Privacy Policy

1. Controller

The controller responsible for processing your personal data is:

Stefan Sonntag
Trading as: Trusted Codes (sole proprietor / Einzelunternehmer)
Leonrodstr. 14b, 80634 Munich, Germany

• Privacy: privacy@trusted.codes
• Legal: legal@trusted.codes

We have not appointed a data protection officer, because the legal requirements for this are not met (Art. 37 GDPR, § 38 BDSG).

2. Scope of this policy

Trusted Codes is a verification service for people who already know each other. It lets two parties confirm, over any channel, that they still share a cryptographic reference, by means of rotating word codes. The service consists of the mobile apps for iOS and Android, the desktop app for macOS, Windows and Linux, the web portals my.trusted.codes and business.trusted.codes, public verification pages, the website trusted.codes and related interfaces. After setup, codes can be generated without a network connection. Other functions need a connection.

This policy applies to all of these offerings. Where we process data on behalf of a business customer, that customer is the controller. Section 13 describes this.

3. Account and sign-in

For an account we process your e-mail address, your display name, your language and the time of registration. If you upload a profile picture, we store it. You sign in with a link that we send by e-mail, or with your Apple or Google account. In the second case Apple or Google sends us your name and your e-mail address (with Apple, possibly a relay address). We only receive this if you choose that button.

If you reach us through a link with campaign information, we store this information (source, medium, campaign) and, where applicable, a referral code with your account.

Legal basis: Art. 6(1)(b) GDPR. For the campaign information: Art. 6(1)(f) GDPR. Our legitimate interest is to know how users find us.

4. Devices

For each device on which you use Trusted Codes, we store: platform and the major version of the operating system; the device name you set in the device settings (without one, a label made of device type, platform and operating system version); a device identifier issued by the operating system; app version; the public key of the device; and the token for push notifications. We need this information to tell your devices apart, to deliver messages and to show you in the settings which devices are signed in. Device names are stored unencrypted. Legal basis: Art. 6(1)(b) GDPR.

5. Connections, code checks and your content

When you connect with another person, we store who is connected with whom, since when, and the name you give the connection. The codes are derived from a secret that the two sides share (code secret). The codes you see are generated on your device.

Where your app supports it, code secrets are encrypted on your device for specific recipient devices (X25519 key agreement, AES-256-GCM). We cannot decrypt that copy.

We also process code secrets in the following cases. There they are stored encrypted with AES-256-GCM under a key that we control, and our servers can decrypt them:

• (a) connection and organisation codes generated by the service;
• (b) code generation for the desktop app and for machine clients;
• (c) invitations and open links, until the recipient's device has received the secret;
• (d) accounts that use the server key backup;
• (e) demonstration accounts.

When a person enters a code on a public verification page, or when a code is checked with the server of another operator (section 15), the code is transmitted in order to check it. Legal basis: Art. 6(1)(b) GDPR.

Code checks. When you check the code of one of your connections, we store the check: who checked whose code, when, and with which result. In an organisation, a check is also recorded when members confirm each other at a meeting (check-in), with the name shown there and the method. Legal basis: Art. 6(1)(b) GDPR.

Beacon. If you broadcast a beacon so that others can check your codes, we store when the session started and ended, its settings, and how many checks and regions it had, including how many checks looked unusual. We delete these records after 90 days. Legal basis: Art. 6(1)(b) GDPR; for counting unusual checks, Art. 6(1)(f) GDPR, our legitimate interest in detecting misuse of your codes.

Seals. When you seal a text or a file, we store a fingerprint (hash) of it, its language, the time of sealing and whether it was revoked. The file itself is never uploaded. If you share a seal by link, we also store the text encrypted with a key that only the link and your own devices hold; we cannot read it. We delete the encrypted text 24 hours after it was first checked, and at the latest after 30 days. The fingerprint remains verifiable through the public transparency log (section 16). Legal basis: Art. 6(1)(b) GDPR.

Content and settings you create. We store what you create or set in the service: the names and descriptions you give connections, tags and favourites, the names you give your workspaces, presets for guest codes and connections, your notification settings, the messages you add to invitations, your public handle and open invitation links, promotion codes you redeem, and the name, permissions and times of use of API tokens and of apps you connect to your account. Of an API token we store only a hash. We also record when you requested a data export; the export file itself is deleted after 24 hours. Legal basis: Art. 6(1)(b) GDPR.

