Privacy Policy

1. Controller

ladruit GbR Partnership under German civil law (Gesellschaft bürgerlichen Rechts) Represented by its partners Maximilian Drude and Joel Ladwig Im Osterdorf 8 58739 Wickede (Ruhr) Germany Email: mail@ladruit.com Privacy contact: privacy@ladruit.com

We have not appointed a data protection officer and are not required to. For anything concerning your personal data, write to privacy@ladruit.com.

2. What atermi is

atermi is an SSH and SFTP client for managing hosts, connections, keys and related data, alone or in teams. It consists of this website, a desktop app, an optional cloud account with an end-to-end encrypted vault and synchronisation, and components you can host yourself. atermi is currently offered as a beta.

3. Visiting the website

When you open atermi.com, your browser sends us technical data that is needed to deliver the page: your IP address, the date and time of the request, the address requested, the referring page where your browser sends it, the HTTP status and your browser's user agent. We use this data to deliver the website and to keep it secure and stable. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a website that works and can be protected against attacks.

The website loads its fonts, scripts and images from our own servers and does not embed content from third parties or use advertising tools or tracking pixels. Without your consent, we count page views on our own servers, without any script running in your browser; with your consent, described in the next section, your browser can additionally load a usage-analytics script from our own server.

4. Visitor statistics

To see which pages are read and how visitors find atermi, we count page views with Umami, open-source software that runs on our own servers, reachable only from our own infrastructure and never directly from your browser. Without your consent, this counting happens entirely on our web server: the website loads no tracking script, sets no cookie for it and neither reads nor stores anything on your device.

For each page you open, our web server passes the following to Umami: the address of the page without any query string, the page you came from without its query string, your browser's language and user agent, and your IP address. The country is determined from the IP address by Cloudflare, which forwards every request to us anyway (see Cloudflare below), and passed on to Umami; no region, city or finer location is kept, and the IP address itself is not stored. To count repeat visits, Umami forms an identifier from your IP address, your user agent and a value that changes every month. This identifier is pseudonymous: it does not contain your IP address or your name, we do not link it to your account or to any other data, and it changes every month. The statistics are deleted automatically after 14 months.

If your browser sends a Do Not Track or Global Privacy Control signal, the page view is not counted at all. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is understanding how the website is used, so that we can improve it. You can object at any time (see Your right to object), and switching on Do Not Track or Global Privacy Control in your browser has the same effect. You can also object directly, without relying on a browser signal, with the 'Basic statistics' switch under 'Privacy settings' at the bottom of every page; your choice is stored in the atermi_consent cookie described under Cookies and storage, which api.atermi.com also reads so that a download you start there honours it too.

Besides page views, our server counts two further events the same way: downloading an installer from the download page (which operating system, which file type, which version and which release channel) and completing a new account registration (only the sign up method: email and password, GitHub or Google). Neither event contains your name, email address or account, and downloads performed by the app's own built in updater are not counted. The same data as for page views, the same Do Not Track and Global Privacy Control rule and the same 14 month deletion apply.

With your consent, for 'Analytics': your browser loads a small script from our own server (again never directly from Umami). It reads your screen size, your browser's language, the page title, the address of the page without its query string, how quickly the page loaded and responded to your first interaction (Core Web Vitals), and where on the page you click and how far you scroll. The script also honours a value named umami.disabled in your browser's local storage: setting it stops the script from sending anything, even while your consent stands. Your browser sends this to our server, which passes it on to Umami; while your consent stands, your page views are counted this way instead of on the server as described above. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Page views, page titles and loading speed are deleted after 14 months, the same as the default statistics; where you click and how far you scroll is stored per visit, not only added up into totals, and is deleted after 90 days. Recipients: no third parties. This data is stored on our own servers in Germany and reaches them through our processor Cloudflare, Inc. (USA, certified under the EU-U.S. Data Privacy Framework and covered by the EU standard contractual clauses, see Cloudflare below).

