Privacy policy
Translation for convenience. Only the German version is legally binding.
1. Who is responsible
Dirk Wagner
c/o flexdienst – #22230
Kurt-Schumacher-Straße 74
67663 Kaiserslautern
Germany
E-mail: datenschutz@knoten.chat
Matrix: @dirk:knoten.chat
knoten.chat is a Matrix homeserver run by a single private individual. There is no data protection officer; the legal requirements for having to appoint one are not met.
2. The most important things first
Three things come first on purpose, because they are the core and are often missing from comparable policies or come too late.
Matrix is a federated network. As soon as you write with someone whose account is on another server, or join a room containing such people, your messages and details of your account are transmitted to those servers. That is not disclosure by us but how the network works. We have no influence on what happens there, how long it stays there or who can see it there. We cannot retrieve it or have it deleted either. If you do not want that, use only rooms in which everyone has an account on knoten.chat.
Encryption protects content, not circumstances. In end-to-end encrypted rooms we cannot read your messages. We still see who is connected with whom, when, in which room, how large messages are and when you are online. This information is not encrypted and technically cannot be.
Your display name and profile picture are public. They are transmitted to every server on which someone shares a room with you.
3. What we process
Account
| Data | Purpose | Legal basis |
|---|---|---|
| User name | your address in the network | Art. 6(1)(b) GDPR |
| Password (hash only) | login | Art. 6(1)(b) |
| E-mail address | confirmation and password recovery | Art. 6(1)(b) |
| Display name, profile picture | how you appear, chosen by you | Art. 6(1)(b) |
| Devices and sessions | login, encryption, security | Art. 6(1)(b) and (f) |
We do not ask for or store a phone number.
Content
Messages, files, images and room state are stored so that you and the people you talk to can retrieve them. In encrypted rooms message content exists only as ciphertext.
Special categories of personal data (Art. 9 GDPR)
People write in a messenger about health, politics, religion, beliefs, trade union membership, ethnic origin and sex life — about themselves and about others. These are special categories under Art. 9(1) GDPR, and we would rather say so than pretend it does not concern us.
What of it is technically accessible to us depends on the room:
| Encrypted rooms | Content exists only as ciphertext. We cannot read it, not even when ordered to. |
| Unencrypted rooms | Content is stored in plain text in the database and is technically accessible to us. |
| Always in plain text | Room names, room topics, display names and who is in a room with whom — room state is never encrypted. |
The last row is the uncomfortable one. A room name often says enough about what it is about, and it travels in plain text in notifications even from encrypted rooms (section 4).
Legal basis: insofar as you manifestly make such data public — for instance in a public room — processing is based on Art. 9(2)(e) GDPR. Otherwise, deliberately transmitting it to a service meant to forward and store it constitutes explicit consent under Art. 9(2)(a) GDPR, which you may withdraw at any time with effect for the future.
What follows in practice: use encrypted rooms for sensitive topics, and choose room names that reveal nothing on their own.
Link previews
When a link is shared in a room, our server fetches the linked page to get title, description and preview image. The preview image is cached here and is subject to the same periods as other media (section 5).
One side of this works in your favour: the other site sees the IP address of our server, not yours. It does not learn who viewed the link, only that a Matrix server fetched it.
It also has an uncomfortable side: the fetch happens as soon as the link lands in the room — also in encrypted rooms, because your app asks the server to do it. If you do not want that, switch off link previews in your app; in Element the setting is under the appearance settings.
Logs
The purpose is operation and defence against abuse, legal basis Art. 6(1)(f) GDPR. On 24.09.2026 we checked which logs exist and what is actually in them — the answer differs from what a template policy would say:
| Log | Content | Real IP addresses |
|---|---|---|
| Web server and homeserver (cluster) | time, requested address, browser identifier, errors | no — only cluster-internal addresses |
| Mail log | sender, recipient, delivering servers | yes |
| Host system log | login attempts, bans by fail2ban | yes |
Why the web server logs no IP addresses: the access log of the upstream proxy is switched off, and the services behind it see only its internal address. That is not chance, but it was not a decision either — it is the default and stays so.
