Privacy Policy

Data Controller

Privacy by Architecture

oh·my·doc uses a zero-knowledge, end-to-end encrypted architecture. All documents, metadata, file names, tags, and search indices are encrypted on your device before being sent to our server. The server stores only opaque ciphertext. We cannot read, analyze, or share your documents — technically impossible by design.

Data We Collect

• Email address — for account creation and authentication.
• Encrypted data blobs — your documents, metadata, and indices stored as ciphertext that we cannot decrypt.
• Technical data — IP address, timestamps, and storage usage for operating the service.

Hosting

Our servers are hosted by netcup GmbH in Germany. All data is stored exclusively on servers located in Germany and is subject to German and European data protection law (GDPR). No data is transferred to third countries.

Payment Processing

For paid subscriptions, we use Stripe, Inc. as our payment processor. When you subscribe to a paid plan, your payment information (credit card number, billing address) is collected and processed directly by Stripe. We do not store your full payment details on our servers. Stripe's privacy policy applies to data processed by them.

Cookies

We only use technically necessary cookies. These include session cookies for authentication, a language preference cookie, and security tokens (CSRF). We do not use any analytics, tracking, or marketing cookies. No consent banner is needed because we don't track you.

Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• · Right of access — request a copy of your personal data.
• · Right to rectification — correct inaccurate data.
• · Right to erasure — request deletion of your account and all associated data.
• · Right to data portability — export your data in a machine-readable format.
• · Right to object — object to certain processing of your data.
• · Right to lodge a complaint with a supervisory authority.

Contact for Privacy Inquiries

For any questions regarding your data or to exercise your rights, contact us at: