Privacy policy

This is a convenience translation. The German version is legally authoritative.

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):
Hermann Berket
c/o Impressumservice Dein-Impressum
Stettiner Str. 41
35410 Hungen, Germany
Email: support@drillflow.de

2. The essentials first: local-first

DrillFlow is a local-first diagram editor. Your diagrams are stored in your browser on your device and only leave it when you actively use a feature that transfers data (sharing, user account). We use no analytics, tracking or advertising services.

3. Hosting and server logs

This website and the DrillFlow services are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.

We keep access logs without IP addresses. Only the following is recorded: timestamp, requested hostname, method, path, status code, response size, response time and — if your browser sends one — the referring page (Referer). IP address, user agent and cookies are stripped before the line is written and never reach the disk. Individual people cannot be identified from this, and visits cannot be linked across requests. The logs are size-capped and overwritten after seven days at the latest; the only longer-lived derivative is a per-day count of requests per page, with no personal reference whatsoever. In addition the web server keeps aggregate counters per hostname and status code, held in memory only. The legal basis is our legitimate interest in secure and stable operation and in measuring reach without personal data (Art. 6(1)(f) GDPR).

Technical error logs may contain IP addresses when errors occur; these logs are likewise size-capped, rotated automatically and continuously overwritten in the process.

4. User account (optional)

You can voluntarily create an account to manage shared links. We process your email address and password; the password is stored exclusively as a cryptographic hash (Argon2). The legal basis is performance of a contract (Art. 6(1)(b) GDPR). You can delete your account yourself at any time: in the app under "Account" (app.drillflow.de/account), in the "Danger zone" section. This irreversibly removes your account, every share link you created and every document in your account library (section 7); documents stored only locally in your browser are unaffected. Alternatively, we delete the account and its associated data on request to support@drillflow.de. After the deletion we send a single confirmation to the former email address and do not keep it afterwards.

Signing in with Google (optional). Instead of a password you can sign in with your Google account. We then redirect you to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), and with your consent Google sends us your email address, the confirmation that Google has verified that address, and an identifier of your Google account. We store only the email address and that identifier — no name, no profile picture, nothing else. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework. Google's own privacy policy applies to its processing (policies.google.com/privacy). You can disconnect Google in the app under "Account → Security" as long as another way to sign in remains (a password or another connected sign-in).

Signing in with GitHub (optional). You can sign in with your GitHub account in the same way. We then redirect you to GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA), and with your consent GitHub sends us your numeric GitHub identifier and the list of email addresses on your GitHub account, with which of them are verified. We store only your verified primary address and that identifier — no username, no profile picture, no access to repositories; GitHub's access token is discarded right after the sign-in. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). The data is transferred to the USA; GitHub, as a subsidiary of Microsoft Corporation, is certified under the EU-US Data Privacy Framework. GitHub's own privacy statement applies to its processing (docs.github.com/site-policy/privacy-policies). You can disconnect it under "Account → Security" like Google.

5. Transactional email (Brevo)

For confirmation and password-reset emails we use Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany); processing takes place in the EU under a data processing agreement pursuant to Art. 28 GDPR. No newsletters or marketing emails are sent.

When you write to us at support@drillflow.de or use the in-app support form, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR). The support form delivers your message and the optionally provided email address to this mailbox via Brevo. The mailbox is operated by Hetzner Online GmbH in Germany (see section 3).

6. Shared diagrams

When you use the share feature, a read-only snapshot of your document (max. 2 MB) is uploaded to our servers in Germany and can be accessed by anyone who knows the link. Please do not upload personal data of third parties that you have no basis to disclose. With an account you can revoke shared diagrams at any time, or have them deleted by emailing support@drillflow.de. The legal basis is performance of a contract (Art. 6(1)(b) GDPR).

Retention: Links created without an account expire 72 hours after creation (those created before 14 October 2026: 90 days) and are deleted automatically thereafter. Links you create while signed in remain until you revoke them or delete your account (which also removes every link belonging to it).

7. Documents in your account (library)

With a paid plan you can keep individual documents in your account so you can work on them from more than one device. This applies only to documents you switch on one by one; every other document stays in your browser alone. What is stored on our servers in Germany (section 3) is the document's content, its title and modification times. Unlike a shared link, these documents are not publicly retrievable — they are reachable only through your signed-in account. The legal basis is performance of a contract (Art. 6(1)(b) GDPR). As with sharing, do not upload personal data of third parties that you have no basis to process.

Retention: a document stays stored until you remove it from your account or delete your account. A removed document is first marked as deleted — so a device that was offline still learns about the deletion — and is erased permanently after 30 days at the latest. Deleting your account irreversibly deletes every document in your library.

8. Cookies

We only set a technically necessary session cookie (df_session, HttpOnly) when you sign in to the app. It serves solely to keep you signed in and carries no tracking features (§ 25(2) TDDDG, Art. 6(1)(b) GDPR). Signing in with Google or GitHub adds a second, equally necessary cookie for at most ten minutes (df_oauth, HttpOnly), which secures the round trip to the provider and back; it is deleted on return. Since no consent-requiring cookies are used, we do not show a cookie banner.

9. No analytics or advertising services

We use no analytics, tracking, fingerprinting or advertising services — neither on this website nor in the app.

10. Local storage in your browser

The editor stores your documents and settings locally in your browser (IndexedDB and localStorage). We have no access to this data; it remains on your device until you delete it or your browser data.

11. Your rights

Under the GDPR you have the following rights:

  • Access to the data processed (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR) — in the app under "Account → Profile → Download my data", a ZIP with every share link, cloud document and setting
  • Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the authority responsible for us: the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. Data security

All connections to our services are encrypted via TLS.

13. Version and changes

Last updated: 19 October 2026. We will amend this policy when our services or the legal situation change; the version published here applies.