Privacy policy of Shale

Entwurf / Draft — not legally reviewed. This text is a first draft and has not been legally reviewed. It applies only once the operator has had it checked and published it. The operator fills in the parts in square brackets.

As of: [date]. The German version says the same; where they differ, the German version governs.

1. Who is responsible

Responsible for processing your data in Shale is [operator name], [address], reachable at [privacy e-mail address]. [Data protection officer, if appointed: name and contact.]

2. In short

• Shale runs on its own servers at Hetzner in [location, e.g. Germany]. There are no ads, no tracking and no advertising id.
• We process what Shale needs to work: your account, your content and what you show to others.
• The app sends anonymous usage statistics and crash reports to our own server. You can switch this off in Settings under "Nutzungsstatistik" (usage statistics, section 3.7).

3. What data we process

3.1 Account and sign-in

• E-mail address: to sign in. We send you a code by e-mail through [name of the e-mail delivery service]. The same address gets our decision and its reasons when we remove your content or suspend your organisation (section 3.4).
• Username, display name, profile picture and profile cards: visible to people you share an organisation or a conversation with.
• Signing in with Google or Apple: only if you choose it; section 3.13 says which data Shale receives and stores.
• Passkeys and security keys: we store only the public key, never your device's secret.
• Sessions and devices: which devices are signed in, so you can see and sign them out under Security → "Sessions and devices".
• Security log: sign-ins, confirmations and changes to security settings, 365 days.

Legal basis: contract (Art. 6(1)(b) GDPR); for the security log also our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

3.2 Your content

What you create and write in modules: chat messages and attachments, direct messages, polls and answers, dates and replies, status and link pages, workflows, web pages and settings. Each space (personal, creator, organisation) decides who sees its content. Legal basis: contract (Art. 6(1)(b) GDPR).

How long: chat messages 365 days by default (a module's provider can set 1 to 365 days); dates until 90 days after they end; workflow logs 30 days; most other content until you or the space delete it. The operator keeps the full list per module: [link or annex with the retention list].

3.3 Public content

What a space makes public (public modules and their web pages, collections, creator cards, public polls) anyone can see, without an account and through search engines. Answering a poll in a browser without an account: section 3.11.

3.4 Reports and moderation

When you report something, we store the report, the reason and a copy of the reported content as you saw it. We delete the copy 30 days after the decision and the report 365 days after the decision. Whoever is reported never learns who reported. When we remove content or suspend an organisation, we e-mail the decision, the rule applied and our reasons to whoever is affected (the author of a removed chat message, the person whose profile it is, otherwise the managers of the space), at their sign-in address; Shale's moderators get an e-mail without any content when a report waits for them. Legal basis: legal obligations to handle notices (Art. 6(1)(c) GDPR with the Digital Services Act) and our legitimate interest in a safe service (Art. 6(1)(f) GDPR).

3.5 Notifications and push

On Android we deliver push notifications through Google's Firebase Cloud Messaging, once you turn push on in Settings → Notifications → Push (it is off until then). Before that the app does not contact Firebase. From then on Google receives a Firebase installation id, a device token (push token) and each notification. With "Show content in notifications" on (the default), it carries a title and text; a chat message never sends its text, only "New message in …". Google may process data in the USA: [transfer basis, e.g. EU-US Data Privacy Framework or standard contractual clauses]. There are no push notifications on iOS yet. Legal basis: contract (Art. 6(1)(b) GDPR).

3.6 Services you connect yourself

When you connect Shale to another service (for example notifications to Discord or Telegram, a calendar import, a webhook, a feed source or a connected system), Shale sends or fetches exactly the data you set up for it. Those services' own privacy terms apply to them.

3.7 Usage statistics and crash reports

The app sends anonymous usage statistics to Shale's own server unless you switch them off in Settings under "Nutzungsstatistik": which screens are open and for how long, a few steps such as adding a module, and crash reports, under a random number made on your device that is not linked to your account. They never contain what you write or which spaces, modules or people you use. Raw data is deleted after 90 days, daily totals after two years. When you switch them off, the app deletes what is still waiting and the random number. Legal basis: our legitimate interest in improving the app and fixing errors (Art. 6(1)(f) GDPR). [Check under § 25 TDDDG by the lawyer: whether the random number on the device needs consent.]

3.8 Server logs and protection against abuse

Our server limits how often one address may ask in a short time. For this it keeps your IP address with a counter of your requests, at most for one day (most limits one hour), and then deletes it. When the operator runs several servers, these counters are kept in Shale's database instead of memory, for the same time. The server's log names only the path of a request, never your address. The web server in front of it stores requests with the IP address for [period, set by the operator]. Legal basis: legitimate interest in a secure service (Art. 6(1)(f) GDPR).

3.9 On your device

The app keeps your settings, a cache of your modules and your chats (encrypted) on your device so it works without a connection. The features you use need this. When you sign out, the app deletes your account's data on the device.

3.10 Chatting as a guest without an account

A space can share a guest link to one of its chats. Whoever opens it in a browser chats without an account. We store the name you type, your messages and the conversation like any chat message (section 3.2): the space's team sees them. Your browser keeps two cookies: shale_guest, which keeps you signed in to this one conversation for 7 days, and shale_guest_csrf, which protects the form against other websites (one day). Both are needed for the chat to work. The guest session ends after 7 days or earlier when the conversation ends or the link is revoked; your messages follow the chat's retention. Legal basis: contract (Art. 6(1)(b) GDPR) and, for the space's team, their legitimate interest in answering you (Art. 6(1)(f) GDPR).

