Privacy Policy

1. Controller

Fabio Simrath, Jenbach, Austria
E-mail: [email protected]

For any question about privacy and to exercise your rights, simply write to this address.

2. The most important points

• The Simrath server is located with the controller in Austria. Your data is stored there.
• The AI assistant Vision is only available to the operator and administrators. For all other users nothing is sent to an AI provider.
• You need to be at least 14 years old to create an account.
• No advertising, no analytics services, no tracking cookies.
• Data is not sold and is only passed on to the service providers named below.

3. Visiting the website

The website is delivered through Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Cloudflare forwards the requests and protects the server from attacks. In doing so, technical data is processed: IP address, time, the address requested and browser details. Cloudflare is certified under the EU-US Data Privacy Framework, which makes the transfer to the USA lawful.

The server itself keeps a log, among other things for sign-ups, sign-in attempts and pairing devices. It may contain your IP address. The log serves security (e.g. against password guessing) and troubleshooting; every entry is deleted automatically after 30 days.

Legal basis: legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

4. No cookies, storage in your browser

Simrath doesn't set cookies. So you stay signed in, the website stores your access key, the server address and your chosen theme (light/dark) in your browser's local storage. This data stays on your device and is technically necessary for the service (§ 165(3) Austrian Telecommunications Act 2021). Each sign-in gets its own session key, which ends after 60 days without use. For the list "Your sessions" in your account, the server stores for each session the device name taken from your browser (for example "Safari on iPhone"), when you signed in and when you last used it. Signing out deletes the key on your device and ends the session on the server.

5. Account

When you create an account, we store your e-mail address, your username, your password, the IP address at creation and the time. The password is never stored in plain text, only as a secure hash (scrypt). Your username is public: other users can find you by it.

So nobody can use other people's e-mail addresses, we send a code to your address when you sign up. The code is valid for 15 minutes. Unconfirmed sign-ups are deleted when the code expires.

When signing up you also enter your birthdate. It is only used to check the minimum age of 14 (§ 4(4) Austrian Data Protection Act, Art. 8 GDPR), is not shown to anyone and not passed on. Anyone younger can't create an account; in that case we store nothing. We also store which version of the Terms of Service you accepted and when, so we can prove it.

If you turn on two-factor sign-in, we store the secret of your authenticator app and the recovery codes (only as hashes). They are deleted when you turn it off.

Legal basis: providing the service you want to use (Art. 6(1)(b) GDPR).

6. Requests for more access

In the Account tab you can ask for a higher access level with "Request more access". For this we store the level you want, your reason (if you write one), the time and the access key the request is for. The operator sees the request and decides.

The public form for access requests no longer exists since October 2026. Older requests from it (name, username, birthdate, e-mail address, IP address and the version of the Terms of Service) are still handled and deleted with your account at the latest.

Legal basis: Art. 6(1)(b) GDPR (handling your request).

7. E-mails

E-mails (codes for signing up and resetting your password, access requests, notices about your account) are sent through IONOS (IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany). IONOS processes your e-mail address and the content of the message as a processor within the EU.

News by e-mail: Only if you tick it when signing up or turn on "News by e-mail" in your Account, we send you news about Simrath now and then. For this we only use your e-mail address and store when you agreed. You confirm the address with the code we send you. You can turn the news off anytime in your Account or unsubscribe by e-mailing [email protected].

Legal basis for the news: your consent (Art. 6(1)(a) GDPR, § 174 Austrian Telecommunications Act 2021), which you can withdraw at any time for the future.

8. Messages, groups and profile

We store the messages you write (content, time, participants), your groups, whom you follow, whom you block, your notifications and files you upload. Messages are seen by the participants of the conversation.

Pictures and files sent in chats (up to 25 MB) are also only seen by the participants. They also see whether you have read their messages (only up to which message is stored). People you chat with can also see whether you are online right now or when you were last active; you can turn this off in your Account at any time. You can delete your own messages for everyone; an attachment is deleted with it.

