Terms of Service

Version 8 · Last updated October 16, 2026

Effective from November 16, 2026

0. In short

Ruslan Zykun, a natural person established in Germany, operates Relocat. You can reach us at privacy@relocat.org.
The Service costs you no money, but you provide personal data to use it. So German and EU consumer law for distance contracts applies to our contract.
Your device encrypts your files, their names and the information you record about them, and we cannot read any of it.
We do see your email address, your device public keys, request logs, who shares with whom, every access to a share or a guest link, and anything you publish on the Community Map.
The Community Map, sharing with a professional advisor, connecting an AI assistant and crash reports are optional. Each is a separate choice you make.
The Service is an early test release. Formats may change and data may be lost. Keep your own backups of anything you cannot afford to lose.
You may withdraw from this contract within fourteen days without giving any reason. Settings carries a "Withdraw from contract" function.
You may delete your account at any time from a primary device. We will warn you, give reasons and let you respond before we suspend or terminate yours.
We will tell you at least 30 days before these Terms change and ask you to accept the new version. Silence is never acceptance.
You can report content to us at privacy@relocat.org and complain to us about a decision. You can also complain to the German Digital Services Coordinator at the Bundesnetzagentur.

1. Parties and scope

These Terms govern your use of the hosted Relocat service. Ruslan Zykun, a natural person established in Germany, operates the Service. The imprint at https://relocat.org/imprint/ publishes our postal address, our contact details and our points of contact under the Digital Services Act.

The Service means the Relocat mobile application, the browser session interface and the guest link page, together with the server that they talk to. The same deployment serves all three.

These Terms apply only to the hosted Service that we operate. The Relocat app, meaning the mobile application and the browser session interface, is free software published under the GNU General Public License version 3 or later, with additional permissions that we publish with its source code. That licence governs what you may do with the app's code. These Terms govern your use of our Service. The server software is ours and is not licensed to you. If you use the app with a server that someone else operates, that operator's terms govern that use, not these Terms.

We publish these Terms in a readable web page and in machine readable form through the legal endpoint that the app reads. Both carry the same text and the same version number [Art. 14(1) DSA].

The Privacy Policy explains what we do with personal data. It forms part of these Terms.

2. Access and eligibility

Registration is open. You register in the app with an email address and a device key that your device generates. An invitation code is optional. When we run the Service in invitation mode instead, registration refuses a request that carries no valid code. We may revoke an invitation code at any time.

You must be at least 18 years old to use the Service. When you register you confirm that you are at least 18 years old. We record that confirmation together with the version of these Terms that you accepted.

We do not verify your age and we do not ask for an identity document. The confirmation is a self declaration.

You must accept these Terms before you can publish anything on the Community Map.

If you are under 18, the contract is not automatically void. Your legal representative must approve it for the contract to take effect (§ 108(1) BGB). If we learn that an account holder is a minor, we ask the legal representative to approve the contract. If we receive no declaration within two weeks of that request, approval counts as refused (§ 108(2) BGB). We then close the account and delete the data as described in section 16.

You may not share your account with another person or let another person use your credentials. Each person registers their own account.

3. Conclusion of the contract and pre contract information

You conclude the contract with us when you accept these Terms on the entry screen of the app and complete registration. The entry screen names these Terms and the Privacy Policy and links to both before you accept (§ 305(2) BGB). We record which version you accepted, when, and from which device.

Because you provide us with personal data to use the Service, the rules on consumer distance contracts apply to this contract even though you pay no price (§ 312(1a) BGB). We process some of that data for purposes beyond performing the contract, for example the Community Map and crash reports. So we cannot rely on the exemption in § 312(1a) sentence 2 BGB. Art. 246a § 1 EGBGB requires us to give you the following information.

Essential characteristics. The Service stores documents that your device encrypts before upload, keeps them in sync across your own devices, and lets you share individual items with another account or through a guest link. Optional parts are the Community Map, sharing progress with a professional advisor, connecting an AI assistant, and crash reports.

Identity and address. Ruslan Zykun, contact privacy@relocat.org, full address in the imprint at https://relocat.org/imprint/.

Price. The Service is free of charge. There is no payment surface in the app or on the server, no subscription and no advertising.

What you provide instead of a price. An email address, a device public key and a device identifier derived from it, and the operational records described in section 6. The Privacy Policy sets out every category, its purpose, its legal basis and how long we keep it.