3.11 Answering a poll without an account

A space can open a poll (form) to answers in the browser: on its public web page or through a share link that anyone may answer. We store your answers, including any text you type, and show them to the space's team that made the poll. Your browser keeps one cookie, shale_answer, with a random number for one year, so that a poll taking one answer per person counts one per browser; the server stores only a value derived from it, never your name or account. The answers are kept as long as the poll exists and are deleted with it. Legal basis: the space's legitimate interest in running its poll (Art. 6(1)(f) GDPR); [lawyer: whether the space is controller for the answers and Shale its processor].

3.12 Camera and QR scanner

The app uses the camera only to scan QR codes (a friend link, a module link). The QR scanner processes the camera image on your device; no image leaves it. On Android the scanner uses Google's ML Kit library, which may send diagnostic data to Google (how the scanner is used and how it performs, with information about the device and the app, but no camera images). Legal basis: our legitimate interest in a working scanner (Art. 6(1)(f) GDPR) [lawyer: legal basis and whether Google acts as processor here].

3.13 Signing in with Google or Apple

Only when you choose "Sign in with Google" or "Sign in with Apple", or link Google or Apple to your account under Security.

• What Shale receives: Google or Apple give the app a signed sign-in token (ID token), which our server checks against the provider's published keys. From it Shale reads: your account's id at the provider (sub), your e-mail address, whether the provider verified it, and your name. From Google also whether the address belongs to a Google Workspace account; from Apple whether it is a private relay address (@privaterelay.appleid.com). Apple sends the name only at the first sign-in and only if you share it. Shale asks Google only for the scopes openid, email and profile, no access to Gmail, Drive, contacts or any other Google data. Shale neither uses nor stores a profile picture from the token.
• What for: to sign you in, to create your account the first time, and to link the sign-in to an existing Shale account with the same address. Only an address the provider vouches for is linked automatically (with Google a Gmail or Workspace address); any other only after you confirmed the account with an e-mail code or passkey. The name becomes your display name when the account is new or has none yet; you can change it at any time. Your address gets codes and notices as with the e-mail sign-in (section 3.1).
• What Shale stores: the provider, the id (sub), the e-mail address at the time of linking (so Security shows which account is linked), whether it is a private relay address, when you linked it and last signed in with it. With Apple also an Apple token, stored encrypted and used only to revoke it at Apple. From Google, Shale stores no token and calls no Google service.
• Unlinking and deletion: under Security you unlink Google or Apple from your account; the e-mail sign-in always stays. When you unlink and when you delete your account (section 6), we delete the link and first revoke the Apple token at Apple. When you withdraw Shale's permission in your Apple settings or delete your Apple account, Apple tells our server and we unlink it; your Shale account stays. The copy of your data (section 6) lists linked providers with address and date, never a token.
• No sharing: Shale uses data from Google and Apple only for signing in. We do not sell it, pass it on, use it for advertising or profiles, or use it to train AI models. Shale's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google and Apple learn that you sign in to Shale; their own privacy terms apply to your account with them. Legal basis: contract (Art. 6(1)(b) GDPR). [Lawyer: whether Google and Apple are separate controllers here.]

4. Recipients

• Hetzner Online GmbH, Gunzenhausen, Germany: runs the servers (processor, [agreement in place: yes/no]).
• [name of the e-mail delivery service], [seat]: sends the codes by e-mail (processor, [agreement]).
• Google Ireland Limited (Firebase Cloud Messaging): delivers push notifications on Android once you turn push on (processor, [agreement]); ML Kit's diagnostic data from the QR scanner on Android (section 3.12).
• Apple (Apple Distribution International Ltd., Cork, Ireland): when you sign in with Apple, the revocation of the Apple token when you unlink or delete (section 3.13). Google receives nothing from Shale for signing in with Google; checking the token uses only Google's public keys.
• Other people in Shale, as far as a space shows them content.
• Authorities, when a law obliges us.

We do not sell data and do not pass it on for advertising.

5. How long we keep data

• Your account, until you delete it (section 6).
• The link with Google or Apple, until you unlink it or delete your account (section 3.13).
• Content, as described in section 3.2.
• Security log 365 days; after an account deletion without your identifiers (pseudonymised).
• Reports 365 days after the decision, the copy of the content 30 days.
• Usage statistics raw 90 days, daily totals two years.
• Rate-limit counters with the IP address at most one day.
• Guest chats: the session 7 days, the messages as the chat's retention.
• Poll answers without an account: as long as the poll; the shale_answer cookie one year.
• Access logs of the web server: [period].

6. Deleting your account and exporting your data

• Export: Settings → Account → "Copy of my data" downloads everything that belongs to your account.
• Deleting in the app: Settings → Account → "Delete account". Your account is hidden at once and signed out everywhere. Your personal space and its modules are deleted. Chat messages stay until the end of their retention, with a pseudonym instead of your name.
• Without the app: deletion works only in the app, which confirms it with a code to your sign-in address. Install the app, sign in and follow the steps above (also on the page /legal/account-deletion). If you write to us, we answer with these steps.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). Write to [privacy e-mail address]; for erasure of your account we point you to the deletion in the app (section 6). You can complain to a data protection supervisory authority, for example [competent supervisory authority].

8. Security

Connections to Shale are encrypted (HTTPS). We protect accounts with codes, passkeys and confirmations for sensitive steps.

9. Minimum age

Shale is for people aged 16 and over. Anyone younger may not create an account.

10. Changes

When this policy changes in a significant way, we say so in the app beforehand.