Privacy policy

Controller

Controller within the meaning of Art. 4 No. 7 GDPR:

Email: hello@deckle.io

No data protection officer has been appointed, as there is no legal obligation to do so.

In short

• The editor runs in your browser. Without an account you can open examples and shared projects and simulate them; nothing is saved on the server. Creating and editing requires an account.
• With an account we store your email address, an optional name, a hash of your password, and the projects, parts and API keys you create.
• Projects on the free plan are public: anyone can view and copy them, and they appear in the community gallery together with the name of your account.
• No tracking, analytics or advertising cookies, no third-party content on our pages; fonts are served from our own server.
• We do not use AI services ourselves. If you connect an AI agent, you choose its provider.
• Paid plans are sold by Stripe’s reseller Link, which processes payment data under its own responsibility.
• Servers in Germany. We do not sell data and do not use it for advertising.

Hosting and server logs

Bringup is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR.

When you open a page, your browser necessarily transmits technical data, including its IP address. The web server in front of the application (reverse proxy) records in its access log: a shortened IP address (for IPv4 only the first two of four blocks), date and time, method and requested address (without access tokens), HTTP status, amount of data transferred and duration. Request headers such as cookies, referrer and browser identification are not logged. The application itself logs one line per request with method, path without parameters, status, duration and a random request ID, but no IP address, email address or content.

Purpose: delivering the service, its security and stability, and detecting abuse. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest lies in these purposes. Log files are deleted after 14 days at the latest, unless an incident requires longer retention for evidence.

Rate limits against password guessing and mass registration keep IP addresses and the email address entered for a short time in the server’s memory only (at most a few hours); they are not written to the database.

Cookies and storage in your browser

We set exactly one cookie: cl_session. It is created when you sign in or register, contains a random token, is not readable by scripts (HttpOnly), is only sent to our own server and expires after 30 days or when you sign out. On the server only a hash of the token is stored, together with its expiry and your browser identification.

In addition, the editor stores settings and work in your browser’s local storage (localStorage and IndexedDB): language, colour theme, panel layout, lesson progress, the circuit currently open and its boards, and a cache of synthesis results. This also applies without an account. These data remain on your device and are only transmitted when you save a project to your account.

Storing and reading this information is strictly necessary to provide the service you have expressly requested (§ 25 (2) No. 2 TDDDG); no consent is required. The subsequent processing of the session is based on Art. 6 (1) (b) GDPR. You can delete the stored data at any time in your browser settings; the editor then starts empty and you are signed out.

User account

For an account we process: your email address, an optional display name, your password (stored only as a salted scrypt hash, never in plain text), the time of registration and of the email confirmation, and the sessions described above. Single-use links for confirming your email address or resetting your password are stored only as a hash; they expire after 24 hours or 60 minutes and are deleted at the latest 7 days after expiry.

Purpose: providing the account and the contract on use of the service. Legal basis: Art. 6 (1) (b) GDPR. Providing your email address and a password is required for an account; you can view and simulate examples and shared projects without one.

Storage period: until you delete your account. You can delete it at any time in the account settings or by email to hello@deckle.io. Deleting the account deletes your projects, parts, API keys, sessions and pending email links; usage counters are deleted after 40 days. Expired sessions are deleted 30 days after they expire. Data we must keep for tax or commercial law reasons are retained for the statutory periods and blocked for any other use.

Sending emails

We send emails that are necessary for the account: confirmation of your email address, password reset and important notices about your contract. No newsletters or advertising.

The emails are sent via an email service provider acting as our processor under a data processing agreement pursuant to Art. 28 GDPR: [TODO: name and address of the email service provider, server location]. It processes your email address, the content of the message and technical delivery data (time, delivery status). Legal basis: Art. 6 (1) (b) GDPR.

Projects and your own parts

Projects you save to your account are stored in our database: the circuit document (schematic, boards, firmware source code, description and settings, up to 12 MB per project), its name, revision, times of creation and last change, and whether the last change came from the editor or from an AI agent (with the name of the API key used). Parts you save to your library are stored the same way.

Legal basis: Art. 6 (1) (b) GDPR. Storage period: until you delete the project, the part or your account. Database backups are kept daily for 7 days and weekly for 4 weeks; deleted data therefore disappear from the backups after about five weeks at the latest.

Please do not put personal data of other people, secrets or confidential information into projects – in particular not into public ones.

Public projects and the community gallery

On the free plan every cloud project is public; private projects are part of the paid plans. On paid plans new projects are private, and you can make any project public yourself.