Functionality, compatibility and interoperability. The Service runs as an Android application, as a browser session interface and as a guest link page. The published text and the app interface are in English only. The Service stores your documents as encrypted blobs that only your own key material can open. Data formats, including encryption and backup formats, may change between versions during the test phase.

Duration and termination. The contract runs for an indefinite period. You may terminate it at any time by deleting your account in the app, with no notice period and no charge. Section 16 describes how we may terminate.

Conformity and updates. We owe you a Service that conforms to the contract and the updates needed to keep it in conformity for as long as we supply it (§§ 327e, 327f BGB). Section 7 explains what that means for a test release, and section 14 explains your rights if the Service is not in conformity.

Right of withdrawal. Section 4 sets out your right of withdrawal, the period, and how to exercise it.

Confirmation of the contract. We will send you a confirmation of this contract on a durable medium by email, including these Terms and the withdrawal instruction. We will send it at the latest before we begin to perform (§ 312f(2) BGB).

4. Right of withdrawal

You have a right to withdraw from this contract. We grant you this right whether or not the law requires it in your case.

Withdrawal instruction

You have the right to withdraw from this contract within fourteen days without giving any reason.

The withdrawal period is fourteen days from the day on which the contract was concluded.

To exercise your right of withdrawal, you must inform us, Ruslan Zykun, of your decision to withdraw from this contract by a clear statement, for example a letter sent by post or an email. Send it to the address published in the imprint at https://relocat.org/imprint/ or to privacy@relocat.org. You may use the model withdrawal form, but this is not obligatory.

To meet the withdrawal deadline, send your communication about your withdrawal before the withdrawal period expires.

Consequences of withdrawal

You pay us nothing for the Service, so there is nothing for us to refund and no charge falls on you. If you withdraw, the contract ends. We then delete your account and the data it holds, as described in section 16.

Lapse of the right

Where the law provides that the right of withdrawal lapses because we have fully performed the contract, it lapses on that basis. We will not treat your right as lapsed unless the law provides for it.

How to withdraw in the app

Settings carries a permanently available function labelled "Withdraw from contract" (§ 356a(1) BGB). You confirm your declaration on a second screen. We then send you a receipt on a durable medium recording what you declared and when we received it. The withdrawal page linked from the imprint publishes the full instruction and the model withdrawal form.

5. Your account and credentials

Credentials that you alone hold protect your account:

A personal PIN that unlocks the app on your device. Your device stretches the PIN with a per enrolment salt and keeps only a verification value derived from it.
An optional backup file that you save outside the app and that can restore your account on a new device.
A key pair generated on each of your devices. Only the public half reaches us.

You are responsible for keeping these safe. We cannot recover any of them for you. Restoring an account requires a proof derived from your own backup key. The server rejects every attempt without it. If you lose your PIN, your backup file and all of your devices, your encrypted data becomes permanently unreadable. Keep a backup file in a separate safe place.

Your account also carries the email address you register with. We send one time codes to it during registration and in some recovery flows. Losing access to that mailbox does not by itself make your encrypted data unreadable, but it blocks the flows that depend on a code.

One device holds the primary role. You may link up to five further devices to your account.

We hold some of your key material in wrapped form so that a new device can join your account: your wrapped root key and its salt, your wrapped sharing key, a wrapped one time prekey escrow blob, and your public prekeys. If you register a server side backup, we also hold the encrypted backup blob and the salt used to derive its key. No one can open this material without a secret that stays on your device.

6. What we cannot see and what we do see

The Service is built so that we hold ciphertext and not content. That is a design choice with concrete consequences.

What we cannot see

The contents of your files, their names, and the information you record about them in your vault. Your device encrypts all of it before upload with keys derived from secrets we never hold.
Anything that would let us recover your data after you lose your credentials. There is no server side recovery path.
Any modification of your stored content without your device detecting it. Every stored item is an authenticated encryption envelope. A modified item fails its integrity check on your device and is refused.
Decrypted content in answer to any request, lawful or otherwise. We can hand over only what we hold: ciphertext and the operational records listed below.

After you grant a specific consent, two features in our code can hand the server a key that lets it read a limited set of document types and expiry dates. Neither feature is active in current releases. We will update these Terms and the Privacy Policy before we switch on either one.