6. How we protect stored data

Personal data in our application database, such as e-mail addresses, names, connection names, notifications and stored API keys, is encrypted with AES-256-GCM before storage. Two exceptions are stored in plain text: the e-mail address that the authentication service uses for sign-in, because sign-in needs it, and the names of your devices. The key is held by a separate key-management provider in the European Union (Infisical), not in the database. Our application servers retrieve the key at run time and can decrypt this data in order to provide the service. When our administrators display decrypted data in the administration console, this is recorded in an audit log.

IP addresses that we use for rate limiting and for verification statistics are stored only as a keyed hash (HMAC-SHA256).

7. Invitations to persons without an account

If you invite a person who does not yet have an account, we store the e-mail address you entered and send that person an invitation. The address comes from you. It is deleted when the invitation is accepted, declined, withdrawn or expires. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest, and that of the inviting person, is to deliver the invitation. The invitation e-mail refers to this policy.

8. Public verification pages and guest codes

On the public verification pages anyone can check a code, also without an account. We process the code words entered, the approximate country and a keyed hash of the IP address, in order to limit guessing. For guest codes we also store who verified a code and when. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to protect codes against systematic guessing. Retention periods: section 25.

9. Ratings and trust score

Users can rate and endorse each other. A rating you receive is never shown with the name of the person who gave it. From these ratings, the age of the account, its use and the results of the fraud check (section 10) we calculate a trust score. A person who verifies a code from you sees this score, also through servers of other operators (section 15). This is an evaluation of personal aspects (profiling). The score does not lead to an automated decision about you. It is information for the person who verifies.

The trust score is part of the service that Trusted Codes provides to every user under the Terms of Service: a person who verifies a code learns whether the connection exists and how trustworthy the account behind it appears. In return, your own score is shown to the persons who verify codes from you. Legal basis: Art. 6(1)(b) GDPR. To the extent that the processing is not necessary for the contract, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest, and that of all users, is protection against fake or misused accounts. In that case you can object (section 27).

If you think a rating about you is incorrect, you can ask us to review and correct it (Art. 16 GDPR).

10. Fraud prevention and automated decisions

When you create an account or request a sign-in link, we send your IP address, your e-mail address and the identification of your browser (user agent) to MaxMind, Inc. (USA). MaxMind returns an approximate location (country, region, city, time zone), properties of the network connection (for example VPN, Tor or hosting provider) and a risk score. We store these results with your account and with each sign-in link request. The registration country and the IP hash on your account are cleared one year after sign-up.

Automated decision. The request is refused automatically if the risk score exceeds a threshold, if a new e-mail address appears together with an increased score, or if an anonymisation network is used from a country with increased risk. Sign-up with a disposable e-mail address is also refused automatically. These decisions are necessary for entering into the contract (Art. 22(2)(a) GDPR). Without them we could not prevent fake accounts that harm the users who rely on genuine connections.

If your request was refused, write to privacy@trusted.codes. A person will review the decision again. You can state your point of view and contest the decision (Art. 22(3) GDPR).

The risk signals are one input to the trust score (section 9). For storing the results the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest, and that of the other users, is to keep fraudsters and fake accounts away before they connect with users acting in good faith (Recital 47 GDPR).

11. Security records

We record sign-ins, account actions and the administration of organisations. For sign-in link requests we store the e-mail address (encrypted), the IP address, the client identification and the result of the fraud check. For rejected registrations we store the attempt. With each sign-in we store a keyed hash of the IP address. We use this data to detect attacks and to investigate errors. Legal basis: Art. 6(1)(f) GDPR. Retention periods: section 25.

Our administrators can give an account a label, for example for a support case, for the test programme or for suspected misuse, and can add an internal note to it. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to support you and to prevent misuse. The labels are part of your data export; you can request the notes from privacy@trusted.codes.

12. Assistant

The apps and portals contain an assistant. It answers questions about the service and, after your explicit confirmation, carries out actions in your account. You interact with an AI system. Its answers can be wrong. Actions run only after you confirm them.

12.1 On our key

To understand your request, to compose answers and to find matching help texts, we use OpenAI (OpenAI Ireland Ltd; parent company OpenAI, Inc., USA). We send your message, the preceding part of the conversation and, for questions about the service, extracts from our help articles. To find matching help articles, your question is also converted into a search vector. We do not send your name, your e-mail address or your account identifier. The conversation can still contain personal data that you or the assistant wrote, for example the name of a contact. Do not enter data about other persons that the task does not need.

