Privacy Policy

By using any service provided by Heimdall.pm, you are agreeing to the following Privacy Policy. Please also review our Terms of Service.

TL;DR

You're in control of your data. We collect as little data as possible and won't share it with anyone unless required by the law. Don't trust anyone; always encrypt your stuff and follow basic OPSEC.

The data we collect

We collect and store only the data you explicitely choose to give us when using any of the services provided by Heimdall.pm. All data is collected independently by each service for the sole purpose of its operation.

Examples of collected data include: e-mail addresses, usernames, passwords, profile pictures, messages, etc. Metadata such as IP addresses, browser fingerprints and (most) logs, however, are not retained by our servers.

How it's handled

Your data isn't and will never be shared with anyone, unless required by law enforcement. It is securely stored on a dedicated server with hardware RAID-1 (data mirroring), FreeBSD's GELI (full disk encryption) and ZFS (file system with advanced data protection features). See About for more info.

Please be aware that most (if not all) Full Disk Encryption implementations are vulnerable to cold boot attacks, and the one used by our server is no exception. This means that any sufficiently skilled attacker with physical access to the server and enough time could, in theory, retrieve the decryption key of our disks and read their content. See the next section for possible mitigations.

Furthermore, we create encrypted backups of (most) of the servers' data every two days, which are then sent to "cold" data storage in my homelab (again, see About). These backups are retained for a week and will only be decrypted in the event of a data loss, in which case the decryption process will happen directly on the affected server.

What you can do about it

As with anything, you shouldn't blindly trust us with your data. Partly because we could very well be lying about the things we do (we don't), but also because nothing is ever 100% secure, even more so with a government-type threat model.

As such, we strongly recommend you to limit the overall data we may have access to, by the use of darknets (Tor, I2P) to hide your IP address, client-side encryption (GPG, AGE, OMEMO, etc…) to obfuscate sensitive data, and just basic OPSEC where appropriate.

You are also given the right to erasure by being able to completely delete all data linked to your account directly on the dashboard. Additionally, you may have access to an archive containing all this data by sending us an e-mail (see Contact). This process wil be made available on the dashboard in the (hopefully near) future.

Changes to this document

Any significant change to this document (that is, changes that directly affect you, the end user) will be followed by a mail sent to your e-mail address.

If you don't actively own a Heimdall.pm account, we advise you to regularly check this privacy policy for future changes.