Features How it works Security Platforms Pricing FAQ
DE EN
Get Aetherly

Privacy Policy

1. Data Controller

DuyTec GmbH

Im Meerbachbogen 8

31582 Nienburg, Germany

Email: [email protected]

Managing Director: Yasin Sapmaz

2. Legal Basis for Processing

a) Account Data (email, hashed password)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Purpose: Authentication, password reset, and transactional notifications.

b) Signaling Data (connection establishment between devices)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Purpose: Establishing peer-to-peer connections. File contents are not transmitted through our servers.

c) Payment Data (via Stripe)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Purpose: Processing paid subscriptions. Credit card data is processed exclusively by Stripe.

d) Transfer Error Reports

Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Purpose: Troubleshooting failed transfers. One record is opened for every accepted transfer, and each side fills in its own record independently. We store the account and device identifier of each side, the transfer identifier, which side of the transfer the record speaks for, a failure reason and its severity level, an error code and an error class, the platform and app version, and the associated timestamps. No file names and no file contents are stored.

e) Visibility Setting

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Purpose: The online-or-invisible setting you choose in the app is stored on our server so that it applies across every device on your account. Only the current value is stored; no history is kept.

f) Transfer Timeline

For every transfer our server records the steps it can see itself: requested, offered to the receiver’s devices, accepted, declined, cancelled, expired, finished and confirmed by the receiver, and which device took each step. Each step carries the time, the account and device identifiers of both sides, and the platform and app version of the device that took it. No file names, no folder paths and no file contents are recorded.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Purpose: finding out where a transfer went wrong. Retention: 180 days.

g) Information Your App Sends with Each Request

With every request to our server, the app sends its platform (Windows, iOS or Android), its app version, its build number, its release channel and, for iOS app extensions, which part of the app is asking. We store the latest values on the record of your device and change them only when they change.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Purpose: compatibility, minimum-version checks and troubleshooting. This information is needed to provide the service you asked for, so no consent is required for it. Retention: as long as the device is registered to your account.

h) Transfer Journals (Error Reports)

Only if you have switched on "Send error reports" on that device, or if you send one report yourself (see "File didn’t arrive?" below), the app sends us the journal of one transfer. A journal contains:

  • the steps of that transfer and their timing, as seen by that device;
  • how the two devices were connected (direct or local network) and whether the device’s network changed during the transfer;
  • for each file only its position number, its file type extension (such as .jpg), its size, the result of the integrity check (hash state) and the storage area it was saved to (place) — for at most 500 files per transfer;
  • up to 50 short lines of the app’s own log for that transfer. Our server refuses a journal that contains a file or folder path in any of these lines, instead of storing it.

A journal never contains file names, folder paths or file contents.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent). Retention: 90 days from receipt.

i) Crash Reports

Only if you have switched on "Send crash reports" on that device, the app sends us a report when it crashes. A crash report is metadata only: the app version and build, the part of the app that crashed, the kind of crash, the exception type or signal, and up to 32 entries naming the program functions that were running (symbol names, never source paths). A crash report never contains memory dumps, memory contents, file names, file contents or messages.

This is in addition to Firebase Crashlytics on Android, which section 10 already describes.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent). Retention: 90 days from receipt.

j) "Report a problem"

When you use "Report a problem", the app sends a category you choose (transfer, connection, account, billing, notifications or other) and, if you write one, a free-text description of up to 2000 characters. The report itself (category, time, the device and account it came from, and the transfer it concerns, if any) is kept for 180 days. The text you wrote is kept separately for 90 days.

Legal basis: Art. 6(1)(a) GDPR (consent). Sending the report is your consent for that one report; neither diagnostics switch needs to be on.

k) "File didn’t arrive?"

When you tap "File didn’t arrive?" for a transfer, your device sends its own journal of that transfer once. Tapping the button is your consent for that one report; neither switch needs to be on. The device on the other side of the transfer belongs to someone else, so it contributes its journal only if its own user has switched on "Send error reports" on that device. Your tap never makes another person’s device send anything.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent of the user of each device).

l) Your Consent: Per Device, Versioned, Withdrawable

  • Both switches ("Send error reports" and "Send crash reports") are off until you turn them on.
  • They apply to one device only; each of your devices asks separately.
  • We record each decision with the version of the consent text you answered (currently version 2026-10), the time and the device. This record is kept as long as the device is registered to your account and is deleted with the device or the account (Art. 6(1)(c) GDPR, proof of consent, Art. 7(1) GDPR).
  • You can change both switches at any time in Settings → Privacy.
  • When you switch one off, we delete that device’s journals or crash reports that we have already received.

m) Where This Data Is Stored

Journals, crash reports and the text of problem reports are stored on our server in Germany in a separate diagnostics database. This database is not part of our backups, so the data is really gone when it is deleted after 90 days, after a withdrawal or with your account.

3. Data Retention

Account data: Until the user deletes their account.

Signaling data: Only for the duration of connection establishment, no permanent storage.

Payment data: In accordance with statutory retention periods (6 years per HGB, 10 years per AO).

Server logs: Maximum 30 days, for error analysis.

