1. Who We Are

Chromacrypt is operated from Ghent, Belgium. For privacy inquiries: privacy@chromacrypt.io

2. What We Collect

The Chromacrypt website (chromacrypt.io) does not use cookies, analytics, tracking scripts, or fingerprinting. We do not collect IP addresses. We do not use third-party analytics services. The only external resource loaded is the Inter typeface from Google Fonts.

3. The Access Request Form

If you submit an access request, your submission (name, organization, role, phone, email, and message) is transmitted directly to our team via a stateless relay and immediately discarded. No database entry is created. No log is written. The data exists for the duration of transit and no longer.

4. The Chromacrypt Application

The Chromacrypt application does not collect, transmit, or store any personal data. The relay (Cloudflare Worker) operates in ephemeral memory with zero persistent storage -- no KV, no R2, no D1, no Durable Objects, no log streams. Messages exist in RAM for milliseconds during transit and are irretrievably destroyed. The system is architecturally incapable of retaining personal data.

5. IPFS Storage

One encrypted blob per communication pair is stored on IPFS via a third-party pinning service. This blob contains cryptographic key material encrypted with a password derived from identifiers that no longer exist. The contents are undecryptable by us, by the pinning service, or by any third party. We cannot determine the owner, purpose, or contents of any stored blob.

6. Your Rights Under GDPR

Under the General Data Protection Regulation (EU 2016/679), you have the right to access, rectify, port, and erase your personal data. We hold none. There is nothing to access, rectify, port, or erase.

If you believe we hold personal data about you in error, contact privacy@chromacrypt.io and we will investigate.

7. Data Controller

Chromacrypt, Ghent, Belgium.
Contact: privacy@chromacrypt.io

8. Changes

We may update this policy. Changes will be posted on this page.