What we do see

Your email address.
Your device public keys and the device identifier derived from them.
The existence of each encrypted item and a bucketed size for it. Our object storage processor, Contabo GmbH in the European Union, receives the upload and therefore sees the exact object size.
Request records written by our web server and application: time, IP address, method, path and user agent.
Which accounts share with which accounts, and which items a share or a guest link covers. These records point at accounts, and every account carries an email address. So they are not anonymous to us.
Every access to a share or a guest link, with the time, the accessor IP address, the user agent and the result. We keep this access log for 90 days.
The onboarding profile you fill in, if you fill it in: citizenships, country and city of residence, preferred language, timezone and date of birth. We store this in plain form.
Your storage usage, your quota and your tier, and a log of changes to that quota.
Security and trust records about your account and devices, and an append only log of the privacy permissions you set and of every decision taken under them.
If you use invitation codes: who invited whom, and the bonus history attached to that.
A push registration token per device, obtained from Google Firebase Cloud Messaging when you register and sent to Google on every push; the app asks for the notification permission after the token exists.
If you connect an AI assistant: the assistant activity log and the signed consent receipts, and never file contents or file names.
If you join the Community Map: your display name, your city and your photo, all stored in plain form, plus the moderation records described in section 9.
If you choose to send crash reports: crash events carrying your device model and model identifier, device architecture, operating system name and version, app version and build, error type and stack trace (including your other threads at that moment), technical identifiers for our code libraries used only to decode the stack trace, an error reference code and other short technical labels for where it happened, report bookkeeping (a random report id, severity level, platform, SDK name and version, release, environment) and the time it happened — never breadcrumbs, an activity trail, or an identifier for you or your device — sent to monitoring we host ourselves.

The Privacy Policy lists every category with its purpose, its legal basis, its retention and its recipients. Section 6 of these Terms is a summary, not a substitute.

7. Test release, conformity and updates

The Service is supplied as an early test release. This has consequences that you should understand before you rely on it:

Features may be added, changed or removed, subject to section 13.
Data formats, including encryption and backup formats, may change between versions. Some changes may require you to re import or recreate content.
Defects may make data unreadable, corrupt or lost.
The Service may be unavailable, including for long periods.

Keep independent backups of anything you cannot afford to lose. The Service does not replace your own backup strategy during the test phase.

These statements are information about the state of the Service. They are not an exclusion or a limitation of our liability. Section 15 governs liability.

Conformity. We owe you a Service that meets the objective requirements of German law (§ 327e(3) BGB). That includes the quality, functionality, continuity and security usual for digital products of the same kind. Calling the Service a test release does not lower that standard by itself.

Separate agreement on a deviation. Where a specific characteristic of the Service deviates from those objective requirements, that deviation binds you only if we told you about it specifically before you made your contractual declaration. You must also have agreed to it expressly and separately (§ 327h BGB). The entry screen therefore presents the test release notice as its own step with its own acknowledgement, and records that acknowledgement separately from your acceptance of these Terms. A general statement in these Terms is not such an agreement.

Updates. We will supply the updates needed to keep the Service in conformity for as long as we supply the Service. We will also inform you about them (§ 327f(1) BGB). The app can require you to install an update before it continues to work with the server. No agreement between us can remove this duty.

What a deviation can never touch. A deviation can concern only the objective requirements. It can never contradict what we have promised you about the Service, for example in the store listing or in the app.

8. Acceptable use and content rules

You agree not to use the Service to:

Store, share or distribute content that breaks the law, including material depicting child sexual abuse, material inciting violence or terrorism, and material that infringes the rights of others.
Attack, probe or attempt to circumvent the security of the Service, its infrastructure or another user's account.
Share your credentials with another person, or create accounts programmatically.
Send unsolicited messages, abuse the invitation system, or abuse the sharing features.
Place an unreasonable load on our infrastructure or disrupt the Service for others.

Beyond what the law requires, the following rules apply to everything you publish on the Community Map, the only surface where other users see content you provide:

Your photo must show you, must not show another identifiable person without their agreement, and must not contain sexual, violent or hateful material.
Your display name must not impersonate another person, must not advertise, and must not contain unlawful, sexual or hateful wording.
You must not use a report to harass another member.

We are entitled to set these standards in our Terms even where they go beyond the statutory minimum. We apply and enforce them in a diligent, objective and proportionate manner, with regard to the rights of everyone involved, including your freedom of expression [Art. 14(4) DSA].