Transfer error reports: 90 days from creation; a daily sweep then deletes them automatically.

Transfer timeline: 180 days.

Problem reports and "File didn’t arrive?" reports (without the text): 180 days.

Server-detected transfer anomalies and diagnostics requests to a device: 180 days.

Transfer journals: 90 days from receipt.

Crash reports: 90 days from receipt.

Text of a problem report: 90 days from receipt.

Consent decisions per device: as long as the device is registered to your account.

App information sent with requests: as long as the device is registered to your account.

A daily sweep deletes expired diagnostics entries automatically. Deleting your account deletes all of this diagnostics data.

Visibility setting: Until you change it or delete your account.

4. Your Rights

You have the following rights regarding your personal data:

1. Right of access (Art. 15 GDPR)

2. Right to rectification (Art. 16 GDPR)

3. Right to erasure (Art. 17 GDPR)

4. Right to restriction of processing (Art. 18 GDPR)

5. Right to data portability (Art. 20 GDPR)

6. Right to object (Art. 21 GDPR)

7. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, contact us at: [email protected]

5. Supervisory Authority

Die Landesbeauftragte für den Datenschutz Niedersachsen

Prinzenstraße 5

30159 Hannover, Germany

Phone: +49 511 120-4500

Email: [email protected]

6. Payment Processing (Stripe)

We use Stripe (Stripe Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA) for payment processing. When you subscribe to a paid plan, your payment data is processed directly by Stripe. We do not store credit card numbers or payment details on our servers. You can find Stripe’s privacy policy at: https://stripe.com/privacy

7. Hosting

This website and the Aetherly server are hosted by netcup GmbH on a server in a data centre in Nuremberg, Germany. Some of the service providers named in sections 6 and 10 also process data outside the European Union, as described there.

9. Sign in with Google or Apple

Instead of an email address and password, you can sign in to Aetherly with your Google account or your Apple ID. Using this is voluntary. The providers are Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Apple Distribution International Ltd. (Hollyhill Industrial Estate, Cork, Ireland).

a) What data we receive

From Google we request only the "openid", "email" and "profile" scopes; from Apple only "name" and "email". Through these we receive your email address, whether the provider has verified it, your name, and a permanent identifier of your account with the provider. From Apple we may receive a private relay address ("Hide My Email"). We get no access to your password, contacts, files, emails or any other content of your Google or Apple account.

b) How we use the data

Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Purpose: creating your Aetherly account and signing you in. The email address serves as your account address and for transactional notifications; the name becomes your profile name, which your confirmed contacts can see. The provider identifier links future sign-ins to your account. We do not use this data for advertising, for profiling, or to train models.

c) Storage and sharing

We store the provider, the provider identifier, the email address and its verification status, for Apple whether it is a relay address and whether mail forwarding to that relay address is switched off, and when the link was created and last used. We do not store Google tokens of any kind. From Apple we store an encrypted token whose only purpose is to revoke the link with Apple when you delete your account. The data is kept on our server in Germany and is not sold or shared with third parties.

d) Retention and deletion

The data is kept until you disconnect the provider in the app under Settings > "Sign-in & security" or delete your account. Disconnecting deletes the link immediately. Deleting your account revokes the link with Apple at once and deletes every link at the end of the 30-day deletion period that begins with your deletion request. You can also withdraw your consent with Google at any time at https://myaccount.google.com/connections and with Apple in your Apple ID settings under "Sign in with Apple".

Aetherly’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

10. Other Service Providers in the Apps

We use the following service providers for individual app features. They process data on our behalf (Art. 28 GDPR) and only for the stated purpose.

Push notifications: Firebase Cloud Messaging (Google Ireland Limited) on Android and the Apple Push Notification service (Apple Distribution International Ltd.) on iOS. A device token and the content of the notification, e.g. an incoming transfer request, are processed. Legal basis: Art. 6(1)(b) GDPR.

Crash reports (Android only): Firebase Crashlytics (Google Ireland Limited). Crash reports are sent only if you have agreed to this in the app; you can withdraw at any time in the settings. Technical details of the crash, device model, operating system and app version, and an installation identifier are processed. Legal basis: Art. 6(1)(a) GDPR (consent).

In-app subscriptions (iOS and Android): RevenueCat, Inc. (USA) manages purchases made through the App Store and Google Play. Your Aetherly account identifier and the store’s purchase and subscription data are processed. RevenueCat does not receive payment details. Legal basis: Art. 6(1)(b) GDPR.

Email delivery: Resend, Inc. (USA) sends our transactional emails, e.g. to confirm your email address or reset your password. Your email address and the content of the email are processed. Legal basis: Art. 6(1)(b) GDPR.

Content delivery and TLS: Cloudflare, Inc. (USA) acts as content delivery network and TLS proxy for every request to the website and to the Aetherly server. Your IP address and technical request data (e.g. the requested address, the time and the browser or app version) are processed. The files you transfer do not pass through Cloudflare, because transfers run directly between the devices. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in the security and availability of the service).

Where data is transferred to the USA, this is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses.

Last updated: 2026-10-18