With your consent, for 'Session recordings': we additionally reconstruct your visit to public pages of the website, a replay of the page layout together with your mouse movement, clicks, scrolling and the pages you navigate to. All text on the page and everything you type into a field is hidden with strict masking before it ever leaves your browser, and pages that need signing in, your account or other personal data, such as those under /account or /auth, are never recorded, and neither is any visit while you are signed in to your atermi account. Recordings are taken from about 1 in 10 visits, last at most 5 minutes and are deleted after 30 days. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Recipients: no third parties. This data is stored on our own servers in Germany and reaches them through our processor Cloudflare, Inc. (USA, certified under the EU-U.S. Data Privacy Framework and covered by the EU standard contractual clauses, see Cloudflare below).

You choose both of these, separately, under 'Privacy settings' at the bottom of every page, and can withdraw your consent there at any time with effect for the future. Your choice is stored in a cookie named atermi_consent for 12 months; storing that cookie needs no consent of its own, because it only remembers a choice you already made (§ 25(2) no. 2 TDDDG). A Do Not Track or Global Privacy Control signal is treated as an objection to the consent-free counting described above and as a refusal of the optional analytics, so no banner is shown and your visits are not counted; you can still switch on 'Analytics' or 'Session recordings' yourself under 'Privacy settings', and that explicit choice then applies.

5. Cloudflare

All requests to atermi.com and to the atermi cloud service reach our servers through Cloudflare, a network and security service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare terminates the encrypted connection, forwards the request to us and protects the service against attacks. In doing so, Cloudflare processes the connection data described above, including your IP address. Cloudflare acts as our processor under a data processing agreement (Art. 28 GDPR).

Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, the data processing agreement includes the EU standard contractual clauses (Art. 46(2)(c) GDPR). Legal basis for using Cloudflare: Art. 6(1)(f) GDPR. Our legitimate interest is a service that stays reachable and protected against attacks.

The content of your vault is encrypted on your device before it is sent. Cloudflare, like us, only ever sees it in encrypted form.

6. Your atermi account

To create and use an account we process your email address, the name you enter, a profile image if you upload one, your account settings and the status of your account. We process this data to provide the account and the cloud service you signed up for. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

When you accept the Terms of Service, we store the time at which you accepted them, which version you accepted and how you accepted them: when registering with an email address and a password, when registering with Google or GitHub on our website or in the desktop app, or later in the app or on our website. We keep a record of each version you accept, so that we can show when and under which Terms the contract was concluded and which Terms apply to it. These records are part of the account data you can download, and they are deleted with your account. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is being able to prove the conclusion and the content of the contract.

If you register with Google or GitHub in the desktop app, we create your account when the provider has confirmed your identity. The app then passes your acceptance of the Terms of Service on to us, which normally takes only a moment. If your acceptance does not reach us, the app asks you to confirm the Terms of Service. Until we have your acceptance, we use the data the provider passes to us only so that you can complete the registration, download your data or delete the account. If the registration is not completed within 7 days, we delete the account and its data. Legal basis: Art. 6(1)(b) GDPR, as steps taken at your request before entering into a contract, and Art. 6(1)(f) GDPR. Our legitimate interest is completing or removing registrations that were started but not finished.

atermi signs you in with the OPAQUE protocol. Your password is never sent to us, and we do not store it or a hash of it. We store a registration record that lets us check a sign-in without learning the password. We also store what is needed for email verification, password resets, one-time codes and two-factor authentication.

For each signed-in session we store the time, your IP address and your device's user agent. This lets you see and end your sessions and lets us detect misuse of an account. Legal basis: Art. 6(1)(b) and (f) GDPR. Our legitimate interest is protecting your account and our service against unauthorised access.

An email address and a password or a sign-in via Google or GitHub are required to create an account. Without them we cannot provide the account. You can use the desktop app without an account.

If you use the desktop app without an account, your hosts, keys and identities stay on your device and we receive none of them. You delete them by deleting that account in the app under Settings, Account.

7. Signing in with Google or GitHub

If you choose to sign in with Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA), you are forwarded to that provider. It confirms your identity and passes us your provider user ID, email address, name, profile image and whether the email address is verified. Legal basis: Art. 6(1)(b) GDPR.

The provider processes your sign-in under its own responsibility and its own privacy policy, and may process data in the USA.

