tillthen.space
PricingLog in

Privacy Policy

Information provided pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR) and the Italian Data Protection Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018).

1. Controller

Switch, Hauptstrasse 68, 39018 Terlan (BZ), Italy
Email: info@tillthen.space

2. Overview of processing

tillthen.space ("we") lets you leave an encrypted message ("vault") that gets delivered by email at a time you choose. To provide this service, we process:

  • Sender and recipient email addresses
  • The message content -- stored encrypted with us, decrypted only at the moment of delivery
  • The scheduled delivery time
  • Your IP address, briefly, to protect against abuse when creating vaults
  • For paid vaults: payment data, processed exclusively by our payment provider Stripe -- we never see or store card details
  • A 1x1 pixel in delivery emails that gives us an approximate signal of whether a message was likely opened -- many mail apps block this automatically, the signal isn't reliable

3. Purposes and legal basis

We process this data to perform the contract with you (Art. 6(1)(b) GDPR) and to protect against abuse, e.g. via rate limiting, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

4. Recipients and processors

To provide the service, we use the following providers:

  • Supabase -- database, authentication, backend hosting
  • Stripe -- payment processing for paid vaults
  • n8n, self-hosted by us -- email delivery
  • Umami, self-hosted by us -- website usage analytics

5. Transfers to third countries

Our payment provider Stripe may transfer data to the United States. Where this happens, we rely on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) as an appropriate safeguard.

6. Retention

Vault content stays stored until it's deleted -- by the sender themselves, or, if enabled at creation, only after the recipient confirms. Accounts can be deleted at any time on request.

7. Cookies

We only use strictly necessary cookies: for your login session and your language preference. Under Art. 122 of the Italian Data Protection Code and the Garante's cookie guidelines, no consent is required for purely technical cookies. No advertising cookies.

8. Analytics

We use Umami, a self-hosted, cookie-free analytics tool, to understand how tillthen.space is used (e.g. page views). Umami doesn't set cookies and doesn't build a profile of individual users -- the data collected is aggregated and not directly attributable to a person. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR).

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15-22 GDPR). You can also lodge a complaint with the competent supervisory authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

Contact for requests: info@tillthen.space