LEGAL

Privacy Policy

Last updated: June 2026

1. Overview

Rohrpost is open-source software that you can run entirely on your own infrastructure ("self-hosted"). This policy covers both the self-hosted software and the managed cloud service available at app.rohrpost.io ("the service").

Short version: Self-hosted Rohrpost collects no data — everything stays on your machines. The managed service collects only what is necessary to operate your account.

2. Self-hosted deployments

When you run Rohrpost on your own infrastructure, Rohrpost GmbH (the project maintainer) collects no information whatsoever. There is no telemetry, no crash reporting, no call-home behavior, and no license server. All computation — including embedding generation via Ollama — happens locally. You are the sole data controller for any information stored in your Rohrpost instance.

3. Managed cloud service (app.rohrpost.io)

3.1 Information we collect

When you create an account on app.rohrpost.io, we collect:

  • Email address — for authentication and service communication
  • Password (bcrypt-hashed, never stored in plain text)
  • Tenant name and API keys you create
  • Usage metadata (request counts, storage usage) — for billing and capacity planning

We also collect the capsule content you ingest through the service — this is the core data the service stores and retrieves on your behalf. We do not use your capsule content for training machine learning models or for any purpose other than operating the service.

3.2 Information we do not collect

  • We do not track your behavior across other websites.
  • We do not sell your data to third parties.
  • We do not use your content for advertising.
  • We do not use third-party analytics on the application pages.

3.3 Infrastructure subprocessors

The managed service runs on cloud infrastructure (VMs, managed databases). Your data is stored within the EU. We will maintain an up-to-date list of subprocessors on request.

4. Cookies and local storage

The admin web UI uses a single server-side session cookie for authentication. No third-party tracking cookies are set. This website (rohrpost.io) uses no cookies.

5. Data retention

Managed service: your account data and capsules are retained as long as your account is active. Deleted capsules and tenant data are purged within 30 days. You may export your entire knowledge base at any time using the rohrpost_okf_export tool.

6. Your rights

If you are in the EU, you have the right to access, correct, or delete your personal data, and to object to or restrict processing. Contact us at the address in Section 8 to exercise these rights. We will respond within 30 days.

7. Security

We use TLS for all connections, bcrypt for password storage, and short-lived session tokens with server-side invalidation. We conduct periodic security reviews of the codebase. If you discover a security vulnerability, please contact us privately (see thecontact page).

8. Contact

For privacy-related questions or to exercise your data rights, open a confidential issue on Codebergor use the contact form in your managed account dashboard.

9. Changes to this policy

We will notify managed service users of material changes to this policy via email at least 14 days before they take effect. Self-hosted users can track changes to this file in the repository.