Messages, attachments and notifications are stored encrypted with AES-256 on the server and protected by HTTPS on the way there. Only the server has the key, so this is not end-to-end encryption.

A profile picture is optional. If you upload one, we only keep a reduced copy (256 × 256 pixels) without metadata: location, camera and time of phone photos are removed. Signed-in users see it next to your username. You can change or delete it in your Account at any time.

Legal basis: Art. 6(1)(b) GDPR.

9. Location

Simrath no longer processes location data. The former location feature ("Location") and the sending of a location derived from the IP address no longer exist; all previously stored location data was deleted (October 2026). No map is loaded anymore either.

10. Vision (operator and administrators only)

Vision is only enabled for the operator and administrators. Questions to Vision are sent via Hermes Agent (running on the Simrath server) to the AI model Claude by Anthropic (Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA) and answered there. The conversation so far, date, time, the current weather and notes we added are sent along. The conversation (the latest messages) is stored on the Simrath server and can be deleted at any time with "New conversation".

Vision is no longer part of the website and is only used through the operator's own app. The Simrath server doesn't process voice recordings.

Legal basis: Art. 6(1)(b) GDPR.

11. Simrath devices

If you pair a Simrath device with your account, we store: a device identifier, model, firmware version, Wi-Fi name, signal strength, uptime, local and public IP address and the time of the last report. This lets you see in "Devices" whether your device is online. The device gets its own key and can only read your account's data as far as it needs for its display.

Legal basis: Art. 6(1)(b) GDPR.

12. How long we keep data

We keep your data as long as your account exists. You can delete your account yourself at any time with "Delete account" in the Account tab (or have it deleted by e-mailing [email protected]). This immediately deletes your account, username, birthdate, profile picture, messages, direct chats, group memberships, notifications, paired devices and your access requests. Groups you own go to the next member.

For other data, for example uploaded files, you can request deletion under "Delete other data" in the Account tab. We take care of it within one month (Art. 12 GDPR) and let you know. The request itself is deleted 30 days after it was completed.

Reports of content (section 15) are deleted 180 days after our decision; your own reports are also deleted right away when you delete your account.

Rejected or completed access requests are deleted as soon as they are no longer needed. Unconfirmed sign-ups expire after 15 minutes. Backups of the database, which are only made during maintenance, may still contain data for a limited time.

13. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw consent at any time for the future. Write to [email protected].

If you believe the processing of your data violates data protection law, you can complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

14. Security

All connections to Simrath are encrypted with HTTPS. Passwords are only stored as hashes, access keys are bound to access levels and can be blocked at any time.

Against password guessing, Simrath counts failed sign-ins per account and per IP address and blocks temporarily after several failed attempts. These counters are deleted at the latest 24 hours after the last failed attempt.

15. Reports of content

With "Report" in Connections you can report a message, a person or a group that you think is illegal or breaks the Terms of Service (Art. 16 Digital Services Act). For this we store who reports, what is reported (for a message, an encrypted copy of its text and the name of an attached file, so we can judge it), the reason, your note and the time. The operator reviews the report and tells you the decision. If a message is removed, its author is told why (Art. 17 DSA), but not who reported it, unless we are required to by law.

Legal basis: Art. 6(1)(c) GDPR (obligations under the Digital Services Act) and Art. 6(1)(f) GDPR (legitimate interest in a safe service and in defending against claims). How long: section 12.

16. Simrath on Instagram

Simrath has a presence on Instagram. When you visit it, Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland) processes your data under the Instagram Privacy Policy, also in the USA (Meta is certified under the EU-US Data Privacy Framework). For the statistics Meta shows us about our presence ("Insights", for example how many people saw a post), we and Meta are joint controllers (Art. 26 GDPR); Meta's Page Insights agreement applies. We only see aggregated numbers, not who you are. You can exercise your rights most easily with Meta directly, but also with us.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting Simrath and staying in touch with people who are interested).