What we process, and what we don't

1. Controller

David Baader, Heidkamp 1, 22399 Hamburg.
Email: hallo@aszendra.com

2. This website

Server logs

The website is hosted by Cloudflare Germany GmbH. Requests produce technical logs that may contain the IP address, timestamp, requested address, user agent and referrer. They serve secure operation and attack defence only.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in undisturbed, secure operation.
Retention: Cloudflare keeps these logs for a few days by default. We do not access them and do not combine them with anything.

Processing on our behalf

A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Transfers to third countries are covered by the EU Commission's standard contractual clauses.

Cookies and analytics

None. This website sets no cookies, stores nothing in your browser, and embeds no fonts, maps, videos or scripts from third-party servers.

Download counting

When an installer is fetched, we count the event with the platform, version, date and whether it was an automatic update. No IP address, no user agent and no identifier is stored, and the numbers cannot be attributed to a person. We know there were 850 downloads on a given day, and never by whom.

Legal basis: Art. 6(1)(f) GDPR — interest in knowing whether and which versions are in use.

Contact form and email

If you write to us via the contact form or by email, we process the details you provide in order to answer your enquiry. For the form, that is your name, email address, topic and message.

The form is received by a small program at Cloudflare and forwarded as an email to our mailbox; it is not stored along the way. Your IP address is used only briefly to slow down mass submissions and is then discarded.

Cloudflare forwards messages to addresses at aszendra.com to our mailbox at Google Mail (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). They stay there until we delete them. This may involve a transfer to the USA, which is covered by the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for contractual matters.
Retention: Messages are deleted once the enquiry is settled and no retention obligation applies.

Donations via PayPal

The “Support us” page contains an ordinary link to PayPal. As long as you don't click it, nothing is transmitted to PayPal. If you donate, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, processes the payment as an independent controller.

From PayPal we receive your name, your email address, the amount and a message if you write one. We use these details only to process the donation and for our bookkeeping.

Legal basis: Art. 6(1)(b) and (c) GDPR.
Retention: As long as statutory retention obligations require.

3. The Aszendra browser

What stays on your device

History, bookmarks, cookies, settings, open tabs, remembered site icons and the encrypted password vault are stored locally only. We have no access to them and there is no sync.

The update check

At most every four hours, Aszendra fetches a file from dl.aszendra.com stating which version is the newest. This transmits what every HTTPS request transmits — IP address and timestamp — plus the installed version, the platform and the chosen channel.

Not transmitted: any installation or device identifier, pages visited, settings, or any content whatsoever. Even the staged rollout of new versions works without an identifier: your machine rolls a number for it locally and never sends it.

Legal basis: Art. 6(1)(f) GDPR — distributing security updates. The check can be switched off entirely in settings.

Lists for the ad blocker and scam protection

The ad blocker fetches its filter lists from easylist.to at most once a day, plus replacement scripts from raw.githubusercontent.com (GitHub). Protection against dangerous sites downloads two domain lists from malware-filter.gitlab.io (GitLab) twice a day. These requests transmit what every HTTPS request transmits — IP address and time — and nothing else.

Whether a site is on a list is checked on your computer. Nobody learns which sites you open — unlike services to which a browser sends addresses, or parts of them, for checking. If you turn off protection against dangerous sites in the settings, Aszendra stops fetching its lists. The providers' privacy terms apply to these requests.

Password check

Only when you click “Check passwords” in the passwords window does Aszendra ask api.pwnedpasswords.com (Have I Been Pwned) whether your passwords appear in known data breaches. Neither passwords nor usernames are sent — only the first five characters of each password's SHA-1 hash. What comes back is a list of hundreds of hashes sharing that prefix, padded with dummies; whether yours is among them is determined on your computer. Reused and too-short passwords are detected without any connection at all.

Legal basis: Art. 6(1)(b) GDPR — you requested the check. Have I Been Pwned's terms apply.

Spell checking

On macOS the system checks spelling itself. On Windows and Linux, Aszendra downloads a dictionary from a Google server (redirector.gvt1.com) for each language you select for spell checking — just as Chrome does. This transmits IP address, time and, from the address, the language — but not what you type: the check runs on your computer.

Translation

Pages are translated on your device. The text of a page is not sent to anyone, including us.

Only the first time you translate in a given direction, and after you click to do so, Aszendra downloads a language pack from dl.aszendra.com. This transmits what every HTTPS request transmits — IP address and timestamp — and, from the pack's address, the language pair. We do not count or analyse these downloads. The packs themselves come from Mozilla; its servers learn nothing about it.

Legal basis: Art. 6(1)(b) GDPR — you requested the translation.

Extensions from the Chrome Web Store

When you install an extension from the Chrome Web Store, Aszendra downloads it from Google. As long as store extensions are installed, Aszendra asks Google every few hours whether newer versions exist, sending the IDs and versions of those extensions, as Chrome does. Without a store extension there is no such request. Google's privacy policy applies to these connections.

Feedback from the browser

“Feedback senden” only opens your mail app with a prepared message containing the version, channel and system. Aszendra itself sends nothing; what reaches us is decided by you when you press send.

Crash reports

Are only sent with your consent. After a crash, Aszendra asks on the next start whether it may send a report and shows exactly what it contains: version, channel, platform, system version, which process crashed, the reason and the time (rounded to the hour) — plus a note if you write one. No addresses, no page content, no memory dump, no identifier.

The report goes to dl.aszendra.com and is stored there without the IP address. The IP address is only used for a short abuse brake (at most five reports per minute) and is not stored. Legal basis: Art. 6(1)(a) GDPR — your consent, given by pressing “Senden”.

Connections you initiate yourself

Opening a website and a search query to the configured search engine go to the respective providers. Their privacy terms apply.

If you choose a secure DNS provider in the settings (Cloudflare, Quad9, Mullvad or Google), your DNS queries go encrypted to that provider instead of your network's.

If you allow an extension to talk to a program on your computer (such as a password manager's desktop app), the two exchange messages directly on your device. Aszendra asks the first time and sends nothing to the network for it.

Why there is no consent banner here

A banner is not a courtesy ritual but a consequence of § 25 TDDDG (the German implementation of the ePrivacy rules): consent is required from whoever stores information on the terminal device or accesses information already stored there — cookies, but equally localStorage, identifiers in the browser, or embedded third-party scripts that do such things.

This site does none of that, and you can check: it ships no JavaScript, embeds nothing from foreign servers and writes nothing into your browser. Measured on the start, download and this page: no cookies, localStorage and sessionStorage empty, no database, no service worker, zero connections to other hosts.

What we do process is above: server logs at Cloudflare and a download count without IP address or identifier. Both happen on the server, not on your device, and rest on a legitimate interest — for which the GDPR provides a right to object, not a prior consent requirement.

A banner asking permission for something that never happens would not just be superfluous; it would be misleading.

A script we did not add

Cloudflare injects a bot-detection script of its own into every response (/cdn-cgi/challenge-platform/). We did not ask for it and it is not part of this site — but it does appear in the delivered source, and we would rather say so than leave it out.

It is blocked by our own security policy and therefore never executes; it sets no cookie and opens no connection. We are working on switching it off entirely.

4. Your rights

You have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Write to hallo@aszendra.com.

You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for our location.

5. Changes

If the processing changes, this statement changes with it. The date above says when it last did.