Website privacy

1. Who is responsible

In this notice, “we” means the operator named above. You can contact us directly using these details with any privacy questions.

2. Visiting the website and hosting

The website and beta database run on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in Nuremberg. To deliver the website, the infrastructure processes in particular your IP address, the requested address and technical connection data. This is necessary to send the page to your browser and protect the service. The legal basis is Article 6(1)(f) GDPR; our interest is secure and reliable operation.

The connection to the published website is encrypted using HTTPS. Fonts, images and the interactive character are loaded from our server. The character is a local browser preview and receives no data from your Codex app.

The front-end web server does not keep a log of individual page requests. Technical errors may appear in operational logs; these logs are not visitor statistics. Web server and database logs are each limited to three files of ten megabytes and are replaced by newer entries when this limit is reached. Their retention period therefore depends on the volume of logs. The website does not include email addresses or link secrets in application messages. In individual cases, database errors may contain details from the processing concerned.

Simple page counts

We count server-side how often a public page is requested. We store only the calendar day, the fixed page path and an aggregate count. No individual visit records are created. IP addresses, browser characteristics, referring pages and URL parameters are not included in the statistics. We use no cookies or other identifiers for this and read no additional information from your device.

The counts do not identify individual visitors. Repeat requests and automated access may be included; content served from your local browser cache may not generate a new request. The statistics are not linked to email addresses or beta signups. We may retain anonymous totals for longer-term comparisons.

The German and English versions of a page are counted together; language is not stored as an additional statistic.

We also count confirmed beta signups per calendar day. This total likewise contains no email addresses or other participant identifiers.

Protection against abuse

To limit bulk signups and login attempts in the admin area, we process short-lived verification keys. These are derived using a secret key from the email address and, where server-side IP detection is enabled, the IP address. We do not store the plain IP address in our database for this purpose. IP-based limits apply for up to one hour, and the email-based limit for 24 hours. Expired verification keys are deleted regularly. This data is used solely to protect the service, not to measure reach. The legal basis is Article 6(1)(f) GDPR.

3. Your closed beta signup

When you sign up, we store your email address, signup and confirmation times, signup status, your communication language, and the exact wording, version and language of your consent. We also store technical hashes for confirmation and unsubscribe links. We do not need your name or a user account.

We use this information to confirm your address, invite you to the closed blinu beta and inform you about your participation. The legal basis is your consent under Article 6(1)(a) GDPR. Providing this information is voluntary; without your email address and confirmation, we cannot add you to the waitlist. You can still visit the website.

Your entry is activated only after you open the link in our email and explicitly confirm your signup on the confirmation page. Signing up does not entitle you to an immediate invitation. We do not use your signup for general advertising outside the beta.

Unconfirmed signups expire after 48 hours. Confirmed entries expire no later than twelve months after confirmation; if the waitlist’s purpose ends sooner, we delete them earlier. You can withdraw your consent at any time using the unsubscribe link in the confirmation email or by contacting support@blinu.app . Unsubscribing deletes your entry from the active database. Withdrawal does not affect the lawfulness of processing carried out before it.

Expired entries are no longer offered for invitations and are cleaned up every 15 minutes during normal operation. Daily database backups are used solely for recovery. Retention is limited to seven days and a maximum of seven backups; older copies are removed during backup runs. After an operational disruption, cleanup resumes once service is restored. If a backup is restored, any deletions made in the meantime must be reapplied. Retention by the email provider is described in the next section.

4. Email delivery and other recipients

Confirmation emails through Resend

We use Resend, a service provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, to send emails. Resend receives the recipient address, sender, subject, message content including links, and technical delivery information. We do not use open or click tracking. Processing serves the signup process you requested, as described above.

A European sending region does not mean all data is stored exclusively in the EU. Resend also processes data in the USA. Its data processing agreement provides in particular for EU Standard Contractual Clauses for relevant transfers to third countries. You can also ask us for information about these safeguards. Details of subprocessors and Resend’s privacy notice are available from the provider.

