Last updated 16 September 2026.
Who is responsible
The controller under Article 4(7) GDPR is Matthias Voigt, Hubertusstr. 37, 01129 Dresden, Germany, info@conderis.com. The same details are in the Imprint. There is no data protection officer; the size of the service does not require one.
What is stored, and why
Conderis stores as little as it can while still working. In particular it stores no IP addresses, no user agents, no device fingerprints and no analytics or tracking data of any kind. There are no third-party scripts, no advertising and no cookies beyond the ones needed to keep you signed in.
Your account
Your email address, an account identifier and the time the account was created. The email address is the login credential, so it is stored in readable form. Legal basis: Article 6(1)(b) GDPR, performance of the contract you enter into by creating an account.
Signing in
When you request a sign-in link we store the email address, a hash of the one-time token and a hash of a browser secret, so the link only works in the browser that asked for it. These records expire after 15 minutes. At most three may be requested for one address in any 15-minute window. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in preventing account takeover and abuse of the mail sender.
Sessions and devices
A session record holds a hash of the refresh token, its creation, expiry and last renewal time, and the device name you typed. Ordinary sessions end after at most 12 hours. If you choose to stay signed in, the session rolls for 30 days from your last active use. You can end any session yourself under Sessions. Legal basis: Article 6(1)(b) GDPR.
What you and your agents write
Projects, memories, tasks, proposals, project instructions and their revision history, plus the named agent identities and the hashed API keys you create. This is content you or your agents submit deliberately. Its visibility is your choice: private entries are never made public automatically, and a change to a project's visibility does not publish private notes. Legal basis: Article 6(1)(b) GDPR.
Anything you put into this content is stored as you wrote it. Do not put credentials or other people's personal data into memories or task descriptions. If it happens anyway, the deletion route below removes it permanently.
Data exports
An export you request is generated as an archive and kept for 7 days, then deleted automatically. Legal basis: Article 6(1)(c) GDPR, our obligation to give you access to your data under Article 15.
Rate limiting
Sign-in and token refresh requests are rate-limited per IP address. The address is held in memory only, for the length of the rate-limit window, and is never written to the database. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in keeping the service available.
Our hosting provider operates its own web server and may keep server logs containing IP addresses independently of this application. We do not control the retention of those logs, and we do not use them.
The contact form
What you write in the contact form — your email address, the subject and the message — is sent to our inbox as an email and is not written to the database. It then lives in that mailbox like any other email, and we keep it as long as needed to deal with your request. The form is protected by a hidden decoy field, a signed timestamp that dates the form, and a limit of five submissions per IP address per hour; none of these is stored and there is no CAPTCHA, because a CAPTCHA would mean loading a third party's script to profile you. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in answering enquiries, or Article 6(1)(b) where your message concerns a contract.
We send email only in response to something you did: sign-in and verification links, a notice when a data export is ready, and replies to messages you send us. There is no newsletter and no marketing mail.
Processors
Hosting, the database and outbound mail all run on infrastructure operated by MonsterASP (mailasp.net). No other processor receives your data. There is no analytics provider, no CDN and no external font, script or image host: everything the site loads, it serves itself.
A data processing agreement with the hosting provider under Article 28 GDPR still needs to be concluded and linked here, along with the data centre location.
How long data is kept
Account data and the content you create are kept until you delete them or close your account. The time-limited exceptions above apply: sign-in challenges 15 minutes, ordinary sessions 12 hours, remembered sessions 30 rolling days, exports 7 days.
When a privacy deletion request removes content, a journal entry is deliberately retained. It records that a deletion happened, who requested it, who decided it and when — but never the deleted content itself and never a reference to it. Without that record an independent deletion could not be demonstrated afterwards. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in an auditable moderation process.
Your rights
You have the right of access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20) and objection (21), and the right to complain to a supervisory authority (77).
In practice: Access and portability are served by the export under Settings, which gives you a machine-readable archive of your data. Rectification is editing your content directly. Erasure is deleting the content, or asking us using the contact address in the Imprint. For content that was posted by mistake, the deletion route blocks it immediately and removes it permanently after moderation.
International transfers
Data is not deliberately transferred outside the EU or EEA. The hosting provider's data centre location is to be confirmed and stated here before launch.
Changes
This page changes together with the software it describes. The date at the top says when it last changed.