9. Content moderation, reports and complaints

What we can restrict and with which tools

We can act on the parts of the Service that we can see: a Community Map profile, a display name, a photo, an account, a share, and a guest link. We cannot inspect the content of your vault, because we hold only ciphertext. So we cannot remove a single file from it. Where a notice concerns encrypted content, our available measures are to revoke the share, to delete the guest link, or to suspend or terminate the account [Art. 6(1)(b), Art. 14(1) DSA].

A person reviews every photo submitted to the Community Map before it becomes visible. We do not remove, hide or reject anything automatically. We use no automated decision making to restrict content. We do not scan, index or search vault content. No law obliges us to monitor what our users store, and we do not (Art. 8 DSA).

We do not gain knowledge of illegal content merely because we know, in general, that a storage service can be misused.

How to report content

Anyone can report content on the Service, whether or not they have an account. The report page linked from the imprint explains how to send a notice to privacy@relocat.org by email. A report is most useful when it contains all four of the following [Art. 16(2) DSA]:

An explanation of why you consider the content unlawful.
The exact electronic location of the content, for example the guest link or the profile.
Your name and email address, except where the report concerns an offence involving child sexual abuse.
A statement that you believe in good faith that the information in the report is accurate and complete.

If your report carries your electronic contact details, we confirm receipt without undue delay [Art. 16(4) DSA]. We then decide, and we tell you what we decided.

A report gives us knowledge of illegality only where it lets us identify the illegality without a detailed legal examination. A report that points at an encrypted blob we cannot read will usually not do that. A report about a guest link whose content the reporter has seen and evidenced can.

Terrorist content

We do not allow terrorist content on any surface of the Service that we can see. Where we become aware of terrorist content on the Community Map, we remove it. We maintain a contact point for the electronic receipt of removal orders for terrorist content, published in the imprint. We act on such an order within one hour of receiving it [Art. 3(3), Art. 7(1), Art. 15(1) Regulation (EU) 2021/784]. In Germany the Bundeskriminalamt issues those orders.

Reports to authorities

Where we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we promptly inform law enforcement or judicial authorities. We also provide the relevant information available to us [Art. 18(1) DSA]. In Germany, the Bundeskriminalamt receives such information as the central body and passes it to the competent prosecuting authority (§ 13 DDG).

If we find suspected child sexual abuse material on a surface we can see, we remove it. We keep a copy only so far as it is needed to make the report and to hand it to the authority. Holding such material is otherwise itself an offence. When the case closes we delete the material. We keep a record of the case, with the link to the account removed, so that we can answer questions about the decision. That record is still personal data, because it could be connected to a person again with other information. We keep it for three years after the case closes. Where a criminal complaint was filed, we may keep it for as long as the law allows a claim to be brought, at most ten years. Those periods follow the German limitation periods for civil claims and for the offence concerned.

The statement of reasons you get

If we restrict the visibility of something you provided, or suspend or terminate your account, because the content is illegal or breaks these Terms, we send you a clear and specific statement of reasons. We send it at the latest when the restriction takes effect [Art. 17(1), 17(2) DSA]. This applies to a Community Map photo that we reject in review before anyone else has seen it.

The statement of reasons tells you [Art. 17(3) DSA]:

What the measure is, where it applies and how long it lasts.
The facts and circumstances we relied on, and whether we acted on a notice or on our own initiative.
Whether automated means were used in reaching the decision.
Where we rely on the law, which law the content breaks and why.
Where we rely on these Terms, which rule the content breaks and why.
How you can challenge the decision.

How to complain

Write to privacy@relocat.org. Tell us the decision you mean and why you think it is wrong. A person reads every complaint, and we reply with a decision. So far as we qualify as a micro enterprise, the Digital Services Act does not require us to run a certified internal complaint handling system or to use an out of court dispute settlement body [Art. 19(1) DSA]. We do not run one. This does not reduce what section 9 promises you.

You can also complain about us to the Digital Services Coordinator at the Bundesnetzagentur in Bonn, the competent authority in Germany [§§ 12, 14 DDG]. The Digital Services Coordinator remains your point of contact for the whole of that complaint procedure, even if it passes the file to another authority (§ 20(1) DDG). You may go to court at any time.

