. Principles

This policy covers the website mindoodb.com and the app MindooDB Haven: the web app at haven.mindoodb.com and the apps for iOS and Android. We process personal data only to the extent necessary, following the principles of data minimisation and data protection by design and by default (Art. 25 GDPR).

3. Hosting of the website

The website is hosted by Cloudflare, Inc. When you visit it, technically necessary access data (such as IP address, time and requested page) is processed to deliver the site and keep it secure. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Transfers to the USA are covered by the EU-US Data Privacy Framework and EU standard contractual clauses.

4. No tracking cookies

Neither the website nor Haven sets marketing or tracking cookies, and neither uses analytics or advertising services. The website only stores your choice of light or dark mode in your browser; this information does not leave your device.

5. Contacting us

If you contact us by e-mail, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR). We delete the data as soon as it is no longer needed.

6. Data processing in Haven

Haven is local-first and end-to-end encrypted: your content is stored on your device and encrypted there before it leaves it. The keys stay on your devices; servers only ever see ciphertext. Neither we nor our hosting providers can read your content (data protection by design, Art. 25 and Art. 32 GDPR). Haven works without an account with us; your user identity is created on your device.

You decide which MindooDB servers Haven synchronises with. If you use a server operated by Mindoo GmbH (MindooDB Cloud), the servers are located in data centres of Hetzner Online GmbH in Germany; we have a data processing agreement with Hetzner, and content is stored in Germany only. The connections pass through the network proxy of Cloudflare, Inc. (USA), which only sees encrypted content and connection data such as IP addresses. Besides the encrypted content, we only store the account and connection data needed for operation (user name, public keys, IP addresses, times of synchronisation). The legal basis is the contract of use (Art. 6(1)(b) GDPR). If you use a server operated by yourself or by someone else, its operator is responsible for it.

The web app haven.mindoodb.com and the update packages for the iOS and Android apps are delivered via Cloudflare. Access data (IP address, time, requested file) is processed for this, as for the website (Art. 6(1)(f) GDPR).

Apps from the Haven App Store run in isolated frames on their own web addresses and only receive the data you grant them in Haven. Apps published by Mindoo GmbH are delivered via Cloudflare. Apps from other providers are loaded from their providers' servers; their privacy policies apply.

Web tiles load the pages you add directly from those websites; their privacy policies apply. If you set up the optional screenshot service with your own Cloudflare account, Haven sends the page address directly to Cloudflare under your account. Your API token is stored only on your device.

In the iOS and Android apps you can unlock Haven with a passkey or a saved password. They are managed by your operating system (iCloud Keychain or Google Password Manager); we receive neither the passkey nor the password.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can export your content from Haven at any time with its backup function. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

8. Changes

We update this privacy policy when the legal situation or our services change.