8. Encrypted vault and synchronisation

Hosts, folders, keys, identities, fingerprints and team data that you synchronise are encrypted on your device with keys we do not have. We store and transmit them only in encrypted form and cannot read them.

To synchronise, we still process metadata that is not encrypted: user and team IDs, record identifiers, version numbers, timestamps, public keys and cryptographic parameters. Legal basis: Art. 6(1)(b) GDPR.

Because we cannot read your encrypted data, we cannot restore it if you lose access to your keys, unless atermi offers a recovery method you have set up.

Synchronising your personal entries across devices is part of atermi Personal or its trial. When the plan or trial ends, synchronisation stops and each of your devices keeps its entries. We keep a copy of the encrypted entries you had synchronised for 30 days, so that they can be restored if you continue with a plan, and then delete it. If you choose yourself to keep your entries only on your devices, we delete them from our servers at once and keep no copy for later. Encrypted versions of them that are still in our synchronisation log are deleted within 7 days. Deleted entries remain in our backups for up to 14 days after their deletion. Legal basis: Art. 6(1)(b) GDPR.

9. Teams

If you create or join a team, the other members see your name, email address and role. Team owners and administrators can also see a history of the team: changes such as invitations, role changes and changes to shared entries, and each SSH or SFTP connection a member opens to one of the team's hosts with the atermi app. Each entry shows who acted and when and, where it concerns an entry or a member, which one; a connection entry also shows which host and whether it was SSH or SFTP. This lets a team trace who did what with shared access. Legal basis: Art. 6(1)(b) and (f) GDPR. Our legitimate interest, and that of the team, is being able to trace changes to shared access, and connections made with it, back to the member responsible.

A connection entry contains nothing else: not the password, key or identity used, nothing you do during the session, and no IP address or user agent. Connections made while the app cannot reach our servers, or made with other SSH software, do not appear in the history.

Other entries can also hold the IP address and the user agent of the request that caused them. Team owners and administrators do not see them. We keep them so that we can trace misuse of an account, such as changes made with a stolen session, and delete them after 30 days. They are part of the account data you can download. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the security of your account and of the data a team shares. You can object to this processing (see Your right to object).

If you are an owner or administrator of a team, the team's key chain records your user ID and the public key you sign with. The key chain is a signed list of who may change the team's key, and every member's app checks it before it uses the key. The entries that name you stay in the key chain until the team is deleted, also after you stop being an owner or administrator or leave the team. If you delete your account, we remove them earlier, once another owner or administrator has opened the team and every member has taken up the new team key that this triggers. Members who have not taken up the new key within 90 days lose access to the team and need a new invitation. If no owner or administrator opens the team, the entries stay until one does or until the team is deleted. For each removed entry we keep a short checksum that lets the members' apps keep checking the key chain. It contains no user ID, no key and no other information from the entry, and it cannot be matched to the entry without a copy of it. Each member's app replaces its copy of the key chain the next time it opens the team. New entries made after you delete your account do not name you. Only we and the members of that team receive these entries. Legal basis: Art. 6(1)(b) GDPR while you are a member of the team, and Art. 6(1)(f) GDPR afterwards. Our legitimate interest, and that of the team's other members, is that they can keep using their team's key securely. You can object to this processing (see Your right to object).

10. Desktop app updates

The desktop app checks for updates with our own release service at most once a day, and whenever you check under Settings, Updates. Each check sends the app version, the release channel and rollout ring you use, the operating system and the processor architecture. When the app downloads or installs an update, it requests the package for exactly the version it chose. Your IP address reaches us as part of every request, through our processor Cloudflare (see Cloudflare above). These requests contain no identifier for your installation or your account, unless you switch on Receive internal releases (see below).

New releases reach installations in stages. Every installation on the same release channel and system receives the same list of available releases, each with the share of installations it has been rolled out to, and the app decides itself whether a release has reached it. For this it stores a random number in its local data folder (update-state.local.json) and compares it with that share. This number never leaves your device.

Storing this number and the day of the last automatic check on your device, and reading the details sent with each check, is strictly necessary for the automatic updates that are part of the app, so it does not require consent (§ 25(2) no. 2 TDDDG). You can switch off automatic update checks under Settings, Updates; the app then checks only when you ask it to.