Public means: anyone, also without an account, can open the project read-only, and signed-in users can copy it into their own account. Projects with at least one part are listed in the community gallery with their name, the beginning of the description (up to 400 characters), the number of parts, the date of the last change and, as author, the display name of your account. If you leave the name empty, no author is shown. The email address is never shown.

Legal basis: Art. 6 (1) (b) GDPR – publication is part of the free plan as described in the terms of use. When you delete a project or make it private, it disappears from the gallery immediately. Copies that other users have already made remain in their accounts; we cannot recall them.

Firmware builds and exports

When you build firmware, its source code and the selected target are sent to our server and compiled in separate build containers (Arduino and bare-metal builds in a runner container, Zephyr projects in a Zephyr build container). The containers run on our own infrastructure, have no internet access and keep the files only in temporary memory, which is cleared after the build. Manufacturing and KiCad exports and simulations started by AI agents run in the same isolated way.

Successful build results are kept in the server’s memory for a limited time, identified by a hash of the source code, so that an identical build is answered immediately. This cache is not stored permanently and is lost when the server restarts.

To enforce the daily allowances of the plans we count builds and server time per day: per account and per network via the IP address. Builds require an account; visitors without an account are not counted. The IP address is only stored as a salted, shortened hash. The counters are deleted after 40 days. A short-term limit per IP address is kept in memory only.

Legal basis: Art. 6 (1) (b) GDPR for account holders; Art. 6 (1) (f) GDPR for the protection against abuse, based on our legitimate interest in a fair distribution of the limited build capacity.

AI agents, API keys and MCP

In plans that include it, you can connect AI agents through the MCP interface using API keys. We store for each key: its name, the first 12 characters, a hash of the key (never the key itself), the time of creation, last use and revocation. Requests from agents are processed like requests from the editor; changes are marked with the name of the key. Legal basis: Art. 6 (1) (b) GDPR. Keys are deleted with your account; revoked keys are kept until then so that the history of changes remains traceable.

We do not send your data to AI providers. The agent itself runs with the provider you choose. Everything the agent reads through the interface (for example projects or simulation results) is transmitted to that provider on your behalf and is subject to its privacy policy.

Plans and subscriptions

For each account we store which plan it has, the status and the end of the current billing period, and – once paid plans are offered – references to the customer and the subscription at Stripe. Legal basis: Art. 6 (1) (b) GDPR, and Art. 6 (1) (c) GDPR for statutory retention duties. Our own accounting records (in particular the settlements with Stripe) are kept for the statutory periods (up to ten years, § 147 AO, § 257 HGB).

Purchase of paid plans via Stripe (applies once paid plans start)

This section applies only once paid plans can be booked. During the beta no payments are processed.

Paid plans are sold through Stripe Managed Payments. Seller (merchant of record) is the Stripe subsidiary Sold through Link, LLC (“Link”). In the checkout you enter your details directly with Stripe/Link; we do not receive card or account numbers. For the purchase, payment, invoicing, taxes, fraud prevention, chargebacks and transaction support Link and the Stripe companies involved process your data as independent controllers under their own privacy policies (https://link.com/privacy and https://stripe.com/privacy). Data may be processed in the USA; the transfer is the responsibility of Stripe/Link.

To assign the purchase to your account we pass your email address and an internal account reference to Stripe when you start the checkout. From Stripe we receive the plan bought, the status and period of the subscription, references to customer and subscription, the country and the amounts, as well as information on refunds and chargebacks. Legal basis: Art. 6 (1) (b) GDPR; for records we must keep, Art. 6 (1) (c) GDPR.

Contact by email

If you write to us, we process your email address, your message and any data you provide in it in order to answer. Legal basis: Art. 6 (1) (f) GDPR – our legitimate interest is answering your enquiry; if the enquiry concerns a contract, Art. 6 (1) (b) GDPR. We delete the correspondence after 12 months at the latest once the matter is settled, unless statutory retention duties apply.

Recipients and transfers to third countries

Recipients of personal data are only: our hosting provider Hetzner (Germany) and the email service provider named above as processors, and, once paid plans start, Stripe/Link as independent controllers. We do not transfer data to other third parties unless we are legally obliged to. Data are processed outside the EU/EEA only by Stripe/Link as described in the Stripe section. There is no automated decision-making including profiling within the meaning of Art. 22 GDPR.

Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) – projects can also be downloaded as files in the editor at any time
• Objection (Art. 21 GDPR) to processing based on Art. 6 (1) (f) GDPR, on grounds relating to your particular situation

An email to hello@deckle.io is sufficient.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, https://www.ldi.nrw.de.

Changes

We adapt this privacy policy when the service or the legal situation changes. The version published here applies.