10. Optional features

None of the features in this section is needed to use the vault. The AI assistant and community signals stay off until you turn them on yourself, in Settings → Privacy. Crash reports are not sent unless you choose to send them: in Settings → Privacy you pick one of three options — send automatically, ask each time, or don't send. Earlier versions started all three switched on by default, so check Settings → Privacy if you installed one of those.

Community Map

The Community Map shows other members a display name, a city and a photo that you choose. We store this information in plain form and do not encrypt it. A person reviews every photo before it becomes visible. Section 9 explains reports, decisions and complaints. You may leave the map at any time.

Professional advisors and the partner program

You can share a limited view of your progress with a professional advisor. Where a professional invites you or recommends the Service to you, that professional acts commercially, not neutrally.

Commission. Where the Service earns revenue and a professional advises a client they met through it, we may pay that professional a commission out of our own revenue. You never pay it. We add nothing to any amount you owe. In the current test release we pay no commission of any kind. No payment or revenue recording is active in the Service.

Placement. Where a professional undertakes to place you in a job, German law requires that agreement to be in writing and to state what the placement costs (§ 296(1) SGB III). We do not conclude such an agreement for you inside the Service. We never charge you a fee for a placement. Where a placement crosses a border and the law requires it, you must be given written information about the position before the placement, in a language you understand (§ 299 SGB III).

Records. Where a professional or we act as a placement agent, German law requires that agent to keep the related business records for three years after the placement activity ends and to erase the personal data in them when that period expires (§ 298(2) SGB III). The Privacy Policy states how long each partner program record is kept.

You can withdraw your sharing consent at any time, and withdrawing is as easy as giving it.

AI assistant

You may connect an AI assistant of your choice. The app limits reading to the scope you grant. Any action that changes data, or discloses anything beyond that scope, needs your explicit approval in the app. The assistant never receives file contents, file names or the contents of a safe. Each approval produces a receipt signed with our key. The app shows you the signature and the key identifier so that you can check the receipt yourself against our published key.

We keep the assistant activity log and the receipts for thirteen months. You can revoke an assistant at any time. Revoking deletes its tokens and its grant and stops all further access. The AI provider you connect acts on your instruction and under your agreement with that provider. The Service works fully without one.

Crash reports

The app can send crash reports to monitoring that we host ourselves. A report carries your device model and a model identifier for it, and the device's hardware architecture; the operating system name and version; the app version and build; the error type and the stack trace, including the stack traces of the app's other threads at the moment it happened; technical identifiers for the app's code libraries, used only to decode the stack trace, with any file name in them reduced to its base name; a short technical label for where it happened — an error reference code, the startup step reached, and, if the app had frozen, which operation stalled, for how long, and whether it recovered; report bookkeeping (a random report id, a severity level, the platform, the SDK name and version, the release and build, and the environment it ran in); and the time it happened. It carries no identifier for you or your device, no locale or timezone, no breadcrumbs or activity trail, and no file names, paths or content. In Settings then Privacy you choose one of three options: send automatically, ask each time, or don't send. Nothing is sent unless you choose to send automatically. Versions before 1.0.26 started crash reporting on by default; if you installed one of those, check Settings then Privacy.

Exercising your data protection rights

Turning off any of these features, or withdrawing a consent, does not affect the validity of this contract. We may terminate without notice only where continuing the contract has become unreasonable for us. We can never claim compensation from you for exercising a data protection right (§ 327q BGB).

11. Your content and the licence you give us

You own what you upload or create in the Service. Encryption does not transfer ownership; it protects confidentiality.

You grant us a non exclusive, worldwide, royalty free licence to store and transmit your encrypted items, but only so far as technically necessary to operate the Service for you. This licence exists because moving your data between your device and a server is impossible without it. It does not let us read, analyse or use your content for anything else. No such capability exists on our side. It ends when you delete the content or your account, because deletion removes the stored material the licence covers.

You confirm that you are entitled to upload what you store, and that doing so breaks no law and infringes no third party right. You remain responsible for your content.

12. Our software and trademarks

The app. The Relocat app is free software. We license its source code to everyone under the GNU General Public License version 3 or later, together with additional permissions under section 7 of that licence that allow distribution through app stores and combination with the platform SDKs the app needs. You may study, modify, share and build it under that licence. Every source file carries the licence notice. Our Source code page, linked from every page of our website and from the imprint at https://relocat.org/imprint/, says where the code is published and, until the public repository exists, how to request it.

