Privacy policy

Last updated: 17. Oktober 2026

Note: This is a courtesy translation. Legally binding is the German version, which you can read by switching the language to DE at the top of this page.

This website is a plain information site. It sets no cookies for analytics or advertising, embeds no third-party content, loads no fonts from external servers and counts no visits. Whatever data does arise is set out here in full.

1. Controller

The controller within the meaning of Art. 4 No. 7 GDPR is:

Colin Pfingsten: c/o flexdienst – #21028; Kurt-Schumacher-Straße 76; 67663 Kaiserslautern; Deutschland; E-mail: support@osirisui.com

2. Visiting the site: server log files

When a page is requested, your browser transmits technically necessary data to the server delivering it. That data is stored in log files:

IP address of the requesting device
date and time of access
name and URL of the file retrieved
volume of data transferred and whether the request succeeded
browser and operating system used
the page visited before (referrer), if your browser sends it

Purpose and legal basis: The processing is necessary to deliver the site, keep it stable and detect attacks. The legal basis is our legitimate interest in a secure and functioning service, Art. 6 (1) (f) GDPR.

Retention: The web server's log files are deleted or truncated after seven days at the latest, unless they are exceptionally needed longer to investigate a specific attack. This period applies to these log files only; the licence server's event log is described in section 5 and has a period of its own.

Encryption: The connection is encrypted with TLS. You can tell by the padlock in your browser's address bar.

3. Hosting

The website, the customer area and the licence server run on a rented virtual server of a hosting provider. The data described in this policy is therefore stored on that provider's hardware.

Delivery network in front of the site

The site is delivered through a network that sits in front of our server. It shields the server against overload and attacks and shortens loading times. Every request therefore passes through this provider first, which sees your IP address, the address requested and your browser's headers:

Cloudflare, Inc.: 101 Townsend Street, San Francisco, CA 94107, USA

The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in operating the site securely and reliably.

A data processing agreement pursuant to Art. 28 GDPR is in place with that provider. As the provider is based in the USA, the transfer is also a transfer to a third country; it is covered by the EU standard contractual clauses pursuant to Art. 46 (2) (c) GDPR.

4. Storage on your device

This website stores only what it needs in order to work. There is no reach measurement, no advertising and no tracking. In full, this is everything:

Name	Kind	Purpose	Kept for
osiris_an	Cookie	Records that you are signed in to the customer area, so that the account menu appears in the header instead of the log-in links. It holds no name, no address and no identifier.	until you close the browser
osiris.site.theme	Local storage	Whether you read the site light or dark.	until you delete it
osiris-sprache	Local storage	Which language you chose.	until you delete it
osiris.hinweis	Local storage	That you have read the notice about this storage, so it is not shown again.	until you delete it

Language: On your first visit, the site looks at the time zone set on your device. If it is Germany’s (Europe/Berlin), you see the German version, otherwise the English one. This happens only in your browser — the time zone is neither stored nor transmitted. A language you choose yourself always wins.

All of it is strictly necessary to provide the service you asked for; it is therefore exempt from consent under § 25 (2) No. 2 TDDDG. The values are not analysed, not transmitted and not linked to your person. You can delete them at any time through your browser settings.

For that reason you will see a short notice rather than a consent banner: there is nothing here you could refuse without breaking the site. Should we ever add anything that does require consent, you will be asked first — and this section will say so.

5. Customer area, licence check and Explore

Besides the pages themselves, our licence server answers requests from the customer area, from the Osiris software on your computer and from Explore. The following explains the event log it keeps and what happens in Explore.

Event log

The licence server records certain events with date, time and the IP address they came from — and, depending on the event, your account, your e-mail address, the licence number or the device name sent when a device is activated. These are: creating an account, signing in, resetting a password and linking a licence; activating and releasing a device and the regular licence check of the running software; fetching the installer or the app package; in Explore, choosing a forum name, publishing, withdrawing or deleting a project, redeeming a pickup code and submitting a report; issuing a trial licence or a place in the offer for the first users, starting a purchase, cancelling a subscription, payment notifications from Tebex and sending reminders; as well as failed attempts and errors.

Purpose and legal basis: The log serves to detect and investigate misuse of licences and accounts, to keep the service secure and to answer support enquiries. Where it concerns your contract, the legal basis is Art. 6 (1) (b) GDPR; otherwise it is our legitimate interest in a secure service that cannot be misused, Art. 6 (1) (f) GDPR.

Retention: Entries are deleted automatically after 90 days, together with the IP address.

Explore: published projects

If you publish a project in Explore, it is public: title, description, tags, licence, images, the package itself, the number of pickups, the dates and the forum name you chose — never your e-mail address. It stays public until you withdraw or delete it, or until we remove it. With the project we store the IP address of the publishing request; that IP address is removed after 90 days. The legal basis is Art. 6 (1) (b) GDPR: publishing is a function of your account that you trigger yourself.

Reports: Anyone can report a project, even without an account. We store the project, the reason, the text you add (if any), the time, your account if you are signed in, and the IP address. The IP address is removed after 90 days; the report itself is kept so that we can handle it and show how it was handled. The legal basis is Art. 6 (1) (f) GDPR — our interest in keeping Explore free of unlawful and harmful content.

Pickup codes: If you have a project sent to Osiris from its page, the server creates a pickup code that is valid for ten minutes and only once. It is stored with the project and its validity only — without IP address and without account — and removed in the daily clean-up once it has expired. Redeeming it in Osiris is recorded in the event log.

