Privacy policy

Applies to this website (id42.xyz) and the Medusa program (medusa.id42.xyz). It follows the Swiss Federal Act on Data Protection (FADP) and, where people in the EU or EEA are concerned, the General Data Protection Regulation (GDPR). Last updated: October 10, 2026. The German version prevails.

Controller

Silo42 – Jens Riedweg
Mühlegasse 18
6340 Baar
Switzerland
jens@id42.xyz

Hosting and location

The website and the program are hosted by Hostinger and delivered through its network. Data may be processed outside Switzerland in the process. For technical reasons the provider keeps access logs: IP address, date and time, the address requested, browser identification. They serve safe and stable operation. I do not evaluate them in relation to persons.

This website

The website is static. It sets no cookies and includes no analytics, advertising or tracking services. Fonts and images come from its own server; no third-party content is embedded. There is no form. Only the host's access logs arise. If you write me an email, I use your details to reply.

The program: what is stored

The data lies as files in the server's data folder, outside the publicly reachable directory. There is no database.

• Account: user name, display name, email address, password (as a hash only), role. Until you delete the account (menu Account › “Delete account …”; this also removes your documents).
• Documents: layout, texts, styles, colours, pages, version state and change log. Until the document is deleted.
• Uploaded files: images, PDF, fonts, Word files. Until the document is deleted.
• Comments and mentions: display name, text, time. Until the document is deleted.
• Contributions from the contribution inbox: name, email address, text, Word file, images, captions, credit and note from people who submit through a contribution link. Accepted contributions until the document is deleted; unfinished submissions are removed after about an hour.
• Access keys in links: for reading, editing, commenting, forms and contributions. Until they expire or are revoked.
• Presence: who has a document open (display name, pointer position). A few seconds, not stored permanently.
• Session: a session identifier when you sign in. Until the browser session ends, with “Stay signed in” up to 30 days after the last activity.
• Counter for failed attempts: the IP address as a hash only, to protect against password guessing. About 24 hours at most.
• Mail log: time, recipient address, subject, result, to spot delivery failures. Cut to roughly the last 500 lines.
• Print orders: the print PDF and the address of the print shop you enter yourself. Until the link expires or is revoked, or the document is deleted.

No analytics or advertising services are used and no profiles are built. Legal bases under the GDPR: contract and steps prior to a contract (Art. 6(1)(b)) for account and documents, legitimate interest (f) for security counters and logs, consent (a) for contributions someone submits voluntarily. Whoever loads third-party content into the program, such as pictures of people or other people's texts, is responsible for holding the rights.

Cookies and local storage in the program

• Session cookie: technically necessary for signing in, HTTPS only, not readable by scripts.
• Language cookie id42-sprache: remembers the chosen language, one year.
• The browser's local storage: display name for comments, interface settings, recently opened documents, offline documents you deliberately save locally and, if you enter them, access keys for AI and translation services. This data stays in the browser and does not go to the server. You delete it in the browser's settings.

There are no cookies for advertising or analytics. A consent prompt is therefore not needed.

Email

Medusa sends mails for signing in (confirm email, reset password), for mentions in comments, for approval and for “Order print”. They go through the host's mail server or a sending service set up for it. The sending service and the receiving server get sender, recipient, subject and content. Mails to a print shop go only to the address the person ordering enters.

Third-party services you trigger yourself

Medusa connects to none of these services by itself. They become active only when you use the function. The request then goes straight from your browser to the provider, not through my server. The provider sees your IP address and the content sent and acts under its own terms; read its privacy policy before using it.

• AI functions: Anthropic, OpenAI, Google (api.anthropic.com, api.openai.com, generativelanguage.googleapis.com), only with your own key. The chosen text and your instruction are sent.
• Translation: DeepL, LibreTranslate, MyMemory, Lingva. The text to translate is sent.
• Spell checking: LanguageTool or a server of your own. The text to check is sent.
• Loading tables and texts: Google Sheets and Google Docs, shared links only, without signing in.
• Image source: Bynder, only if set up. Signing in happens in Bynder's dialog; Medusa sees no credentials.
• Video chat: WebRTC directly between the participants. To connect, a STUN server run by Google is asked, which sees the IP address. Sound and picture do not pass through my server and are not stored.

When an admin installs a Google font, the server fetches it from Google. Google sees only the server's address, no data of users.

Disclosure

Apart from the service providers named (host, mail sending) and services you trigger yourself, I pass no data on. With a document link you give others access to content and comments: whoever has the link sees the document within the rights granted.

Security

Transfer is encrypted (HTTPS), passwords exist only as hashes, documents are reachable only with an account or a key, failed attempts are limited, the data folder lies outside the public directory. There is no such thing as complete security.

Your rights

You have the right to access, rectification, erasure, restriction, a copy of your data, objection and withdrawal of consent. You delete account and documents yourself in the program. For everything else write to jens@id42.xyz; I usually answer within 30 days. Complaints go to the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or to the supervisory authority of your country of residence in the EU.

Changes

This policy may be adapted. The version published at the time applies.