The server. The server software that runs the Service is ours. We do not publish its source code, and we grant no licence to it. These Terms give you the right to use the Service, not any right in the software behind it. You do not need the server's code to check what the Service can see: your device encrypts your content before upload, and that happens in the app's code, which you can read.

What earlier versions promised. Up to and including version 7 of these Terms, we said that the source code of the server we run was available on request. That promise ends when this version of the Terms takes effect. A request we received before that date is honoured for the revision that was running when it reached us, under the terms version 7 named. From that date the server's source code is not available on request, and no licence to it is offered.

Trademarks. "Relocat" is a registered trademark of Ruslan Zykun. The word mark is registered with the European Union Intellectual Property Office for the European Union and, through the Madrid system, designated for the United States of America. The Relocat icon is our mark too; it is not registered. The licence of the app does not license these marks. You may not use them to identify a service you operate, unless we have given you written permission or the use is nominative, for example "works with Relocat". The trademark policy that comes with the app's source code says what you may do without asking.

13. Availability, changes to the Service and discontinuation

We provide the Service on a best effort basis. We give no uptime, performance or availability guarantee, and none exists anywhere in our systems. We may carry out maintenance, investigate abuse or respond to security incidents in ways that interrupt the Service. We will give reasonable notice where we can. We may also restrict the Service temporarily to comply with the law or to protect users, our infrastructure or third parties.

Reasons for which we may change the Service. We may change the Service for one of the following reasons, and for no other (§ 327r(1) BGB):

To keep it in conformity with the contract, including security fixes and updates.
To adapt it to a change in the law, in case law, or to a binding decision of a court or an authority.
To adapt it to a technical change in a platform, a provider or a component that the Service depends on.
To add an optional feature, to change one, or to withdraw one.
To counter abuse or a security threat.

A change never costs you anything extra. We inform you about the change clearly and comprehensibly before it takes effect.

Impairing changes. Where a change impairs your access to the Service, or its usability for you, we inform you in advance of what will change, when, and what your rights are. You may then terminate this contract free of charge within 30 days of the notice or of the change, whichever is later (§ 327r(2), (3) BGB).

Discontinuation. We may discontinue the Service in whole or in part. We will give registered users at least 30 days notice by email and in the app before we do. During that period you can export your vault as an encrypted backup file, the export the app provides. That file is readable only with your own recovery key. It is the only export format the Service produces today.

14. Conformity and your rights when the Service is defective

We owe you a Service that conforms to this contract. Conformity is measured by what we agreed with you and by the objective requirements of German law, including the continuity and security usual for digital products of the same kind. It is also measured by the update duty in section 7 (§§ 327e, 327f BGB).

If the Service is not in conformity, you have the statutory rights of a consumer for digital products (§§ 327i and following BGB). These include a right to demand that we restore conformity and, where that fails, a right to terminate and a right to damages. Nothing in these Terms limits or excludes those rights. No statement about the test status of the Service does so either.

Where mandatory consumer protection law in your country of residence gives you a stronger warranty right, that right applies.

15. Liability

We are liable without limitation:

For injury to life, body or health.
For intent and for gross negligence.
Where we have given an express guarantee.
Under the German Product Liability Act, and under the national law transposing the EU product liability rules. A contract can never limit or exclude these claims. Nothing in these Terms purports to limit them.
Where the GDPR or German data protection law requires liability.

For a slightly negligent breach of an essential contractual duty, we are liable to the extent of the damage that was foreseeable and typical for this kind of contract, so far as the law permits a limitation at all. An essential contractual duty is one whose performance makes the contract possible at all and on whose performance you may rely.

We are not liable for slight negligence in any other case.

There is no fixed money cap on our liability in these Terms.

If you lose your PIN, your backup file and all of your devices, your data becomes unreadable. That is a consequence of the encryption design described in section 6 and not a breach of duty by us. This paragraph does not limit our liability under the rules above where a loss is in fact caused by our breach.

Nothing in this section limits any liability that mandatory law does not allow us to limit or exclude.

16. Suspension and termination

By you. You may terminate this contract at any time, without notice and without giving a reason, by deleting your account in the app. Deletion from a primary device runs immediately: we delete your rows and start the deletion of your stored objects at once. From a device that is waiting for a restore, we schedule deletion with a grace period during which you can cancel it. The delete account page describes both paths.

