Privacy policy

What we store, who processes it, and what you can ask of us.

Last updated: 17 October 2026

Controller

Nearay GmbH is the controller for the processing of personal data on this website and in the Lotse console. Address, representation and contact details are in the imprint. For questions about data protection, write to info@nearay.com.

Two roles, kept apart

Lotse is a platform that other companies build into their apps. That gives us two different roles, and this policy keeps them apart:

  • For this website and for our customers’ console accounts we are the controller. That is what the sections below are about.
  • For the data the Lotse SDK collects inside our customers’ apps we are a processor under Article 28 GDPR. The controller there is the operator of that app: they decide on purposes and means, we only act on their instructions. If you are a user of an app that uses Lotse, the privacy policy of that app applies to you, not this one. A data processing agreement is concluded on request.

Visiting this website

lotse.dev is made of static files. No cookies are set, nothing is loaded from third parties, the typeface is served from our own server, and there is no audience measurement. When you open a page, your browser transmits technically necessary data that our host records in server logs: IP address, time, requested address, amount of data transferred, status code, referrer and browser identification. These logs serve the operation of the site and the defence against attacks, are not combined with other data, and are deleted monthly. The legal basis is our legitimate interest in secure operation, Article 6(1)(f) GDPR.

Console account

Anyone registering at console.lotse.dev provides an e-mail address and a password. We store the e-mail address, the password only as a cryptographic hash, times of sign-in and sign-out, and session and refresh tokens. To fend off automated attacks we store the IP address, the e-mail address entered and the time of failed sign-in attempts and of password reset requests. To limit the number of registration and recovery e-mails we also store, for every registration started, a salted hash of the e-mail address entered and, for every registration or password reset started, a salted hash of your IP address (for IPv6, of its /64 range), each with the time. A successful sign-in deletes the failed attempts for that e-mail address; all other entries are deleted after 24 hours, as are unconfirmed registrations and password reset requests. The legal basis is the performance of the contract, Article 6(1)(b) GDPR, and for abuse prevention Article 6(1)(f) GDPR. Members of a project see the e-mail addresses of its owner and of its other members.

Registration e-mails

Confirmation and recovery codes are sent through Brevo, a service of Sendinblue SAS, based in France. Your e-mail address and the content of the message are transmitted to Brevo, which records them in its delivery logs. We do not write the codes themselves to any log. The legal basis is Article 6(1)(b) GDPR.

Project invitations

The owner of a project can invite other people into it by e-mail address. For each invitation we store the address, the time and a hash of the link in the invitation mail. The invitation is deleted when it is accepted, taken back or replaced; an invitation nobody accepts expires after seven days and is deleted within one more day. The mail is sent through Brevo as described above, and neither the address nor the link is written to our logs. Whoever accepts needs a console account with that address, see “Console account”. The owner sees the addresses of open invitations. The legal basis for the invited person is the legitimate interest of the owner and of us in working on a project together, Article 6(1)(f) GDPR.

Paid plans and payment

Paid plans are sold through Paddle. If you take out a paid plan for a project, Paddle sells it to you as the merchant of record: Paddle.com Market Limited, United Kingdom, and its affiliates. Paddle receives the data you enter at checkout, such as name, billing address, VAT ID, e-mail address and payment details, and processes it as an independent controller under its own privacy policy; we never see your payment details. When we prepare the checkout, we transmit your e-mail address and the number of the project it is for to Paddle. From Paddle we receive what we need to run the plan: the Paddle customer and subscription numbers, the plan and billing interval, the status and the end of the period. Paddle sends invoices, receipts and payment reminders to you directly. Where Paddle transfers data outside the European Union, it relies on the safeguards of data protection law, such as an adequacy decision or standard contractual clauses. The legal basis is the performance of the contract, Article 6(1)(b) GDPR, and for tax obligations Article 6(1)(c) GDPR. As long as you do not take out a paid plan, no data goes to Paddle.

Error tracking in the console

We use Sentry in the console to find and fix programming errors. When an error occurs, an error report is transmitted to Sentry containing technical details of your browser and operating system, the address called, the time, the steps that preceded it, a pseudonymised identifier of your account (a shortened hash, not your e-mail address) and your IP address. Programming errors on the server are reported to Sentry as well, with the same pseudonymised identifier and without the content of the request. We use the European region of the service, so the data is processed in the European Union. The provider is a company based in the United States, so access from a third country cannot be ruled out entirely. A data processing agreement including the European Commission’s standard contractual clauses is in place. The legal basis is our legitimate interest in a working and secure application, Article 6(1)(f) GDPR. There is no error tracking on this website.

Storage of images and documents

Images and documents uploaded to Lotse are stored with Cloudflare R2. The storage location is restricted to the European Union. The provider is a company based in the United States; as with the service above, a data processing agreement including the standard contractual clauses is in place. The legal basis is Article 6(1)(b) GDPR where the storage serves the performance of the contract, and Article 28 GDPR where we act on behalf of our customers. The nightly, encrypted backups of our database are also kept with Cloudflare R2 in the European Union; each backup is deleted after 14 days.

