Privacy policy

Last updated: 16 August 2026

artifacted stores as little about you as it can get away with. This page lists everything we keep, why we keep it, and how to get it deleted — in plain language.

Who is responsible

artifacted is operated by zukunft company UG (haftungsbeschränkt), vertreten durch Alexandros Avlastimidis, Germany — full provider details are on the imprint page. For anything privacy-related, email contact@artifacted.cloud.

What we store, and why

• Your account. When you sign in — with Google or Microsoft — we receive your email address and name — nothing else. We use them to identify your account and to show app owners who has access to their apps. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR).
• Your apps. The code you deploy is stored in its sandbox on Cloudflare's network so we can run it and serve it back. Legal basis: contract (Art. 6(1)(b) GDPR).
• Data your apps store. Apps can save small pieces of data (votes, lists, tallies) through their built-in storage — shared, or kept per person. That data lives in a small store of its own on Cloudflare's network, reachable only through the same access check as the app itself, and is deleted when the app is deleted. Legal basis: contract (Art. 6(1)(b) GDPR).
• Files your apps store. Apps can also save files — images, exports, attachments — up to 25 MB per file and 500 MB per app. The bytes are stored on Cloudflare's network behind the same access check as the app itself: visible only to people the app is shared with, never publicly addressable, and deleted when the app is deleted. Legal basis: contract (Art. 6(1)(b) GDPR).
• Databases your apps keep. Apps can also keep a small SQL database — one per app, or one per person when the app is set that way — on Cloudflare's network. The same access check as the app itself gates every query, and the database is deleted when the app is deleted. Legal basis: contract (Art. 6(1)(b) GDPR).
• Visit events. Because every app is private, we check who is asking on every request — and we record who opened which app, and when (sampled to at most one entry per visitor, app, and hour). These records power the access checks, the usage statistics app owners see, and our own understanding of whether artifacted is useful. Legal basis: our legitimate interest in running a private-by-default service securely and improving it (Art. 6(1)(f) GDPR).
• Sharing records. Which emails or company domains an app is shared with, so we can enforce access. Legal basis: contract (Art. 6(1)(b) GDPR).
• Secrets. API keys you add for your apps are stored only in Cloudflare's encrypted secret store and injected into your app at runtime. Our database stores the key names only — never the values. Secret values never appear in our logs, API responses, or dashboard.

What we don't do

No advertising, no selling or renting data, no third-party analytics or tracking scripts. The only cookies we set are the session cookie that keeps you signed in and a few short-lived cookies that exist only during the sign-in handshake. All of them are strictly necessary to provide the service you asked for — the § 25 Abs. 2 TDDDG exemption — which is why there is no cookie banner: there is nothing optional to consent to. Our usage statistics are first-party records on our own servers (sampled to at most one entry per visitor, app, and hour), with no third-party trackers and nothing extra stored on your device.

Who else processes your data

• Cloudflare — hosting, database, file storage, and secret store. Everything artifacted runs on lives on Cloudflare's global network. Cloudflare is a US company; transfers are covered by the EU-U.S. Data Privacy Framework and the EU standard contractual clauses in Cloudflare's data processing addendum. An app can be created with "Store data in the EU": that app's saved data and uploaded files are then stored in the EU — requests are still executed at Cloudflare's nearest edge location, and platform account data (sign-in, sessions, sharing, usage records) is stored globally.
• Google / Microsoft — sign-in only. Your sign-in provider tells us your email address and name when you sign in; we send nothing about your usage back to them.
• Resend — transactional email. Invitations, access requests, plan reminders, account and workspace notices from our staff, and app notification emails are sent through Resend, which processes the recipient's email address only.
• Paddle — payments. When you buy a plan online, the checkout and invoicing run through Paddle as merchant of record: Paddle processes your payment and billing details, which never touch our servers.
• WorkOS — enterprise sign-in and directory sync. When your organization signs its people in through its own identity provider (Okta, Entra ID, Google Workspace), the sign-in runs through WorkOS, which tells us your work email address. If your organization also switches on directory sync, we process its directory data — names, work email addresses, group names, and whether a person is active — on your organization's instruction: to switch off access the moment the directory does, and to let apps be shared with its groups. We never write back to the directory.

That is the whole list. By design, nothing else phones home — and the apps people deploy can't quietly send data elsewhere either: every request an app makes to the outside world passes our egress check, and new apps start with outside requests blocked until their owner allows specific hosts.

How long we keep things

Account data, apps, their saved data, files, databases, and sharing records are kept for as long as your account exists. Usage records (who opened which app, and when) outlive the app they belong to: deleting an app stops new records immediately, but the existing ones are kept — they are how app owners see usage over time and how we understand whether artifacted is useful. They are not kept forever: records of apps in a workspace are deleted after the retention window the workspace's admins choose (30, 90, or 365 days; 365 is the default), and every other usage record — personal apps, sign-ins — is deleted after 365 days at the latest. A nightly job enforces both. The activity views app owners see read at most the last 90 days. Delete your account (email us) and we remove your account data, your apps, their saved data, files, databases and secrets, and the usage records tied to your email.

Your rights

Under the GDPR you can ask us for a copy of your data (access, Art. 15), ask us to correct or delete it (Art. 16 and 17), restrict or object to processing (Art. 18 and 21), and take your data elsewhere (portability, Art. 20). Much of that is built in: every app's owner can export everything the platform holds for that app — code, saved data, files, and databases — as one download, which answers access and portability for your apps, and deleting an app removes its data, files, databases, and secrets. For everything else — a full copy, corrections, or deleting your account — email contact@artifacted.cloud and we'll handle it — no forms, no hoops. You can also complain to a data protection supervisory authority; in Germany that is the authority of your federal state.