← Back

Privacy Policy

⚠️ Draft. Please have it reviewed by a lawyer before going live.
The German version is legally binding.

1. Controller

Robware, Hauptstraße 58c, 21640 Bliedersdorf, Germany.
Email: kontakt@robware.de

2. Core principle: end-to-end encryption

Schnack is an end-to-end encrypted messenger. Message content, media and files are encrypted and decrypted exclusively on your device. The server only stores and transmits this content in encrypted form (ciphertext) and can never read it in plaintext.

3. What data we process

  • Account data: email address, display name and a password hash (we do not store the password itself), optionally a profile picture.
  • Messages & media: end-to-end encrypted only; the server sees only ciphertext plus technical metadata (sender/recipient identifiers, timestamps, delivery and read status).
  • Cryptographic keys: public keys and pre-key bundles for establishing encrypted sessions (X3DH).
  • Push tokens: device tokens from Apple (APNs) or Google (FCM) to notify you of new messages. The notifications contain no message content.
  • Contacts & status: the contacts you create in the app as well as online / last-seen status.
  • Technical connection data: e.g. IP address and connection time, insofar as required for operation and security.

4. Purposes and legal basis

Processing takes place to provide the messenger service (performance of a contract, Art. 6(1)(b) GDPR) and to ensure operational security and stability (legitimate interest, Art. 6(1)(f) GDPR).

5. Processors and third-country transfer

For operation and storage we use service providers (server hosting as well as object storage for encrypted media blobs). Push notifications are delivered via Apple (APNs) and Google (FCM). All message and media content remains exclusively encrypted in this process.

Note (to be reviewed): If object storage outside the EU/EEA is used (e.g. Yandex Object Storage), the admissibility of the third-country transfer must be assessed separately and secured contractually. This section is to be finalized legally before publication.

6. Storage period

We store personal data only for as long as necessary for the stated purposes. When you delete your account, the associated data is removed, unless statutory retention obligations apply.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with a data protection supervisory authority. To do so, contact kontakt@robware.de.

8. Data protection contact

If you have questions about the processing of your data, you can reach us at kontakt@robware.de.