Privacy Policy

intelligent piXel GmbH
International Institute of Forensic Expertise (IIFE)
Enzianstraße 4a
82319 Starnberg
Germany

Email: george@rauscher.xyz

Contact Form: Homepage Contact Form

Zero-knowledge by design. All encryption and decryption happens in your browser. We have no access to your data and strictly adhere to all data protection laws.

Client-Side Encryption: All encryption and decryption happens in your browser using the Web Crypto API. Your plaintext and passwords never leave your device.

Zero Server Knowledge: We have no access to your messages, passwords, or encryption keys. Even if we wanted to read your data, we couldn't.

IP Addresses (Website Visitors):
We do not log or store IP addresses of our website visitors beyond the technically required temporary processing for delivering web content (max. 14 days in server logs for security purposes). No permanent storage, no tracking, no profiling. Legal basis: Art. 6(1)(f) GDPR.

IP Addresses (Contact Form):
When you use our contact form, we process your IP address for abuse protection: rate limiting, country and VPN/hosting checks, and automated spam classification. A security log keeps the event type, IP address, and sender email for a maximum of 14 days, then deletes them automatically. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing spam and abuse).

Contact Form Data:
When you submit our contact form, we process the following data:

• Your name (as provided by you)
• Your email address
• Your message
• Your consent confirmation
• Your IP address, country/network metadata, and submission time (abuse protection)

The form does not write this data to a database on the web server. The message is handed to Proton Mail SMTP over an encrypted TLS connection and delivered to the mailbox that handles it. The provider of the mail delivery service and of that mailbox is Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland. Proton AG acts as our processor. The data processing agreement under Art. 28(3) GDPR forms part of its terms of service. Switzerland is covered by a European Commission adequacy decision under Art. 45 GDPR. Legal basis: Art. 6(1)(a) GDPR (consent via the form checkbox) and, where the inquiry prepares a contract, Art. 6(1)(b) GDPR. You may withdraw consent at any time with effect for the future.

Cookies:
We don't use cookies. No tracking, no analytics, no third-party scripts.

Your Messages & Files:
Your encrypted or decrypted messages and files never touch our servers. Everything happens in your browser. We have zero access to your data.

We do not analyze or store any data collected during your visit to our website. No analytics tools, no tracking pixels, no data mining.

The only data temporarily processed is:

• Anonymous HTTP requests to serve HTML/CSS/JavaScript files
• These are not logged or stored beyond normal web server operation

We offer our encryption service free of charge, because we believe in everyone's right to privacy.

No ads, no premium tiers, no upsells. Just pure, secure encryption.

SSL/TLS Encryption:
Our website uses industry-standard SSL/TLS encryption (HTTPS) with 2048-bit or stronger certificates. You can verify this by checking for the lock icon in your browser.

Server Location and Hosting:
This website is hosted on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner is a European provider, all server data is processed and stored exclusively in Germany. A data processing agreement (DPA) under Art. 28 GDPR is in place with Hetzner.

Security Infrastructure (IPServerSec and CrowdSec):
The server is protected by IPServerSec, an in-house hardening and early warning system developed by intelligent piXel GmbH. IPServerSec deploys traps for automated attack scanners, monitors the server for reachability and anomalies, and sends alerts to the administration within seconds via SMS and email. To operate this system, your IP address is processed for attack detection and automatic blocking decisions. Legal basis: Art. 6(1)(f) GDPR.

The website is also protected by CrowdSec, a behavioral detection engine and Web Application Firewall (WAF). CrowdSec analyzes requests for attack patterns (SQL injection, XSS, RCE, LFI) and automatically bans attacking IP addresses. Your IP address, the requested path, and HTTP headers are processed for this purpose. Legal basis: Art. 6(1)(f) GDPR.

Technical Measures:
We employ suitable technical and organizational security measures to protect against accidental or intentional manipulation, loss, destruction, or unauthorized access. Our security measures are continuously improved.

The complete source code of our encryption implementation is available for review. We use standard Web Crypto API methods with no obfuscation.

Check your browser's developer console to see the encryption process in action - everything happens locally.

Right to Information:
You always have the right to request information about your stored personal data free of charge. For contact form submissions, we store your IP address for a maximum of 14 days in security logs for spam protection. For encryption/decryption operations, no personal data is stored (zero-knowledge architecture).

Right to Deletion:
You have the right to request deletion of your personal data at any time. For contact form submissions, you can request immediate deletion of your stored IP address by contacting us. Security-log and rate-limit data are automatically deleted after 14 days.

Right to Data Portability:
You have the right to receive your personal data in a structured, commonly used format. For contact form submissions, this includes your stored IP address and timestamp. Please contact us to request your data.

Right to Objection:
You have the right to object to data processing based on legitimate interests (Art. 21 GDPR). However, since we process minimal data only for technical necessity, there's nothing to object to.

Right to Lodge a Complaint:
You have the right to lodge a complaint with a supervisory authority if you believe our data processing violates data protection laws.

Data Protection Authority:
Bavarian Data Protection Authority (BayLDA)
Promenade 18, 91522 Ansbach, Germany

If you have any questions about your data, please contact us using the details provided at the top of this page.

Use at Your Own Risk: This service is provided "as is" without warranties of any kind.

Limitation of Liability:
intelligent piXel GmbH is liable without limitation for damages caused by intent or gross negligence. For damages caused by slight negligence, liability is limited to typical and foreseeable damages. This limitation does not apply to liability for personal injury, death, or damages under the Product Liability Act.

Damages that may be limited under this clause include, but are not limited to:

• Data loss or corruption (if caused by slight negligence)
• Unauthorized access to your data (if not due to our negligence)
• Business interruption or lost profits
• Indirect or consequential damages

We cannot guarantee the availability, reliability, or accuracy of the information and services on our website.

Password Security:
We cannot recover lost passwords. If you forget your password, your encrypted data is permanently inaccessible. There are no backdoors.

By using our website and services, you acknowledge this disclaimer.

We reserve the right to update this privacy policy from time to time to reflect changes in our services or legal requirements.

The updated policy will apply to your next visit. We recommend checking this page periodically for updates.

Last Updated: 18 August 2026
Version: 2.3.0 (Contact form: Proton Mail SMTP, shared abuse protection)

If you have any questions about this privacy policy or our data practices, please contact us:

Email: george@rauscher.xyz
Contact Form: Homepage Contact Form
Website: encryptor.app