Privacy Policy

Controller

MOSKITO LLC, 30 N Gould Sr, Sheridan, WY 82801 — identical to the information provided in the Legal Notice

What Data We Process

Upon registration: a self-chosen nickname, an email address, and a password, which is stored exclusively as a hash (not in plain text). The email address is used to confirm the account, for password recovery, and — if enabled — for the login security code (2FA). A real name is not required.

Voluntarily, later in the account: a second, separate email address exclusively for password recovery. Without this information, the account email address will be used.

When uploading images: the image file itself, as well as the original file name, the timestamp, the IP address of the upload, and a SHA-256 checksum of the file. The checksum and IP address are used exclusively to uniquely identify a file in the event of an official inquiry. For viewing by recipients, an additional cleaned copy is created from which metadata such as camera and location data (EXIF/GPS) is removed. The original remains stored unchanged.

When creating a link: an optional separate link password (also stored only as a hash), the selected validity period, and the time of the first view.

Technically, automatically: IP address and timestamp for security-relevant actions (e.g. login attempts, link accesses) for detecting misuse and limiting login/access attempts (rate limiting), as well as a technically necessary session cookie. The application itself does not set any tracking or marketing cookies.

Purposes and Legal Bases

• Provision of the service (registration, login, image sharing) — Art. 6(1)(b) GDPR
• Sending security codes and password reset links by email — Art. 6(1)(b) GDPR
• Protection against misuse, fraud, and unauthorized access (rate limiting, logging) — Art. 6(1)(f) GDPR (legitimate interest)

Recipients and Third-Party Providers

For sending emails (login codes, password resets), the SMTP server configured by the operator is used.

Storage Period

Account data and images remain stored until you delete them. Individual images and individual links can be deleted or revoked at any time from the dashboard; they will no longer be accessible from that moment onward.

When an account is deleted, login access, links, and images are immediately blocked, and your email addresses are removed from the account. The account data, such as nickname, email addresses, last known IP address, and image files, are then moved to a separate archive for a short period and subsequently permanently deleted. This retention period of no more than fourteen days serves to meet legal requirements only in the event that a judicial order exists in relation to your account. The legal basis is Art. 6(1)(c) and (f) GDPR. Deletion periods may only be suspended where statutory retention obligations or official orders prevent deletion.

An expired or revoked link does not automatically delete the associated images — they remain available in the account so that, for example, a new link can be created, and they can be deleted individually there.

A sharing link contains a randomly generated secret (token). When first accessed, this secret appears in the requested address and may therefore appear in server logs; all subsequent accesses take place without the token. We do not store the token itself in our database or logs, but only a shortened, non-reversible identifier.

Your Rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection to the processing of your data. To exercise these rights, an informal message to the contact address provided below is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority.

Contact for Data Protection Requests

mod [et] bildr [dot] de