We use these requests to deliver the update that fits your system. Legal basis: Art. 6(1)(b) GDPR where you use atermi under our Terms of Service yourself, otherwise Art. 6(1)(f) GDPR; our legitimate interest is to keep every installation up to date and secure.

We also count, per day and in aggregate, how many update checks and downloads each app version makes, without your IP address and without any identifier. This shows us which versions are still in use, so that we do not stop supporting a version people still run, and whether a new release arrives as expected, so that we can pause a faulty one. These counts contain no personal data. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a safe and reliable update process that leaves no installation behind. The requests themselves, including your IP address, are kept in our server logs for 30 days (see How long we keep data). You can object to this processing at any time (see Your right to object).

If you switch on Receive internal releases under Settings, Updates, the app creates a random tester identifier, shows it there and sends it with its update checks and downloads while the switch is on, so that we can give releases still in internal testing to installations we have put on our list. To join, send us the identifier shown there. We use this identifier for nothing else, apart from our server logs (see How long we keep data). The app deletes it when you switch the setting off; we keep it on our list until you ask us to remove it or the test ends. Legal basis: § 25(2) no. 2 TDDDG, as you have asked for this function, and Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR; our legitimate interest is to give releases still in testing only to installations we have admitted.

If you switch on Share diagnostics under Settings, Updates, the app additionally sends events about available updates, downloads, installations, rollbacks and crash loops: the event, the versions involved, how long it took, a fixed error code where there is one, the time, the release channel and rollout ring, your operating system and processor architecture, and a random identifier for your installation that lets us tell repeated events of one installation apart from events of many. The app creates this identifier when you switch diagnostics on. When you switch diagnostics off, the app stops using the identifier, has us delete the events already sent with it and then deletes the identifier as well; if your device is offline at that moment, this happens as soon as it is back online. If you had switched diagnostics on before events carried this identifier, the app switched them off with this change and asks you again. Diagnostics are off by default, and you can switch them off at any time with effect for the future. Legal basis: your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR. Otherwise, diagnostic events are deleted after 90 days.

If the app stops trying to install an update after it failed repeatedly, Settings asks you once whether to send a report about that failure. The report contains the version that failed, the app version, the release channel and rollout ring, the operating system, the processor architecture and a fixed error code, with a random identifier used for this report only, but no error message and no content from your device. It is sent once, only if you agree, and deleted after 90 days. The app keeps the report's identifier until then, so that you can withdraw your consent at any time under Settings, Updates; the report is then deleted. Legal basis: your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR.

Earlier versions of the app sent a random install identifier with every update check, and a separate event when a check started. We discard the identifier and these events when older versions still send them; only our server logs can still contain the identifier, and we delete them after 30 days (see How long we keep data). We have turned the identifiers and events stored so far into counts without personal data and then deleted them. The current version deletes the identifier from your device.

11. Bug reports, ideas and votes

In the desktop app, you can report a bug under Feedback in the sidebar. Nothing is sent until you press Send report. The report contains the text you write and, only if you switch on Include system info for that report, the app version, the release channel, your operating system with its version and the processor architecture, exactly as the dialog shows them. It contains no account, no email address and no identifier for your installation. Reports always go to us, also when you use the app without an account or with a server you host yourself. They reach our servers through our processor Cloudflare (see Cloudflare above). As with every request, your IP address is kept in our server logs for 30 days (see How long we keep data); the logs record that a report was sent, but not what it says. We do not use your IP address, or anything else, to find out who sent a report. Please leave passwords, keys, hostnames and other personal details out of your text.

We use a report to find and fix the error it describes. It is kept on our own servers in Germany, where only our team can read it. If the error needs work, our team files an issue about it in a private repository of our development team at GitHub (see GitHub below). The issue contains only what our team takes from your report after removing personal details, and your report itself is then deleted. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to learn about errors in atermi and fix them, which is also what you ask for when you send a report. The app reads the system information on your device only to show it to you in the dialog, and sends it only if you switch it on for that report. Sending it is then part of the function you have asked for, so it does not require consent (§ 25(2) no. 2 TDDDG).

