Privacy. What we do with your data.

Who is responsible

Tobos FlexCo, Seitenstettengasse 5/37, 1010 Wien, Austria. hey@tobos.ai. We have no data protection officer; write to that address for anything on this page.

Visiting the site or app

When you open a page on tobos.ai, app.tobos.ai or a deck, our server processes your IP address and what your browser sends with the request: the page asked for, the time, the browser, the language, and the referring page if your browser sends it. Access logging is off, so none of this is stored after the answer. If something fails, our server's error log may record the IP address or e-mail address involved; we delete log entries after 7 days.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in delivering the site, the app and decks, and keeping them secure.

Cookies

The website sets no cookies. The app sets one, tobos_session, which keeps you logged in until you log out, for at most 30 days, and does nothing else. In the app and on the home page, your browser keeps scroll positions in its session storage, so that going back returns you to the same place; it never leaves your browser and is gone when you close the tab. Both are strictly necessary for the service you asked for, so they need no consent (§ 165(3) TKG 2021). Stripe's payment page is on Stripe's own site and sets Stripe's cookies; Stripe's cookie policy applies.

Your account

Signing up is logging in with a code we e-mail you. For that we process your e-mail address, the code (stored only as a hash), who asked for it: "a browser", or the CLI with your computer's name, which the e-mail repeats so you can recognise the request, and the IP address the request came from, so we can limit how many codes one network asks for. Each login creates a session in the browser, or a token for the CLI, stored as a hash, with your computer's name and when it was last used. We also keep which version of the terms you accepted, and when.

Your account gets a name made from the part of your e-mail address before the @. It is part of your decks' addresses, Stripe receives it as your customer name, and anyone who opens a deck link sees it.

We delete login codes after a day, sessions when you log out or after 30 days, and a CLI token when you log out. The account stays until it is deleted, and the record of the terms with it; if you bought Pro, we keep that record for 7 years (see Payments).

Legal basis: Art. 6(1)(b) GDPR, the contract with you; for the record of the terms, Art. 6(1)(f), our interest in proving what was agreed.

E-mails from the app

Postmark sends the app's e-mails for us: login codes, the confirmation of a purchase, and confirmations of withdrawals and cancellations. Postmark is AC PM, LLC, 1 N Dearborn Street, Chicago, IL 60602, USA, our processor. It receives your e-mail address and the e-mail, and keeps the e-mail for up to 45 days; an address that bounces stays on its list of addresses not to send to. Postmark's parent, ActiveCampaign, LLC, is certified under the EU–U.S. Data Privacy Framework, which covers AC PM, LLC (Art. 45 GDPR); standard contractual clauses apply in addition. We switched off open and link tracking.

Your decks and media

Your decks' code, text, notes and history are stored on our server in Germany as git repositories, including the name and e-mail address in each commit; when the app makes a commit for you, that is your account's address. Media files are stored in Hetzner's object storage in Falkenstein, Germany, exactly as you upload them, with any data inside them, such as where a photo was taken. We record each push with the person who made it.

A file that several decks use is stored once. Decks and their media stay until your account is deleted, or you ask us to delete a deck; a media file is deleted once no deck uses it any more.

Legal basis: Art. 6(1)(b) GDPR, the contract with you. If you use Tobos privately and your decks contain other people's data, we store and show it for you under Art. 6(1)(f): your interest, and ours, in providing the service you use. We can't tell who is in a deck, so we can't inform them one by one (Art. 14(5)(b) GDPR); they can use the rights on this page.

If you are a business, we process the personal data in your decks only on your behalf and on your instructions, under our data processing agreement (Art. 28 GDPR).

Viewing a deck

A deck is shown from a separate address, tobosusercontent.com, through a deck link that expires after at most 24 hours. Whoever opens it sends our server their IP address and browser data, as described above: none of it is stored after the answer, except in the error log, for 7 days, when something fails. The viewer receives the whole deck, including its notes and the account's name. Our viewer sets no cookies and loads nothing from other services, and our checks stop a deck's code from loading or sending anything in the background. A deck can still link to other sites, or open one when you click; those are other services, with their own privacy policies.

Payments

Stripe handles payments for Pro: Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, Ireland. You enter your payment details, your name, your billing address and, if you are a business, your VAT ID directly at Stripe; we never see your full card number. We give Stripe your e-mail address and your account's name, and get back what we need to manage Pro: your customer and subscription numbers, the status, and when the paid month ends.

