Legal
Privacy
Written from what the code actually does, not from a template. Where something is still unresolved it says so.
Who is responsible
Kevin Lenhart, Forstrasse 10, 76756 Bellheim, Germany — the controller for everything described here. Questions, or any of the requests below: info@theshortcutagency.de. The full details are in the imprint.
What we store, and why
An email address and a password, to let you sign in. A profile, and whatever you write in it. Your posts, replies, projects and milestones — the product exists to publish those, and they are public by design. Bookmarks, notifications, direct messages and block lists, which are readable only by the account they belong to, enforced by a check in every backend function rather than by the interface hiding a button.
What we deliberately don't store
No IP addresses, no device fingerprints, no advertising identifiers, no location beyond the one you type into your profile yourself, and no record of what you looked at. There is no field in the database that could hold any of it. The feed is ranked by likes, replies and recency — public numbers — not by watching you. No analytics, no advertising, no third-party tracking, which is why there is no cookie banner: the only cookies are the three that keep you signed in.
Who else sees it
Three companies, and no others. Convex runs the database. Vercel serves the site and, like any web host, records requests including IP addresses. Resend sends password reset codes, and only if you ask for one. Each has its own suppliers; Convex publishes that list, and we keep our own record of all of it.
Where it lives
The site runs in Frankfurt. The database does not: it is a Convex deployment in the United States, so your email address, posts and messages are stored and processed there. That transfer runs on the European Commission's Standard Contractual Clauses, and Irish law governs it. Convex's EU region costs more than PublikMate currently earns, so the plan is to move as soon as it does — and to say so here rather than leave you to guess.
How long
Your posts and profile stay until you remove them. Notifications are deleted after ninety days, and reports once they have been dealt with. Nothing is kept simply because deleting it was never implemented.
What you can do
Download everything you wrote as one file, at any time, from Settings. Correct anything in your profile from the same place. Delete the account and it is a real delete — profile, posts, replies, projects, messages, images and login, removed row by row rather than hidden. Posts other people wrote inside your projects stay theirs. You can also ask us for any of this by email, and you can complain to a data protection authority — for us that would be the one for the state we are registered in.
Still open. Which of Convex's suppliers can reach the contents of our database rather than only their own records about us; how long a deleted row survives in their backups; and where Vercel processes its request logs. We are asking, and this page changes when we know. Saying so is more useful than a sentence claiming everything is settled.
Back to PublikMate