On atermi.com/ideas you can suggest an idea for atermi while you are signed in to your atermi account. We ask you to sign in only to keep the board free of spam: we check that you are signed in, but we do not pass on your account, name or email address with your idea, and we do not store which account an idea came from. The idea, that is its title and any details you add, goes to our own servers in Germany, where our team reads it.

Nothing you suggest is published automatically. If we put an idea on the board at atermi.com/ideas, and perhaps later on the roadmap at atermi.com/roadmap, we publish a title and a short summary based on your text, which we may shorten or edit, but never your name. Before we publish an idea, we remove any personal details from it. We file the published text as an issue in our private repository at GitHub (see GitHub below); what you sent us is then deleted. The published text can be read by anyone. Legal basis for receiving, reviewing and publishing ideas: Art. 6(1)(f) GDPR; our legitimate interest is to collect suggestions for atermi, to decide what we build next and to show openly what people ask for and what we plan. If you object to the publication of your idea (see Your right to object), we take it down.

While you are signed in, you can vote for or against an idea on the board and take your vote back. We store your vote with your account: the item, whether you voted for or against it, and when you voted and last changed your vote. Everyone sees only the total for each item; only you see your own votes. Votes stay on our own servers in Germany and are not passed on to GitHub or anyone else. Legal basis: Art. 6(1)(b) GDPR, as voting is a function of your account; where you use atermi on behalf of an organisation, Art. 6(1)(f) GDPR, our legitimate interest being a board on which every account counts once. Taking a vote back deletes it at once. Your votes are part of the account data you can download, and they are deleted with your account (see Exporting and deleting your data).

The board and the roadmap show only what we have published: a title, a summary, a stage and, for planned or shipped work, a date. Our servers fetch these public details from GitHub every few minutes and keep a copy of them to show on the website.

GitHub: our team files issues about bug reports and published ideas in a private repository and project of our organisation at GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. They contain only what our team has taken from reports after removing personal details, and the public text of published ideas. GitHub stores and processes them for us as our processor under a data processing agreement (Art. 28 GDPR). They reach GitHub only from our own servers, so GitHub receives neither your IP address nor any identifier of you or your installation. For a few purposes of its own that this agreement lists, such as detecting abuse of its service, GitHub processes the content under its own responsibility and its own privacy statement. GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, the data processing agreement includes the EU standard contractual clauses (Art. 46(2)(c) GDPR); you can obtain a copy of them from us at privacy@ladruit.com. Legal basis for using GitHub: Art. 6(1)(f) GDPR. Our legitimate interest is to handle reports and ideas in the tools our team uses to plan and build atermi.

We delete a bug report or an idea on our servers as soon as we have decided on it, and at the latest 90 days after we received it. A published idea is kept for as long as we show it on the board or roadmap; when we take it down, we delete it from our servers, together with the votes on it, within 90 days.

Because bug reports and ideas carry no account or other identifier, we cannot tell on our own which of them came from you. To receive a copy of one, have it corrected or deleted, or object to it, write to privacy@ladruit.com as described under Withdrawing consent and data we cannot link to you.

12. Newsletter

You can subscribe to the atermi newsletter with or without an account. We then store your email address, the status of your subscription, confirmation and unsubscribe tokens and the time of subscription, confirmation and unsubscription. That is all the newsletter data we store; it is currently limited to the email address and these records.

We send the newsletter only after you confirm your address through the link in a confirmation email (double opt-in). It contains product news, release notes, beta and security information and offers about atermi. We do not measure whether you open it or click links. Legal basis: Art. 6(1)(a) GDPR (consent).

You can withdraw your consent at any time, through the link at the end of every newsletter or by writing to privacy@ladruit.com. Unsubscribing does not affect your account or emails we have to send for it.

13. Service emails

We send emails that your account needs, such as verification and sign-in codes, password resets, security notices and important changes to the service or these documents. We send them from our own mail server. Legal basis: Art. 6(1)(b), (c) and (f) GDPR.

14. Contacting us

If you write to us, we process your email address, your message and anything you attach, in order to answer you. Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract with us, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering the requests we receive.

15. Payments

Paid checkout is not currently enabled, and we process no payment data. Before we introduce paid plans or a payment provider, we will update this Privacy Policy.

