Privacy Notice

1. Scope

This privacy notice applies to the public secpal.app website, download resources on apk.secpal.app, and direct contact with SecPal.

It does not apply to the processing of personal data within an installed or operated SecPal instance. The entity that determines the purposes and means of processing within the respective instance is responsible for that processing.

2. Controller

The controller within the meaning of the GDPR is:

Contact by email: hello@secpal.app

3. Website and download delivery

When secpal.app or a download resource on apk.secpal.app is requested, the IP address, the requested content, and other technically necessary connection data are processed temporarily. This is necessary to transmit the requested content and to provide the services securely and reliably.

Hosting and delivery are provided through Hetzner Online GmbH. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure and reliable provision of the website and download resources.

SecPal keeps no regular web server access or error logs and does not use analytics, marketing, or tracking services. Individual page and download requests are not stored permanently by SecPal or used to produce visitor or download statistics.

Processing the technically necessary connection data is required to transmit the requested content. Without this processing, the website or download resources cannot be provided.

4. Local display preference

When a person manually selects light or dark mode, that preference is stored exclusively in the browser's local storage. It is not transmitted to SecPal or an external provider.

The preference remains stored until it is changed or the browser's local storage is cleared. The storage is necessary to provide the display mode expressly selected by the user during later visits. It is based on Section 25(2)(2) TDDDG and does not require consent.

5. Contact by email

Email communication is technically provided through Uberspace. Uberspace is operated by Jonas Pasche in Mainz, Germany.

When SecPal is contacted, SecPal processes the contact details provided, the content of the message, and any attachments submitted. The purpose is to handle the inquiry and conduct the communication required for it.

Article 6(1)(b) GDPR applies when the inquiry concerns pre-contractual measures or an existing contractual relationship. In all other cases, processing is based on Article 6(1)(f) GDPR. The legitimate interest is handling incoming inquiries and security reports.

Contact by email is voluntary. Without a reachable sender address and sufficient information, it may not be possible to answer an inquiry.

SecPal deletes the message after the inquiry has been finally processed unless a statutory retention obligation or another specific legal reason requires longer storage.

6. Data subject rights

Subject to the applicable statutory requirements, data subjects have rights including access, rectification, erasure, restriction of processing, and data portability. They also have the right to object to processing based on Article 6(1)(f) GDPR.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority. The competent authority includes the State Commissioner for Data Protection of Lower Saxony.

Requests concerning data subject rights may be sent to hello@secpal.app.