Privacy Policy

Controller

The controller for this data processing is:

Email: [email protected]

The principle: your notes do not live with us

OwnLore connects AI tools to a note archive that lives in your own storage — a folder in your Google Drive, a GitHub repository or your own server via FTP/FTPS or SFTP. The contents of your notes are stored exclusively there. They pass through our server when a request is made and are handed to the requesting AI tool, but we do not keep them.

Our database holds administrative data only. And even that we deliberately keep unreadable:

• File names and paths of your notes are stored encrypted only (AES-256-GCM). They do not exist with us in plain text.
• For each note we store a random, meaningless identifier, a checksum of the content and the size in bytes — not the content.
• The credentials for your storage are held as a single encrypted record; the key for it is not in the database.
• Snapshots of your notes (previous versions) also live in your storage, not with us. We only remember that they exist.
• Our logs contain no file names — only the meaningless identifier appears there.

The legal basis for processing in the course of providing the service is Art. 6(1)(b) GDPR (performance of the contract of use).

Hosting and server log files

OwnLore runs on a server operated by Hetzner Online GmbH in Germany. A data processing agreement under Art. 28 GDPR is in place. When you visit, your browser automatically transmits data that the server records in log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the retrieved file
• Website from which the access originated (referrer)
• Browser and operating system used

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in technically faultless and secure operation. Log files are deleted after 30 days at the latest. This data is not combined with other sources.

Traffic passes through Cloudflare as an upstream protection and delivery service. Your IP address is processed there in order to fend off attacks and to encrypt the connection. The legal basis is Art. 6(1)(f) GDPR.

User account

For an account we process your email address, your name if you provide one, and your password. We store the password exclusively as a cryptographic hash (argon2id) — we do not know it in plain text and cannot reconstruct it.

In addition we store the language we should address you in, plus timestamps recording whether and when an AI tool has already connected. We need the latter to show you the remaining setup steps in the dashboard.

The legal basis is Art. 6(1)(b) GDPR. If you delete your account we delete this data; an exception applies to the checksums described under “Protecting the free trial” and to statutory retention obligations.

Connection to your storage

To reach your brain we need access to the storage you select. What is held with us depends on the backend — encrypted in every case:

• Google Drive: a renewal token issued by Google. The authorisation covers exclusively files that OwnLore creates itself (the “drive.file” permission); your other files in Google Drive are not visible to us.
• GitHub: the identifier of the app installation. You grant access at GitHub for exactly one repository; this does not give us access to your other repositories.
• FTP/FTPS and SFTP: server address, user name and password or private key.

If you connect GitHub, data is transmitted to GitHub, Inc. (USA) on every access — technically unavoidable, since that is where your files are. Whether this happens is entirely your decision through your choice of backend. GitHub is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

The legal basis is Art. 6(1)(b) GDPR. If you disconnect, we delete the credentials from our database and, where the backend supports it, revoke the authorisation with the provider. Your files remain untouched with you.

Connecting your AI tools

An AI tool authenticates against our MCP endpoint with its own access token. We store those tokens as a hash only — after issuing them, the value itself is unknown to us. We also record which program registered, which permissions it has and when the token expires.

When an AI tool requests a note, we hand its content to that tool. What that tool's provider does with it is governed by their privacy policy — we have no influence over that. You make this decision by connecting the tool and instructing it.

The legal basis is Art. 6(1)(b) GDPR.

Activity log and versions

We keep a log of every access by an AI tool to your brain, which you can review in the dashboard. Its purpose is to show you what has happened in your name. We record the time, the type of access, the meaningless note identifier, size and line changes, checksums, the name of the AI tool and the outcome — and, if a write was rejected, the reason as a keyword.

What the log does not contain: file names, note contents and differences between versions. The differences the dashboard shows you are computed from the versions in your storage at the moment you look at them and discarded afterwards.

Before every change OwnLore takes a snapshot of the affected note so you can restore it. Those snapshots live in your storage under “.brain/history”. We hold only the reference to them; it is removed after 30 days.

The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR — our legitimate interest lies in making automated write access traceable and in preventing abuse.

Payments

Payments are handled by Stripe Payments Europe, Ltd., Ireland, together with affiliated companies of the Stripe group. Payment details such as card numbers are entered and processed exclusively there — they never reach our server.

We hold only the identifiers of your customer and subscription records at Stripe, the status of the subscription, the plan you chose and the end of the current billing period. We need this copy in order to decide, on every access by an AI tool, whether the service is unlocked without querying Stripe each time.

Stripe also processes data in the USA. The Stripe group is certified under the EU-US Data Privacy Framework; standard contractual clauses under Art. 46 GDPR apply in addition.

The legal basis is Art. 6(1)(b) GDPR. Invoices are subject to commercial and tax retention periods of up to ten years (Art. 6(1)(c) GDPR in conjunction with section 147 of the German Fiscal Code).

Emails to you

For system emails — currently only the link to reset your password — we use Resend Inc. (USA) as a processor. Your email address and the content of the message are transmitted for that purpose. Resend is certified under the EU-US Data Privacy Framework; standard contractual clauses under Art. 46 GDPR apply in addition.

For a requested reset we store a random value for up to one hour — and even that only as a checksum from which the link cannot be reconstructed. It expires afterwards; used and expired entries are removed on the next reset.