Feedback from Osiris

If you send feedback from Osiris (the bug icon at the bottom of the sidebar), we store your description, the Osiris version, your operating system, the language of the interface, the time and your account with name and e-mail address — no chats and no file contents. Sending is noted in the event log, without the text. To prevent spam, at most three reports in a row are accepted, followed by a 30-minute pause; for this we keep a keyed hash of your IP address, never the address itself, and remove it after 90 days. We use feedback only to fix problems and improve Osiris and delete it once it is no longer needed; if you delete your account, your name and e-mail address are removed from it. The legal basis is Art. 6 (1) (f) GDPR — our interest in software that works.

6. Free trial, subscription and payment

With an account you get a free trial of Osiris; after that you can keep using it with a subscription. This section explains what data that involves.

One free trial per device

So that the free trial is granted only once per computer, Osiris sends a pseudonymous device identifier to our licence server when you activate it — a string the app derives from your computer's machine ID without the ID itself ever leaving the computer. Of that identifier, the server stores only a hash, together with the internal number of the account that received the trial on this device and the date. If someone creates a second account on the same device, it does not get a second trial there.

Purpose and legal basis: The check prevents the free trial from being used again and again with new accounts. The legal basis is our legitimate interest in preventing misuse of the free offer, Art. 6 (1) (f) GDPR.

Retention: We keep the entry for as long as we offer a free trial. It stays even if you delete your account — otherwise the trial could be claimed again with every new account. The hash cannot be turned back into your computer's identifier.

Offer for the first users

While our offer for the first users is running (terms of service, section 6), a new account can receive one of a limited number of free places. For this we store the number of the place, the internal number of the account that received it and the time. If you delete your account, the place stays taken, but the link to your account is removed. The device rule described above also applies to the free licence from the offer.

So that one person cannot take many places, the licence server counts how many places were granted per internet connection within a day — by IP address, for IPv6 by its network part (/64). This count is kept only in the server's working memory: it is never written to disk and is gone after a day or when the server restarts.

Legal basis and retention: Granting and keeping track of the place is necessary to provide the free licence, Art. 6 (1) (b) GDPR; the count per connection and the device check serve our legitimate interest in preventing misuse of the free offer, Art. 6 (1) (f) GDPR. We keep the entry for as long as your account exists; after that, only the number of the place and the time remain.

Subscription and payment via Tebex

You buy the subscription from Tebex. Tebex sells it in its own name as merchant of record: your purchase contract, the invoice and the VAT are with Tebex, and Tebex processes the payment. The provider is:

Tebex Limited: London, United Kingdom

When you start a purchase, we pass to Tebex your e-mail address and the internal number of your account, so that the payment can be matched to your account — depending on the type of checkout also your name and the IP address of the request. At checkout you then give Tebex your payment details and billing information yourself; Tebex also determines the country you are buying from, for VAT. We never see your payment details such as card or account numbers.

Tebex notifies us about your subscription — purchase, renewal, cancellation, refund or chargeback. From these notifications we store the kind of event, the transaction number, the subscription reference, amount, currency and time, linked to your account; with them we keep track of your subscription and extend or end your licence.

Legal basis and retention: The processing is necessary to provide your subscription and your licence, Art. 6 (1) (b) GDPR. We keep subscription and payment records for as long as the subscription runs and afterwards for as long as commercial and tax law require us to.

Tebex is itself responsible for what happens at checkout and for the payment; its own privacy policy applies: tebex.io/privacy. Tebex is based in the United Kingdom, for which the European Commission has found an adequate level of data protection (Art. 45 GDPR).

Mail about your trial and subscription

Around your trial and subscription we write to you: a reminder shortly before your trial or subscription runs out, a note once it has run out, and confirmations when a subscription starts, is cancelled or ends. The legal basis is Art. 6 (1) (b) GDPR (performance of the contract). We do not send advertising.

7. Contacting us

If you write to us by e-mail, we process your details in order to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry concerns a contract, otherwise Art. 6 (1) (f) GDPR (interest in answering enquiries). We delete the messages as soon as they are no longer needed and no statutory retention obligations stand in the way.

8. What does not happen

no reach measurement, no analytics, no tracking
no ad networks, no profiling, no automated decision-making
no fonts, maps, videos or scripts from external servers
no tracking pixels in the mail we send — the logo travels inside the message
no code the delivery network adds of its own: its optional script injections are switched off
no disclosure to third parties other than the recipients named in this policy
no transfer to third countries beyond the recipients named in this policy

That applies to this website. The Osiris software itself communicates — if you use it — with Anthropic; what happens there is described under AI transparency.

If you connect GitHub in the Osiris software, it talks to GitHub directly from your computer — to list your repositories and to clone the ones you add to a chat or project. The access token stays on your computer, in the local key store of Osiris; it is never sent to us, and we see neither the token nor your repositories. What happens at GitHub is governed by GitHub's own privacy statement.

9. Your rights

You have the following rights against us regarding your personal data:

Access to the data processed (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)

An informal message to support@osirisui.com is enough.

10. Right to lodge a complaint

Without prejudice to any other remedy, you may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

The authority competent for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz. Further information is available on the supervisory authority's website.

11. Changes

If the website changes, this policy changes with it. The version published here applies, dated 17. Oktober 2026.