On our Pro plan, Resend retains regular email data and related delivery logs for 30 days, according to its retention description ; backups are retained for seven days. Following termination of our Resend account, the agreement provides for deletion of remaining customer data within 90 days. Resend processes certain account, usage and security data as an independent controller; the purposes and retention criteria in its privacy policy apply to this data. Withdrawing consent with us therefore does not automatically remove messages already delivered to a recipient’s inbox or all data lawfully retained by the email provider.

Contact and support

When you write to us, we process your contact details, your message and any files you voluntarily include to handle your request. Please send only the diagnostic or project data needed for that purpose. For contractual or pre-contractual matters, Article 6(1)(b) GDPR applies; otherwise, Article 6(1)(f) GDPR applies based on our interest in responding to enquiries.

Our support mailbox uses Google Workspace; the provider in the European Economic Area is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Affiliated companies and service providers may process data outside the EEA. Google describes contractual safeguards, including Standard Contractual Clauses, in its Cloud Data Processing Addendum.

We use Spark by Spark Mail Limited, 26–27 Fitzwilliam Place, Dublin 2, D02T292, Ireland, to read and reply to messages. This involves processing message, contact and technical account data. For blinu support, we do not use Spark’s AI features, team sharing or shared email links. Spark describes server-side caching of recent emails for four hours and backup retention typically lasting one week. Other message copies remain in the mailbox and on our devices; our deletion rule below applies to them. Spark also processes data in the USA and identifies adequacy decisions or Standard Contractual Clauses as safeguards. Details and contact information are available in the Spark privacy policy; you can also ask us about the safeguards.

Support enquiries are deleted once they have been fully resolved and no further retention is necessary. Where statutory retention duties or the necessary protection of legal claims require otherwise, the data concerned remains stored with its use restricted to that purpose and is deleted once the reason no longer applies.

Only authorised people have access to the beta list. Hosting and email providers are used to fulfil the purposes described. Any further disclosure requires a legal basis, for example compliance with a legal obligation. We do not sell your data.

5. Language preferences and admin cookies

On your first visit, we use your browser’s language preference. A link with a language prefix displays the language specified in that link. Only when you manually choose Deutsch or English do we store the functional cookie blinu_language for six months, with the value de or en. It contains no individual identifier. Choosing “Automatic” deletes it. The cookie stores the language preference you explicitly requested; the legal basis is section 25(2)(2) TDDDG. To the extent personal data is processed, Article 6(1)(f) GDPR applies based on our interest in providing your chosen language. Language preferences and browser language are not included in reach measurement.

We do not use analytics or advertising cookies for public visits or beta signups. After login to the protected admin area, the technically necessary session cookie blinu_admin is set. It expires after no more than eight hours and is removed at logout. A server-side hash allows us to verify and end the session early; expired entries are deleted regularly. Its purpose is to protect prospective participants’ data against unauthorised access. The legal bases are section 25(2)(2) TDDDG and Article 6(1)(f) GDPR.

6. Your rights

Subject to the statutory conditions, you have rights of access to your personal data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You can withdraw consent at any time with effect for the future.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will stop processing unless overriding compelling legitimate grounds or the establishment, exercise or defence of legal claims require otherwise. You may object to direct marketing at any time without giving specific reasons.

To exercise these rights, contact support@blinu.app. You can also lodge a complaint with a data protection supervisory authority, particularly in the place where you live or work or where the suspected infringement occurred. The supervisory authority responsible for our location is the Hessian Commissioner for Data Protection and Freedom of Information .

We do not make decisions about website visitors or prospective beta participants based solely on automated processing that produce legal or similarly significant effects, and we do not create personal usage profiles.

7. Privacy in the apps

Local Codex processing, Wi-Fi connectivity, QR pairing, device settings and timers in the native apps are described in the privacy notice for blinu and blinu link . The beta waitlist is separate from those functions.