The legal basis is Art. 6(1)(b) GDPR — without a way to reset a forgotten password the account would be unusable. We send no marketing emails and no newsletters.

Protecting the free trial

The trial is available once per storage location. To stop it being repeated by discarding and recreating accounts, we remember three characteristics — and only as a keyed checksum (HMAC) from which the characteristic cannot be recovered:

• an identifier of the storage location (for Google Drive from the account identifier assigned by Google, for GitHub from account name and repository, for your own servers from address, user name and directory)
• a random identifier generated by us, stored inside your brain, which survives a migration
• the identifier Stripe assigns to the payment card used

A match locks nobody out — it merely removes the free period. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in preventing repeated use of a one-time benefit.

These checksums outlive the deletion of your account, because otherwise they would have no effect. The link to your account is removed in the process; what remains is a value that is meaningless in itself.

Abuse prevention

We limit the frequency of login attempts, registrations and requests to our interfaces. To do so we briefly process your IP address in the server's memory; it is not stored permanently. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest lies in fending off automated attacks.

Cookies

Without your consent we set strictly necessary cookies only:

• Language choice (OWNLORE_LOCALE, one year): remembers which language you selected in the header.
• Sign-in (session cookie, 30 days): keeps you logged in to the dashboard. Without it no account can be used.
• Connection flow (two cookies, ten minutes each): secure the route to your storage provider and back against interference. They are deleted immediately afterwards.

The legal basis is section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) or (b) GDPR. No consent is required because without these cookies the service you have expressly requested does not work. You can delete them in your browser at any time.

If you agree in the cookie banner, one advertising cookie from Google is added (_gcl_au, 90 days at most). It records that your visit came from one of our ads. Without your consent it is neither set nor read — see the next section.

Your answer to the banner is remembered in your browser's local storage (keys “ownlore_consent” and “ownlore_cookie_notice”) — not as a cookie, so the value is not sent with every request. Clearing your browser data means we ask again.

Google Ads — measuring our ads

We advertise OwnLore through Google Ads. To see which ad actually led to a sign-up, our pages include the Google tag (gtag.js) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When the page loads, the tag starts in the “no consent” state (Google's consent mode). In that state it stores nothing on your device and reads nothing; click identifiers from the ad are stripped before transmission. Only once you agree in the banner does it set a cookie and attribute your visit to an ad.

The data transmitted comprises your IP address, the address of the page you called up, the referring page and technical details about your browser and device. Transfer to Google LLC in the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses under Art. 46 GDPR are in place in addition.

What is written in your brain does not reach Google this way: the tag runs in your browser and sees page addresses, not note content. The connection to your storage and your AI's work bypass it entirely.

The legal basis is your consent under section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future via “Cookie settings” in the footer. Withdrawing takes one click, exactly like giving consent, and takes effect immediately. Withholding consent puts you at no disadvantage whatsoever; OwnLore works in full.

Otherwise no embedded third-party content

Apart from the Google tag described in the previous section, fonts, images and scripts are served exclusively from our own server. No further third-party content is loaded — no Google Fonts, no analytics tool, no social media plugins. The payment process takes place on a Stripe page, not embedded in ours.

Recipients at a glance

Beyond the cases named here we do not pass on personal data — in particular we do not sell data and we build no advertising profiles from your notes. The only recipients are:

• Hetzner Online GmbH, Germany — server operation (processor)
• Cloudflare, Inc. — protection and delivery of traffic
• Stripe Payments Europe, Ltd., Ireland and affiliated companies — payment processing
• Google Ireland Limited, Ireland and affiliated companies — only if you select Google Drive as your storage
• GitHub, Inc., USA — only if you select GitHub as your storage
• the provider of the AI tool you connect yourself
• Resend Inc., USA — sending system emails (password reset)
• Google Ireland Limited, Ireland and affiliated companies — measuring our ads, only with your consent

Data is disclosed to authorities only where we are legally obliged to do so.

Retention periods

We store personal data only for as long as the respective purpose requires:

• Account data: until the account is deleted
• Storage credentials: until the connection is disconnected
• Server log files: 30 days
• References to stored versions: 30 days
• Activity log: until the account is deleted
• Billing data: up to ten years due to statutory retention obligations
• Checksums protecting the free trial: indefinitely, without any link to your account
• Password reset links: one hour
• Google Ads advertising cookie: 90 days at most, only where consent has been given

Contacting us by email

If you write to us, we process your email address and the information in your message solely in order to handle your enquiry. The legal basis is Art. 6(1)(f) GDPR, and for contract-related enquiries additionally Art. 6(1)(b) GDPR. We delete the data once the enquiry has been dealt with conclusively and no statutory retention obligations apply.

Email: [email protected]

Your rights

With regard to your personal data you have the following rights at any time:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object to that processing on grounds relating to your particular situation. An informal message to the address above is sufficient.

You can also lodge a complaint with a data protection supervisory authority about our processing of your data at any time (Art. 77 GDPR) — the authority at your place of residence or at our registered office is competent. No automated decision-making or profiling takes place.

Changes to this policy

As the service develops we will adapt this policy. The version published here is the applicable one; the date at the bottom of the page shows when it was last updated.