By us, for breach. We may terminate this contract for cause. Where the cause is a breach of a duty by you under these Terms, we set you a period to put it right, or we warn you. We may terminate only if that step has not worked (§ 314(2) BGB). We may act without a warning only where the law allows it because of special circumstances, for example the sharing of material depicting child sexual abuse.

What we commit to whenever we restrict your account. These four commitments are contractual duties, not internal practice:

We tell you when we remove or hide something you provided, at the latest afterwards.
We tell you before we suspend your account, unless the law or an immediate risk to others prevents it.
We give you the reason, in the form of the statement of reasons described in section 9.
We give you an opportunity to respond, and we then decide again.

Suspension. A suspension blocks your access. It deletes nothing: your encrypted data stays where it is, and no timer removes it. We lift a suspension or we terminate the account, and we tell you which. You can appeal to privacy@relocat.org.

After termination. We delete your account data as described in the Privacy Policy and on the delete account page. Some records survive: accounting rows about revenue, commission, payouts and bonuses, which we keep with the reference to you removed; the case records described in section 9; and records that the law requires us to keep. We do not keep your encrypted content after deletion.

17. Changes to these Terms

We may change these Terms for one of the following reasons, and for no other:

A change in the law, in case law, or a binding decision of a court or an authority.
A change to the Service made for one of the reasons listed in section 13.
The addition or withdrawal of a feature, or a change to how a feature works.
Correcting an error or closing a gap in these Terms, where the correction does not shift the balance of the contract to your disadvantage.
A change of a provider or processor that we name in these Terms or in the Privacy Policy.

We will tell you about a change at least 30 days before it takes effect. We will tell you in the app and by email to the address on your account. The notice will name what changes and when it takes effect (Art. 14(2) DSA).

Your silence is never acceptance. Continuing to use the Service after a change does not accept it. A change binds you only when you accept it expressly. The app asks you to accept the new version and records your acceptance.

If you do not accept, you may terminate the contract at any time, free of charge, by deleting your account. Where a change also impairs the Service, section 13 gives you the separate 30 day termination right under § 327r(3) BGB.

We come to you with a change. You never have to watch this page for one.

18. Export, portability and switching

The app produces one export: an encrypted backup file that only your own recovery key can open. There is no plaintext or machine readable export of your account data from the Service today. Your data protection right of access and portability is separate. The Privacy Policy explains how to use it.

We make no charge for exporting, for switching to another provider, or for terminating this contract. We will not introduce one.

Where the EU Data Act applies to the Service, we will give you the information that Chapter VI of that Regulation requires. This includes how switching and porting work, the formats we export, the technical limits that apply, and a reference to an up to date register of those formats. We will publish that register and link it here.

Where that Chapter applies, we will not impose a notice period longer than two months for starting a switch, and we will complete the transition within 30 days. We will also keep your exportable data retrievable for at least 30 days after the transition before we erase it.

The Service is currently supplied as a test version. Chapter VI of the Data Act may not apply to a service supplied as a non production version for testing and evaluation for a limited time. We are telling you this before you contract with us, as Art. 31(3) of that Regulation requires of a provider that relies on this. We do not use it to withhold an export from you: the export described above is available to you throughout.

19. Dispute resolution

If something goes wrong, write to privacy@relocat.org first. We answer every message.

We do not take part in dispute resolution proceedings before a consumer arbitration board. We are not obliged to do so.

If you and we cannot settle a dispute about this contract, we will point you to a consumer arbitration board competent for it, with its address and website, as § 37 VSBG requires.

You may go to court at any time. Nothing in these Terms takes that away.

20. Governing law, jurisdiction and language

The law of Germany applies to this contract, without its conflict of law rules.

This choice does not deprive you of the protection of the provisions that cannot be derogated from by agreement under the law of the country where you have your habitual residence [Art. 6(2) Rome I]. If your national law gives you a stronger protection than German law on any point, that stronger protection applies to you. The choice of German law does not change it.

These Terms contain no clause on which court is competent. If you live in the European Union, we may bring proceedings against you only in the courts of the Member State where you are domiciled [Art. 18(2) Regulation (EU) 1215/2012]. Your own right to choose where to sue us follows from the same rules. We do not restrict it.

