encryptor.app
EN DE

Privacy policy

Last updated: September 26, 2026

In brief

  • Encryption and decryption run in your browser. Your text, files and passwords are not sent to our server.
  • No cookies, no analytics, no tracking. No content is loaded from third-party servers.
  • Our web server keeps log files for up to 14 days.
  • If you use the contact form, we process your data to answer you and to prevent abuse.

Controller

intelligent piXel GmbH
International Institute of Forensic Expertise (IIFE)
Enzianstraße 4a
82319 Starnberg
Germany

Email: george@rauscher.xyz
Contact form: encryptor.app/contact/

Encryption on your device

All encryption and decryption happens in your browser, using the Web Crypto API and the hash-wasm library, which is served from encryptor.app. Your plaintext, your files and your passwords never leave your device.

We have no access to your messages, files, passwords or encryption keys. encryptor does not store passwords.

Cookies, analytics, third-party content

We don't use cookies. No analytics tools, no tracking pixels, no profiling.

All scripts, styles and fonts are served from encryptor.app. The website loads no content from third-party servers.

If you choose a color theme, your browser stores this choice locally under the name encryptor-theme. It is not sent to us. Legal basis: Section 25(2) no. 2 TDDDG, because the storage is strictly necessary for the function you requested.

Server log files

When you visit encryptor.app, our web server (nginx) processes your IP address to deliver the pages and records requests in log files for security purposes. The log files are deleted automatically after 14 days at the latest. There is no permanent storage, no tracking and no profiling.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.

Contact form

When you submit the contact form, we process the following data:

  • your name, as provided by you
  • your email address
  • your message
  • your consent confirmation
  • your IP address, country and network metadata, and the time of submission (abuse protection)

Purpose: to answer your inquiry.

The form does not write this data to a database on the web server. The message is handed to Proton Mail SMTP over an encrypted TLS connection and delivered to the mailbox that handles it. The provider of the mail delivery service and of that mailbox is Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland. Proton AG acts as our processor. The data processing agreement under Art. 28(3) GDPR forms part of its terms of service. Switzerland is covered by a European Commission adequacy decision under Art. 45 GDPR.

Legal basis: Art. 6(1)(a) GDPR (consent via the form checkbox) and, where the inquiry prepares a contract, Art. 6(1)(b) GDPR. You may withdraw consent at any time with effect for the future.

Storage period: we keep your message as long as needed to answer your inquiry. Statutory retention obligations remain unaffected.

Abuse protection for the contact form

When you open the contact page or send the contact form, we process your IP address to protect the form against spam and abuse:

  • Rate limiting: we count requests per IP address.
  • Network and country check: our server sends your IP address to the service ip-api.com. It returns whether the address belongs to a VPN, a proxy or a data center, and in which country it is located. We keep this result on our server for 6 hours.
  • Automated spam classification of the message.

Requests through a VPN, a proxy or a data center network, and requests from countries outside the EU and the USA, are not accepted by the form. You can reach us by email instead.

A security log keeps the event type, IP address and sender email for a maximum of 14 days, then deletes them automatically.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is preventing spam and abuse.

Hosting

This website is hosted on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner is a European provider, and all server data is processed and stored exclusively in Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

Data security

Our website is transmitted with TLS encryption (HTTPS).

The server is protected by IPServerSec, an in-house hardening and early-warning system developed by intelligent piXel GmbH. IPServerSec deploys traps for automated attack scanners, monitors the server for reachability and anomalies, and sends alerts to the administration within seconds via SMS and email. To operate this system, your IP address is processed for attack detection and automatic blocking decisions. Legal basis: Art. 6(1)(f) GDPR.

The website is also protected by CrowdSec, a behavioral detection engine and web application firewall (WAF). CrowdSec analyzes requests for attack patterns (SQL injection, XSS, RCE, LFI) and automatically bans attacking IP addresses. Your IP address, the requested path and the HTTP headers are processed for this purpose. Legal basis: Art. 6(1)(f) GDPR.

We employ suitable technical and organizational security measures to protect against accidental or intentional manipulation, loss, destruction or unauthorized access. Our security measures are continuously improved.

Open source and transparency

The source code of the web version is public on GitHub. SHA-256 checksums of every file served on this site are published on the How it works page and in the GitHub release.

Free of charge

encryptor is free of charge. No ads, no premium tiers, no upsells.

Your rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): you can request information about your stored personal data free of charge. For contact form submissions, we store your IP address in security logs for a maximum of 14 days for spam protection. For encryption and decryption, no personal data is stored.
  • Right to rectification (Art. 16 GDPR).
  • Right to erasure (Art. 17 GDPR): you can request deletion of your personal data at any time. For contact form submissions, you can request immediate deletion of your stored IP address. Security log and rate limit data are deleted automatically after 14 days.
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR): you can receive your personal data in a structured, commonly used format. For contact form submissions, this includes your stored IP address and timestamp.
  • Right to object (Art. 21 GDPR): you can object at any time to processing based on legitimate interests. Just write to us.
  • Right to withdraw consent (Art. 7(3) GDPR), with effect for the future.
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Supervisory authority: Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

If you have any questions about your data, please contact us using the details at the top of this page.

Disclaimer and liability

Use at your own risk: this service is provided as is, without warranties of any kind.

Limitation of liability: intelligent piXel GmbH is liable without limitation for damages caused by intent or gross negligence. For damages caused by slight negligence, liability is limited to typical and foreseeable damages. This limitation does not apply to liability for personal injury, death, or damages under the Product Liability Act.

Damages that may be limited under this clause include, but are not limited to:

  • data loss or corruption (if caused by slight negligence)
  • unauthorized access to your data (if not due to our negligence)
  • business interruption or lost profits
  • indirect or consequential damages

We cannot guarantee the availability, reliability or accuracy of the information and services on our website.

Password security: encryptor generates the password and does not store it. We cannot recover lost passwords. Without the password, your encrypted data is permanently inaccessible. There are no backdoors.

By using our website and services, you acknowledge this disclaimer.

Changes to this policy

We reserve the right to update this privacy policy from time to time to reflect changes in our services or legal requirements. The updated policy applies to your next visit. We recommend checking this page periodically.

Questions?

If you have any questions about this privacy policy or our data practices, please contact us.
Email: george@rauscher.xyz
Contact form: encryptor.app/contact/
Website: encryptor.app