Privacy Policy

1. General Overview & Controller

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations (GDPR / DSGVO) and this Privacy Policy.

The controller responsible for data processing on this platform can be reached via the contact details provided in our Impressum.

2. Cookies and Tracking

This website does not use cookies. We do not use Google Analytics, advertising trackers, fingerprinting, or any third-party tracking scripts.

3. Content Delivery Network & Security (Cloudflare)

To protect this website and ensure high availability, we use the Content Delivery Network (CDN) and Web Application Firewall (WAF) provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA).

When you access our web pages, your browser connects to Cloudflare’s edge servers. Cloudflare processes your IP address and technical telemetry to filter out malicious traffic (such as DDoS attacks and automated scraping) before it reaches our self-hosted infrastructure.

Legal Basis: Our legitimate interest in providing a secure, stable, and highly available service pursuant to Art. 6 (1) (f) GDPR.
Data Transfer: We maintain a Data Processing Agreement (DPA) incorporating Standard Contractual Clauses (SCCs) with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework (DPF).

4. Server Log Files & Analytics

Our self-hosted web infrastructure automatically collects and processes technical information transmitted by your browser into server logs:

Browser type and browser version
Operating system used
Referrer URL
Date and time of server request
IP address (Anonymized)

Privacy by Design: IP addresses are truncated/anonymized immediately before being written to disk. Consequently, raw web server log files do not contain Personally Identifiable Information (PII).

We evaluate these anonymized logs locally using GoAccess, a self-hosted, open-source analytics utility. No logs or traffic metrics are shared with or accessible to third parties.

5. Client-Side Tools (Credential Decryptor)

Our /decrypt/ credential decryption tool operates entirely client-side within your browser using WebCrypto primitives:

Private keys, ciphertexts, and decrypted credentials are processed solely in local browser memory.
No keys, passwords, or decrypted account payloads are ever transmitted across the network or logged by our servers.

6. XMPP Service (`xmpp.darkstars.me`)

We operate a private, self-hosted XMPP chat server (xmpp.darkstars.me) for encrypted, decentralized instant messaging.

Closed / Invite-Only Access: Public registration (In-Band Registration / IBR) is strictly disabled. Self-registration by third parties is not permitted. Accounts are provisioned exclusively on a manual basis by the operator for specifically invited individuals (e.g., personal contacts, friends, and family) who have a direct personal or operational reason to communicate with us.
Account Data: When an account is created, we store the Jabber Identifier (JID, e.g., [email protected]) and a cryptographically hashed representation of the password (e.g., via SCRAM-SHA). Plaintext passwords are never stored.
Message Content & End-to-End Encryption: We enforce/recommend End-to-End Encryption (OMEMO / PGP). When messages are encrypted end-to-end, the server operator cannot inspect or read message contents, attachments, or call data. If a recipient is offline, encrypted messages may be queued temporarily in server memory or an offline message spool until delivered, after which they are removed.
Connection & Metadata Logs: To ensure service operation, message routing, and abuse mitigation, connection logs (IP addresses and session timestamps) may be processed temporarily and are rotated/purged regularly.
Legal Basis: Processing of account credentials and message routing occurs pursuant to Art. 6 (1) (b) GDPR (provision of communication services requested by the invited user) and Art. 6 (1) (f) GDPR (legitimate interest in maintaining server stability and network security).
Account Termination & Erasure: Users may request the deletion of their XMPP account at any time. Upon deletion, account records, roster entries, and stored offline messages are permanently removed from the server database.

7. Private Matrix Homeserver

We host a private, single-user Matrix homeserver for administrative and personal operational communication.

No Public Registration: Registration is permanently disabled. No third parties or external users may create or hold an account on this homeserver.
Federation & Remote Processing: If federation is enabled to communicate with external Matrix servers, encrypted room events (messages, room state, profile information, and key exchanges) are exchanged with participating homeservers as required by the decentralized Matrix protocol. End-to-End Encryption (Olm/Megolm) protects message payloads from server inspection.
Data Retention: Minimal room event data and temporary IP connection logs are processed strictly to maintain federated synchronization and network security based on our legitimate interest (Art. 6 (1) (f) GDPR).

8. Contact Inquiries

If you contact us via email or SimpleX Chat, the messages and contact identifiers you provide are stored strictly for communicating with you and handling follow-up questions. This data is processed based on pre-contractual measures or legitimate interest (Art. 6 (1) (b)/(f) GDPR) and is never shared with third parties without your consent.

You hold the following rights regarding personal data processed by us:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure / “Right to be forgotten” (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to data processing based on legitimate interests (Art. 21 GDPR)
Right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR)