Privacy policy

This is a convenience translation. The German version is legally authoritative.

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):
Hermann Berket
Vogelsbergstraße 8
63743 Aschaffenburg, Germany
Email: support@drillflow.de

2. The essentials first: local-first

DrillFlow is a local-first diagram editor. Your diagrams are stored in your browser on your device and only leave it when you actively use a feature that transfers data (sharing, user account). We use no analytics, tracking or advertising services.

3. Hosting and server logs

This website and the DrillFlow services are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

We keep no access logs of visits to these pages. The server stores only technical error logs, which may contain IP addresses when errors occur; these logs are size-capped, rotated automatically and continuously overwritten in the process. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

4. User account (optional)

You can voluntarily create an account to manage shared links. We process your email address and password; the password is stored exclusively as a cryptographic hash (Argon2). The legal basis is performance of a contract (Art. 6(1)(b) GDPR). You can delete your account yourself at any time: in the app under "Account" (app.drillflow.de/account), in the "Danger zone" section. This irreversibly removes your account and every share link you created; documents stored only locally in your browser are unaffected. Alternatively, we delete the account and its associated data on request to support@drillflow.de.

5. Transactional email (Brevo)

For confirmation and password-reset emails we use Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany); processing takes place in the EU under a data processing agreement pursuant to Art. 28 GDPR. No newsletters or marketing emails are sent.

When you write to us at support@drillflow.de or use the in-app support form, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR). The support form delivers your message and the optionally provided email address to this mailbox via Brevo. The mailbox is operated by Hetzner Online GmbH in Germany (see section 3).

6. Shared diagrams

When you use the share feature, a read-only snapshot of your document (max. 2 MB) is uploaded to our servers in Germany and can be accessed by anyone who knows the link. Please do not upload personal data of third parties that you have no basis to disclose. With an account you can revoke shared diagrams at any time, or have them deleted by emailing support@drillflow.de. The legal basis is performance of a contract (Art. 6(1)(b) GDPR).

Retention: Links created without an account expire 90 days after creation and are deleted automatically thereafter. Links you create while signed in remain until you revoke them or delete your account (which also removes every link belonging to it).

7. Cookies

We only set a technically necessary session cookie (df_session, HttpOnly) when you sign in to the app. It serves solely to keep you signed in and carries no tracking features (§ 25(2) TDDDG, Art. 6(1)(b) GDPR). Since no consent-requiring cookies are used, we do not show a cookie banner.

8. No analytics or advertising services

We use no analytics, tracking, fingerprinting or advertising services — neither on this website nor in the app.

9. Local storage in your browser

The editor stores your documents and settings locally in your browser (IndexedDB and localStorage). We have no access to this data; it remains on your device until you delete it or your browser data.

10. Your rights

Under the GDPR you have the following rights:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the authority responsible for us: the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

11. Data security

All connections to our services are encrypted via TLS.

12. Version and changes

Last updated: 18 July 2026. We will amend this policy when our services or the legal situation change; the version published here applies.