OpenAI processes the data in the United States. The transfer is based on the EU Standard Contractual Clauses. OpenAI keeps API data for up to 30 days to detect abuse and then deletes it, and does not use it to train models.

Each plan that includes the assistant contains a limited number of answers per month composed on our model (currently three). After that, answers need your own key.

12.2 On your own key

If you store your own API key, the assistant sends the same content to the provider you chose (OpenAI, Anthropic, Google, xAI, Moonshot AI or OpenRouter). This happens under your own contract with that provider, and its terms apply. That provider is not our sub-processor. We store your key encrypted (section 6).

12.3 Storage and legal basis

For each request we store its category (for example "create a connection" or "question about the service") and its outcome, not its text, for 180 days, in order to find errors. Only if a request is classified as suspected abuse do we keep its text and the answer, encrypted, for 30 days, in order to investigate the misuse. We store the model usage per user for 13 months, for billing.

Legal basis for the assistant and for usage records: Art. 6(1)(b) GDPR. For the request records and the text of suspected abuse: Art. 6(1)(f) GDPR. Our legitimate interest is to find errors and to prevent misuse.

13. Organisations and business customers

For an organisation we store its name, its logo, the billing e-mail address, the VAT identification number, and its members, groups and roles. We check the VAT identification number with the VAT Information Exchange System (VIES) of the European Commission. Legal basis: Art. 6(1)(b) and (c) GDPR.

We process the data of the members and contacts of an organisation on behalf of the business customer, on the basis of the Data Processing Agreement. For requests about this data, the business customer is your first point of contact. Administrators of an organisation can export its data. The export file is available for download for 7 days and is then deleted.

Administrators of an organisation see a verification log: which members and contacts of the organisation checked whose code, when and with which result. Entries are kept for one year; beacon entries for 90 days.

14. Payments

Paid plans are available only to business customers. Payments are processed by Stripe Payments Europe, Ltd. (Ireland). Stripe also processes data in the USA (section 24). Card data goes directly to Stripe and does not reach us. We receive the payment status and the name and address for the invoice. We keep invoices and booking records as long as commercial and tax law requires (section 25). Legal basis: Art. 6(1)(b) and (c) GDPR.

15. Servers of other operators

Trusted Codes can be connected with servers of other operators, for example an organisation that runs the service itself. If you connect with a person on such a server, or if that person verifies a code from you, we send that server your display name, your profile picture, your public keys and your trust score; for invitations, the e-mail address of the invited person; and your e-mail address, if you enabled this. If you delete your account, we tell these servers that it no longer exists. The other operator is itself the controller for the data on its server. Legal basis: Art. 6(1)(b) GDPR.

16. Public transparency log

So that anyone can check that we do not exchange keys unnoticed, we regularly publish one hash value in a public transparency log (Sigstore Rekor, USA). This value is the root of our record of public keys and of seal fingerprints. It contains no personal data. Entries in this log cannot be removed. Legal basis for creating the record: Art. 6(1)(f) GDPR. Our legitimate interest is that key changes can be verified.

17. Desktop app and connection to AI programs

The desktop app can give AI programs that you choose access to your codes. It does this through a local interface on your computer or through our relay service mcp.trusted.codes. The relay passes requests between the AI program and your desktop app. It stores no content. It keeps connection logs (a user name derived from your e-mail address, IP address and time) for 7 days. We run the relay ourselves on a rented server of Hetzner Online GmbH in Germany.

What the AI program does with the data is determined by its provider. You and that provider are responsible for this. Legal basis for the relay: Art. 6(1)(b) GDPR; for the connection logs: Art. 6(1)(f) GDPR, our legitimate interest in operating the relay securely.

18. Test programme

While the apps are distributed through test programmes, we add your e-mail address to a group at Google Workspace that controls access to the test versions (Google, USA). When you delete your account, the address is removed from this group. Legal basis: Art. 6(1)(b) GDPR.

19. Usage statistics and error reports

In the apps, the portals and on our websites we count with Plausible Analytics which pages and screens are opened. We run Plausible ourselves on a rented server of Hetzner Online GmbH in Nuremberg, Germany. Plausible sets no cookies. The IP address is processed only in memory, to form a hash that changes daily. It is not stored.

We also evaluate events such as the creation of an account or a connection. Some of these evaluations are linked to your account identifier or to a hash of it (pseudonymous data). For internal evaluation we use Metabase, which we run ourselves on the same server in Germany. Only we have access. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to understand and improve the service. You can object (section 27).