Push notifications

Push notifications to Android devices are delivered through Firebase Cloud Messaging by Google. The device token and the content of the message are transmitted to Google; there is no other way to reach an Android device. Push notifications to iOS devices are delivered through the Apple Push Notification service by Apple Inc. when the app operator has stored an APNs key with us, otherwise through Firebase Cloud Messaging, which passes them on to Apple. The device token and the content of the message are transmitted to Apple; there is no other way to reach an iOS device. Data may be transferred to the United States in the process. This processing takes place in our role as a processor for the respective app operator.

Access by AI agents

Members of a project can create an access token in the console that lets an AI agent of their choice, such as Claude Code, Cursor, VS Code or Codex, read the data of that project and, if the token permits it, make limited changes such as creating links or replying to feedback. The transfer to the agent and to the provider of the AI model it uses is initiated by the app operator and takes place on their instruction. We do not operate any AI ourselves and do not commission one; the choice of provider and the agreement with it are up to the app operator. Screenshots, replays, heatmap images and the e-mail address of a feedback message are not available to agents, nor are installation identifiers, push tokens, or the hashed IP addresses and user agents of link clicks. Data the app transmits to us, such as user identifiers, attributes, event properties and feedback with its metadata, is passed to the agent as it was transmitted. We store tokens only as a cryptographic hash, together with their name, permission level, creator, expiry and time of last use. For each call we log the name of the tool, the project, the identifier of the token, the duration and the outcome, never the token or the content of the call; these logs are deleted like the other operational server logs. In the console, a reply to feedback sent through an agent is shown under the name of the member who created the token. The legal basis for the token and its use is Article 6(1)(b) GDPR; for the data of the project we act as a processor for the app operator under Article 28 GDPR.

Webhooks

The owner of a project can set up webhooks in the console. Lotse then transmits the events the owner selected, with their content, to the address the owner specified, for example the text of a feedback message, an e-mail address given voluntarily, user and installation identifiers or attributes. The transfer is initiated by the app operator and takes place on their instruction; the app operator is responsible for the processing at the receiving end. Push tokens, the access credentials of installations, and the hashed IP addresses, identifiers and browser identifications of link clicks are never transmitted; screenshots and replays only as a link into the console. We keep the content of an event for seven days and the delivery log for 30 days. For this data we act as a processor for the app operator under Article 28 GDPR.

Hosting

Server and database run at IONOS SE in a data centre in Germany. There is one instance and one database; nothing is replicated to other regions. A data processing agreement with the host is in place.

What the SDK collects inside our customers’ apps

This processing is carried out for the respective app operator, not for us. For completeness it is listed here; there is more detail on our page “Data and privacy”:

  • a random installation identifier created on first start, not derived from the hardware
  • platform, operating system version, device language and version of the app
  • on Android, the Play Store install referrer, once
  • the push token, if notifications were allowed
  • the events the app reports, with the properties it passes
  • events the SDK reports on its own: every app start with a random session identifier, version changes of the app, the opening of a push notification, the opening of the app through a short link, the display, tap and dismissal of an in-app message and, if the app sets it up, the name of every screen shown
  • the time of first and last contact, the result of matching the install to a link, and the delivery status of every push notification
  • if the app identifies its user: the user ID the app operator assigns and the attributes the app passes with it, stored as given
  • for feedback, the text, the category, an e-mail address given voluntarily, the app version, the last screen shown, additional details the app passes, and a screenshot that is only created on an explicit user action and can be reviewed and discarded before sending; the console shows the events right before it alongside
  • messages in conversations and in the support chat, and votes on a feature board, if the app uses these functions
  • when a short link is opened: time, browser identification, platform, a salted hash of the IP address, and an identifier made of platform, language and a shortened IP range. The full IP address is not stored.

What we do not collect

No advertising identifiers (IDFA, GAID), no location, no contacts, no device name and no list of installed apps. We do not sell data and do not pass it on to advertising networks.

Retention

Account data is stored as long as the account exists. The data of a project is stored as long as the project exists; deleting it also deletes the associated devices, events, feedback and clicks. There are currently no fixed deletion periods for individual records. Projects and single feedback messages can be deleted in the console; during the beta we delete individual devices and user data on request. Operational server logs are deleted after 30 days. Deleted data remains in the encrypted backups for up to 14 days.

Your rights

You have the right to information about the data stored about you, to rectification, to erasure, to restriction of processing, to data portability, and the right to object to processing based on legitimate interests. You can withdraw consent at any time with effect for the future. Write to the address given above. If your request concerns data from an app that uses Lotse, we will forward it to the app operator responsible. Independently of that, you may lodge a complaint with a data protection supervisory authority; the one responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information.

Changes to this policy

If the way we process data changes, we change this policy. The date above tells you when that last happened.