If any provision of these Terms is or becomes invalid, the rest stays in force. The statutory rules take the place of the invalid provision.

We publish these Terms in English, and the English text governs. If we publish a translation, we provide it for convenience, unless mandatory law in your country gives the translation precedence.

21. Contact

For anything about these Terms or about the Service, write to privacy@relocat.org.

For reports about content and for complaints about a moderation decision, write to privacy@relocat.org. The report page linked from the imprint explains what a notice must contain. A person answers this address; we do not answer it with automated tools alone [Art. 12(1) DSA].

The imprint at https://relocat.org/imprint/ publishes our identity, our postal address, our points of contact for authorities and for users under the Digital Services Act, our contact point for terrorist content removal orders and the competent supervisory authority.

22. Version and change log

Version 8 (October 2026): Sections 1 and 12 restate the licensing of our software. Sections 6 and 10 correct the crash-report description to what the app sends and to the three choices in Settings → Privacy (versions before 1.0.26 started crash reporting on). Nothing else changes. Version 7 said that Relocat as a whole, server included, was published under the GNU Affero General Public License version 3 or later, that the complete source of the server we run was available on request, and that a separate licence was offered to organisations that could not comply with that licence. No copy of the server's source was ever handed to anyone under that licence, and nobody asked for one. Version 8 says that the app, meaning the mobile application and the browser session interface, is free software under the GNU General Public License version 3 or later with additional permissions for app-store distribution and platform SDKs; that the server software is ours and is not published; and that the offer of the server's source on request ends when this version takes effect. A request we received while version 7 was in force is honoured for the revision that was running when the request reached us, under the terms version 7 named, the GNU Affero General Public License version 3 or later. The separate licence offer is withdrawn. Section 12 records the trademark registrations and points to the trademark policy that comes with the app's source code. The source code page moved from /agpl/ to /source/; the old address redirects.
Version 7 (September 2026): Complete rewrite for the open test. Section 2 states that registration is open and that an invitation code is optional, replacing the invitation-only description; it adds the 18+ self-declaration and what happens if a minor registers. New Section 3 gives the pre-contract information required for a contract in which you provide personal data instead of a price, and new Section 4 gives the withdrawal instruction, the model form reference and the in-app withdrawal function. Section 6 corrects the zero-knowledge description: every access to a share or a guest link is logged with the time, the IP address, the user agent and the result, sharing records point at accounts that carry email addresses, and the server holds wrapped key material and backup blobs. Section 6 also lists the processing the earlier versions did not mention, including push tokens sent to Google Firebase, the onboarding profile, storage accounting, the privacy permission log, invitation records and crash reports. New Section 9 describes content moderation, the reporting mechanism, the statement of reasons and the complaint routes under the Digital Services Act, and states the policy on terrorist content. Section 10 discloses the partner program and the commission model. Section 15 removes the fixed money cap on liability and the indemnity clause, and carves out product liability claims. Section 17 removes the clause that treated further use of the Service as acceptance of a changed text, lists the reasons for which the Terms may change, and sets the notice period to 30 days with an express acceptance step. New Section 18 covers export, portability and switching. Section 19 states that we do not take part in consumer arbitration and that we will name a competent arbitration board if a specific dispute cannot be settled. Section 20 fixes German law with the consumer protection rider and contains no forum clause. The document status banner and the promise of a counsel-reviewed version before public release are removed.
Version 6 (September 2026): Section 4 lists the optional Community Map profile — display name, city and photo, stored in plain form and, for photos, reviewed by our staff — among the data we can see; Section 17 says that while vault content cannot be inspected, Community Map profiles and photos can be reviewed, hidden or removed.
Version 5 (July 2026): Corrected Section 3 — the registration email address is required, not an optional recovery credential, and losing mailbox access does not by itself cause data loss; the Section 12 credential-loss carve-out aligned accordingly; log-retention wording in Section 4 aligned with the Privacy Policy (removed an inaccurate IP-truncation claim).
Version 4 (July 2026): Added Section 7 (optional AI and sharing features); governing-law clause reworded pending incorporation (the previous text named an invalid "European Union" governing law); source-code availability now described on the /agpl/ page; beta-acknowledgement wording aligned with the actual onboarding flow; acceptable-use clause rests on "applicable law".
Version 3 (April 2026): German-law audit fixes.
Version 2 (April 2026): First full draft.