If an error occurs, the apps, the portals, the administration console, the desktop app and the website send an error report to Sentry (Functional Software, Inc., USA), EU region in Germany. The report contains the technical trace, the app version, the device model or browser and, where applicable, your account identifier. It contains no e-mail address and no IP address. The website does not use session replay. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to fix errors.

20. Website, hosting and contact form

The website, the pages and interfaces under app.trusted.codes and the portals are hosted by Vercel Inc. (USA). The server functions run in Frankfurt, Germany. Static files are delivered through Vercel's global content delivery network. With each request, Vercel processes request metadata and your IP address. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to deliver the website securely.

If you use the contact form or the waiting list on trusted.codes, we store your name, your e-mail address, the subject and your message in a spreadsheet at Google (Google Sheets, USA), in order to reply to you. We use this only during the test period. The spreadsheet is deleted when the test period ends. Legal basis: Art. 6(1)(b) GDPR if your request concerns a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to answer your request.

21. Cookies and storage on your device

The website sets one cookie, NEXT_LOCALE, when you change the language. It stores this choice for one year. In the portals, your browser stores your session and settings such as the selected organisation in local storage after sign-in. The apps store keys, secrets and sign-in data in the protected key store of the device (Keychain / Keystore) and other data in an encrypted local database. All these entries are strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG).

We deliver fonts and program libraries from our own servers. Your browser does not load anything from third parties for this.

22. E-mails and push notifications

We send e-mails through Resend, Inc. (USA), from its region in Ireland. Push notifications go through Expo (650 Industries, Inc., USA) to the delivery service of Apple or Google (USA). They receive the address or the push token and the content of the message. The apps also receive updates through Expo. For this, the IP address of the device is transmitted. Legal basis: Art. 6(1)(b) GDPR.

23. Recipients and service providers

We use service providers that process data on our behalf. Our database, sign-in, server functions and file storage run at Supabase on Amazon Web Services in Stockholm, Sweden (EU). Supabase Inc. is a US company. The encryption keys are held by Infisical in its EU instance; Infisical receives no user data.

The complete, dated list with purpose, location and data shared is also published at trusted.codes/legal/subprocessors and as Annex 2 of the Data Processing Agreement.

Current as of 2026-10-01

Data is also received by: servers of other operators (section 15); the European Commission, for checking VAT identification numbers (section 13); the public transparency log (section 16, no personal data); and, if you use your own API key, the AI provider you chose (section 12.2). Authorities receive data only if we are legally obliged to provide it.

24. Transfers to third countries

Some recipients are located in the USA or belong to US companies: Supabase (support access), Vercel, Resend, Sentry, OpenAI, Stripe, MaxMind, Expo with Apple and Google push services, Apple and Google sign-in, Google Workspace and Google Sheets. For these transfers we rely on the Standard Contractual Clauses of the European Commission (Decision (EU) 2021/914). You can obtain a copy from privacy@trusted.codes.

25. Retention periods

As a rule, we store data as long as your account exists and delete it when you delete your account. The following periods apply instead:

26. Deleting your account

You can delete your account in the app and in the portal. We then delete your account data. We remove your e-mail address from the test programme group (section 18) and tell the servers of other operators that your account no longer exists (section 15).

After deletion, only the following remain, for the periods in section 25: the records of your legal acceptances, which we need as evidence; invoices and booking records; sign-up and deletion events; and records whose own period has not yet ended. If you answer the optional survey after deletion, we store your answers without your e-mail address. Legal basis for the survey: Art. 6(1)(f) GDPR. Our legitimate interest is to improve the service.

27. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Many of these you can exercise yourself: in the app and in the portal you can export your data and delete your account. The export contains all personal data we store about you, except security material such as keys and tokens and internal notes; it names what it leaves out and how to request it. Otherwise, write to privacy@trusted.codes. We reply within one month and can ask for proof of your identity. For automated decisions, see section 10 (Art. 22 GDPR).

28. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

29. Obligation to provide data

To create an account we need your e-mail address. Without it we cannot provide the service. All other information is optional or arises from your use of the service.

30. Changes to this policy

If the processing changes, we update this policy and publish the new version with its date. We inform you of material changes by e-mail. Earlier versions remain available at their version address.

This version (2026-10-04) is effective from 4 October 2026.