16. Cookies and storage on your device

The website and the cloud service use only cookies and local storage that are strictly necessary for a service you asked for: keeping you signed in, protecting forms against misuse and remembering settings such as the colour theme. Storing and reading this information does not require consent under § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Any personal data involved is processed under Art. 6(1)(b) or (f) GDPR.

Specifically: the cookie atermi_consent stores the choice you make under Visitor statistics above and, separately, whether you have objected to the consent-free counting described there with the 'Basic statistics' switch, for 12 months, and needs no consent of its own because it only remembers a choice you already made (§ 25(2) no. 2 TDDDG). It is set for atermi.com and all its subdomains, so that api.atermi.com can read the same choice, for example when you download an installer from there. During a password reset you asked for, the website keeps your email address in your browser's session storage (reset_email) to carry it from one step to the next; it is deleted when the reset is done and at the latest when you close the tab. With your consent, the analytics script also reads a value named umami.disabled from your browser's local storage, which lets it recognise whether you have separately switched it off there; it never writes it. The session recording script stores nothing in your browser.

The desktop app stores settings, cached data and keys on your device, protected where possible by your operating system's keychain. This data stays on your device unless you synchronise it through your account, with the exception of the update information described under Desktop app updates and the bug reports you choose to send (see Bug reports, ideas and votes).

Beyond the consent choice described under Visitor statistics above, we do not use analytics, advertising or other tracking cookies.

17. Hosting and backups

atermi runs on server hardware that we operate ourselves. Database backups are kept in two places: on storage we operate ourselves, and as an additional encrypted copy in Cloudflare's object storage in the European Union, which only we can decrypt. Backups are deleted automatically, so data that we delete from our live systems remains in them for up to 14 days. They exist only to restore the service after a technical failure, and apart from regular tests that such a restore works, we do not use them. If we ever restore the service from a backup, we repeat every deletion made after that backup before the service is used again.

18. Recipients

We do not sell personal data and do not pass it on for advertising. Recipients are limited to Cloudflare as described above, GitHub for what our team files about bug reports and ideas as described under Bug reports, ideas and votes, the sign-in provider you choose, other members of teams you belong to as described above, the public for the text of ideas we publish, and authorities or courts where we are legally required to disclose data.

19. How long we keep data

We keep account data for as long as your account exists. If the registration of an account is not completed, we delete the account after 7 days. When you delete your account, we delete its data from our live systems immediately, except for the entries in the key chain of a team that continues without you (see Teams). The deleted data then remains only in the backups described above, for up to 14 days.

When an account is deleted, whether you delete it, we delete it at your request, or we delete it because its registration was not completed, we keep a record of the deletion: the account's user ID, a keyed hash of its email address, when the deletion was requested and carried out, and which of these three cases it was. We cannot recover the email address from the hash, but we can check whether an address you give us belonged to a deleted account, for example to answer your question whether we deleted your data. We also keep the user ID and the time of the deletion in a separate store outside our database. Both let us repeat the deletion if we ever have to restore the database from a backup, so that deleted data does not come back. We delete the separate copy within 31 days after we store it, which is normally right after the deletion, and the record 3 years after the deletion; the record remains in our backups as described above. Legal basis: Art. 6(1)(c) GDPR together with Art. 17 GDPR, as far as we need these records to repeat a deletion after a restore, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest is being able to show that and when we deleted an account, to answer questions about it, and to make sure that a repeated deletion never affects a new account. You can object to this processing (see Your right to object).

When synchronisation ends with a plan or trial, the copy of your synchronised entries is kept for 30 days, as described under Encrypted vault and synchronisation, and then deleted automatically.

Session records, including the IP address and user agent they hold, are deleted when you sign out or end the session, and within a day of the session expiring. Server logs, which contain IP addresses, are deleted automatically after 30 days. We keep them this long because attacks and misuse of accounts are often noticed only days later. Diagnostic events from the desktop app, which you can switch on under Settings, Updates, and failure reports you agreed to send are deleted after 90 days. Visitor statistics are deleted automatically after 14 months. With your consent, click positions and scroll depth are kept separately and deleted after 90 days, and session recordings are deleted after 30 days (see Visitor statistics above). The statistics database is backed up daily to our own storage in Germany; deleted statistics remain in these backups for up to 30 more days until they are overwritten, and the backups are used only to restore the service. Entries in a team's history are deleted after 24 months, connections to team hosts after 12 months, and all of them when the team is deleted. The IP address and user agent an entry holds are deleted after 30 days, for the same reason as server logs. When you delete your account, we delete the entries for your own actions and remove you from entries about you. Key chain entries that name a deleted account are removed as described under Teams and then remain in our backups for up to 14 days. The checksums that replace them are deleted with the team.

Bug reports and ideas are deleted from our servers as soon as we have decided on them, and at the latest 90 days after we receive them. A published idea is kept for as long as we show it on the board or roadmap and deleted within 90 days after we take it down, together with the votes on it. Otherwise, votes are kept until you take them back or delete your account.

Newsletter records are kept while you are subscribed. After you unsubscribe, we keep your email address and the time you unsubscribed, so that we can prove your withdrawal and do not write to you again. Emails to us are kept for as long as needed to handle the matter, and longer only where the law requires it.

20. Exporting and deleting your data

In the desktop app, under Settings, Account, you can download a copy of your account data and delete your account yourself. You can also ask us to do either by writing to privacy@ladruit.com.

Because we cannot read your encrypted vault, an export from us contains your vault only in encrypted form. The desktop app shows your decrypted data.

The download includes your votes on the idea board, each with the title of the item. It does not include bug reports or ideas you sent, because we do not store which account or installation they came from (see Withdrawing consent and data we cannot link to you).

21. Your rights

Under the GDPR you have the right to:

• access to your personal data (Art. 15 GDPR),
• correction of inaccurate data (Art. 16 GDPR),
• deletion (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• receive the data you provided to us in a structured, common, machine-readable format (Art. 20 GDPR),
• withdraw any consent at any time, with effect for the future and without affecting processing that took place before (Art. 7(3) GDPR),
• lodge a complaint with a supervisory authority (Art. 77 GDPR).

22. Withdrawing consent and data we cannot link to you

You can withdraw any consent you have given for analytics or session recordings at any time, with effect for the future, under 'Privacy settings' at the bottom of every page.

Where we hold your data only as a pseudonymous statistic, as described under Visitor statistics above, or in a bug report or an idea that carries no account or other identifier, as described under Bug reports, ideas and votes, we generally cannot tell which data is about you. The rights above, in particular access, correction, deletion and receiving your data (Art. 15 to 20 GDPR), then apply only if you give us additional information that lets us find the data concerning you (Art. 11(2) GDPR).

For a bug report or an idea, write to privacy@ladruit.com with its wording, or a passage from it that would hardly appear in any other, and roughly when you sent it. If we find it, we delete it, correct it or take it off the board, as you ask. Before we send you a copy, we may ask you for further details, so that we do not give one person's report to someone else.

23. Your right to object

Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

For the consent-free visitor statistics described under Visitor statistics, you do not need to write to us to object: the 'Basic statistics' switch under 'Privacy settings' at the bottom of every page takes effect immediately, in addition to switching on Do Not Track or Global Privacy Control in your browser.

If we process your data for direct marketing, you can object at any time without giving reasons (Art. 21(2) GDPR).

To object to the publication of an idea you suggested, or to us keeping a bug report you sent, write to privacy@ladruit.com with the details described under Withdrawing consent and data we cannot link to you. We then take the idea down or delete the report.

To object to anything else, write to privacy@ladruit.com. We answer requests without undue delay and within one month at the latest. For complex requests this period can be extended by two further months, and we will tell you within the first month if that happens.

24. Supervisory authority

The supervisory authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestraße 2-4 40213 Düsseldorf, Germany You may also complain to the supervisory authority where you live or work.

25. Automated decisions

We make no decisions based solely on automated processing, including profiling, that have legal effects on you or affect you similarly significantly (Art. 22 GDPR).

26. Changes to this Privacy Policy

We update this Privacy Policy when atermi or the way we process data changes, for example when we introduce paid plans. The current version is always available at atermi.com/privacy. If a change affects you significantly, we will also tell you by email.