Stripe works for us as our processor, for example for subscriptions, invoices and the customer portal. For the payment itself, which is a regulated service, and for its own purposes, such as preventing fraud and meeting its legal duties, Stripe is a controller in its own right; see stripe.com/privacy. Stripe may decline a payment it judges risky; ask Stripe about such a decision. Stripe also processes the data at Stripe, LLC in the USA, which is certified under the EU–U.S. Data Privacy Framework (Art. 45 GDPR); Stripe's data transfer terms add standard contractual clauses. If you save your details with Link, Stripe's own service, Stripe's terms for Link apply.

If you withdraw from Pro or cancel it with the forms at app.tobos.ai/withdraw or app.tobos.ai/cancel, we keep what you entered, with the time, and e-mail a confirmation to the address you gave. If no account has that address, we delete the record after 12 months.

We keep invoices, payment records and the records of your Pro contract (the terms you accepted, withdrawals and cancellations) for 7 years from the end of the year, as Austrian tax law requires (§ 132 BAO).

Legal basis: Art. 6(1)(b) GDPR, the contract; Art. 6(1)(c), the retention the law requires; for forms sent from an address without an account, Art. 6(1)(f), our interest in proving what we received.

Reports and moderation

If you report content, we use your report, and your name and e-mail address if you give them, to handle it. We tell the person whose content you reported who you are only where that is strictly necessary, for example for a copyright claim (Art. 17(3)(b) Digital Services Act). We keep reports, our decisions and our reasons for 12 months after a case is closed. We inform the police or prosecutors when someone's life or safety is at risk (Art. 18 DSA), or when an authority orders us to. If we remove terrorist content on a removal order, we keep it and the data about it for six months, as the law requires (Art. 6 Regulation (EU) 2021/784).

Legal basis: Art. 6(1)(c) GDPR with the Digital Services Act and Regulation (EU) 2021/784; for breaches of our terms, Art. 6(1)(f), our interest in enforcing them.

The CLI

The tobos CLI runs on your computer. It talks to app.tobos.ai, and keeps your token and e-mail address in a file on your computer (~/.config/tobos/config.json). It sends us no usage data. Two things download from others directly: tobos check --types installs packages from the npm registry (npm, Inc., part of GitHub, USA), and rendering or exporting a deck on a computer without Chrome or Edge downloads Chromium from cdn.playwright.dev (Microsoft, USA). Those services see your IP address, and their own privacy policies apply.

Writing to us

If you e-mail us, we use your address and message to answer you. Our e-mail is hosted by Hetzner in Germany, under the same data processing agreement as our server.

We delete enquiries 12 months after the last message. Correspondence about a contract with us is kept for 7 years, as Austrian law requires (§ 212 UGB, § 132 BAO).

Legal basis: Art. 6(1)(b) GDPR for a contract or a request for one, Art. 6(1)(c) for the retention the law requires, otherwise Art. 6(1)(f), our interest in answering you.

Hosting, DNS and backups

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, hosts the site, the app, the decks, the media and our e-mail, in Germany, as our processor under a data processing agreement (Art. 28 GDPR). Every night we back up the database and the decks' git repositories to Hetzner's object storage in Germany, and keep each backup for 30 days. A deleted or replaced media file stays recoverable for 30 days.

The DNS for our domains is run by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA: your DNS resolver asks Cloudflare where our server is. Cloudflare usually sees the resolver's address rather than yours, and never the pages you load. Cloudflare is certified under the EU–U.S. Data Privacy Framework (Art. 45 GDPR).

Deleting your account

Write to hey@tobos.ai, saying which account it is. Within 30 days, we delete your account, its decks, sessions and tokens, and media no other deck uses. Copies in our backups, and old versions of media files, go 30 days later. We keep only what the law requires: invoices, payment records and the records of your Pro contract, for 7 years; and reports and moderation cases, as described above.

Your rights

You can ask what we hold about you, have it corrected or deleted, restrict its use, and get a copy (Art. 15–20 GDPR). Write to hey@tobos.ai.

Right to object: where we rely on Art. 6(1)(f), you may object at any time on grounds relating to your situation (Art. 21 GDPR).

You don't have to give us any data, but without an e-mail address we can't make you an account, and without your IP address our server can't send you a page. We make no automated decisions about you (Art. 22 GDPR).

Complaints

You can complain to the Austrian data protection authority, Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb.gv.at, or to the authority in the EU country where you live or work.

Last updated 12 October 2026.