Privacy Policy

Version 1 · Last updated April 30, 2026

1. Who We Are

Relocat ("we", "us", "our") operates the Relocat platform — an end-to-end encrypted document storage and sharing service. We act as the data controller for the personal data described in this policy.

Registered address: Contact: privacy@relocat.org

2. What Data We Collect

Account data

When you register, we collect your email address and a hashed device identifier. We do not collect your name, phone number, or postal address.

Device and session data

We store a unique device ID and its public cryptographic key to authenticate your requests. No private keys ever leave your device.

Server logs

Our servers log standard HTTP request data: IP address (truncated after 365 days), timestamp, HTTP method and path, and user-agent string. These logs are used for security monitoring and abuse prevention.

Encrypted files and metadata

We store the encrypted blobs you upload, along with encrypted metadata (file names, sizes). We store these as opaque binary objects — we cannot read their contents.

3. What We Cannot Access

Relocat is a zero-knowledge platform. All file content, file names, and metadata are encrypted on your device before being sent to our servers, using keys that never leave your device. This means:

We cannot read your files or their names.
We cannot read any metadata you store in your vault.
We cannot comply with requests to disclose file contents, because we technically cannot access them.

This is not a policy choice — it is a cryptographic guarantee built into the platform architecture.

4. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases:

Contract (Art. 6(1)(b)): Processing your email and device credentials is necessary to provide the Relocat service you have registered for.
Legitimate interest (Art. 6(1)(f)): Retaining server logs for up to 365 days is necessary for security monitoring, abuse prevention, and incident response. We have assessed that this interest does not override your fundamental rights given the short retention period and the absence of profiling.

5. Third-Party Processors

We use the following sub-processor to store encrypted data on your behalf:

Amazon Web Services (AWS) — cloud object storage in EU (Frankfurt). Only encrypted blobs are stored; Amazon Web Services (AWS) cannot decrypt them. Data processing agreement in place per GDPR Art. 28.

We do not share personal data with any other third parties, sell data, or use it for advertising.

6. Data Retention

Account and device data: Retained for the duration of your account. Deleted within 30 days of account deletion.
Encrypted vault data: Retained until you delete it or your account is deleted.
Server logs: Retained for 365 days, then automatically deleted.
Guest link access logs: Retained for 365 days for security auditing, then deleted.

7. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights:

Right of access (Art. 15): Request a copy of the personal data we hold about you.
Right to rectification (Art. 16): Ask us to correct inaccurate data.
Right to erasure (Art. 17): Ask us to delete your account and associated data.
Right to data portability (Art. 20): Receive your account data in a machine-readable format.
Right to restrict processing (Art. 18): Ask us to pause processing in certain circumstances.
Right to object (Art. 21): Object to processing based on legitimate interest.

To exercise any of these rights, contact us at privacy@relocat.org. We will respond within 30 days.

You also have the right to lodge a complaint with your national data protection supervisory authority.

8. Data Protection Officer

Note: if and appear as literal placeholders, the DPO details have not yet been configured. Contact privacy@relocat.org in the meantime.

9. Cookies and Tracking

The Relocat guest file sharing page (/g/) uses no cookies, no tracking pixels, and no analytics scripts. The authenticated application uses a session cookie strictly necessary for login — no consent is required under the ePrivacy Directive for strictly necessary cookies.

We do not use advertising cookies, behavioral tracking, or third-party analytics on any page.

10. International Transfers

Encrypted data may be stored in EU (Frankfurt). All transfers within Amazon Web Services (AWS)'s infrastructure are covered by Standard Contractual Clauses (SCCs) under GDPR Art. 46(2)(c).

11. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. We will notify registered users by email of any material changes at least 14 days before they take effect. The version number and last updated date at the top of this page always reflect the current version.

Governing law: European Union.

12. Contact

For any privacy-related questions or to exercise your rights: privacy@relocat.org