Retention: 7 days. This applies to all three rows of the table and is enforced by the server, not just promised — set up and measured on 24.09.2026. One qualification belongs with it: a service that logs very rarely can keep individual older lines until the daily cleanup removes them; the period is therefore the upper limit, not deletion to the day.
What is stored beyond that: the homeserver keeps the last used IP address per device in the database, so that you can see in the device list whether a stranger has logged in. This storage is unaffected by the log periods. Here too: 7 days. The device entry stays in the list; only the last used address disappears from it. That has a price we state openly: whoever checks after seven days whether a stranger has logged in no longer learns from where. We chose to store less data.
Operational metrics
To monitor the system, technical metrics are collected (Prometheus/Grafana): load, storage use, number of requests, error rates. These data are aggregated and contain no message content. Retention 30 days.
Calls (audio and video)
Calls run through our own relay service at call.knoten.chat, not through an outside provider. It is needed because a call with several participants would otherwise not connect.
| What it sees | IP address and port of every participant, duration and time of the connection |
| What it does not see | the content — sound and picture are encrypted between the participants |
| Where it runs | on our server, the same machine as everything else |
The difference from writing is real and should be said: when you write, our proxy sees your address and does not log it. In a call, the media path must know your address, otherwise the packets do not arrive. If you want to avoid that, do not make calls through this server.
Connection data of the call service is not kept permanently; whatever ends up in logs is subject to the periods in section 5.
Gifts by bank transfer
If you support the service by bank transfer, the credit transfer gives us your name, IBAN, amount, date and reference. We learn nothing more, and we ask for nothing more.
| Purpose | assigning the gift, cost report, the operator's tax return |
| Legal basis | Art. 6(1)(c) GDPR insofar as tax record-keeping duties exist; otherwise (f) |
| Who sees it | the operator; where necessary a tax adviser and the tax office |
| Published | sums only, never names — unless you expressly wish to be named |
The operator's bank, bunq B.V. in Amsterdam, processes the transfer as a controller in its own right under its own privacy terms; it does not act on our behalf.
A gift is not tied to an account on knoten.chat. We do not link the two, and whoever gives receives nothing in return — no privileges either.
4. Push notifications — please read carefully
For your phone to buzz when someone writes to you, the homeserver has to send a notification to a push service. At knoten.chat that is our own service at ntfy.knoten.chat, not Google or Apple.
We measured what is transmitted:
| transmitted | |
|---|---|
| Message text | no — removed on the server (push.include_content: false) |
| Sender and display name | yes, in plain text |
| Room name | yes, in plain text |
| Room and event identifier | yes |
Also from encrypted rooms sender and room name travel in plain text, because room state is not encrypted. There is no setting that prevents it. Since we run the push service ourselves, these details stay with us — which also makes them data we hold. They are kept for twelve hours and then deleted.
Outgoing notifications are randomly delayed by up to ten seconds so they are harder to match to individual messages.
Push is optional. If you do not set up the distributor app, this data is not created.
5. How long we keep data
| Data | Period |
|---|---|
| Messages | until you or a room delete them |
| Your own images and files | 30 days from last access |
| Images from other servers (cache) | 7 days from last access |
| Push notifications | 12 hours |
| Operational metrics | 30 days |
Mail to abuse@, impressum@ and the other role addresses |
1 year |
| Moderation decisions and their reasons | 3 years |
| Backups | 7 days daily, 4 weeks weekly, 6 months monthly |
| Details of gifts | as long as needed for the tax return, at most 10 years |
| Account never used | deactivation after 30 days |
| Inactive account | deactivation after 180 days, with notice and 30 days' grace |
On image retention: counted from last access, not from upload. An image that keeps being viewed stays. What nobody has opened for 30 days is deleted.
On mail to our role addresses: what is sent to abuse@, impressum@, datenschutz@, security@, hostmaster@, dmarc@, dirk@ or konto@ is forwarded to the operator and additionally kept here — so that an abuse report is not lost if the provider of the forwarding target rejects it. It is deleted after one year; a monthly job on the server enforces this, so the period is the upper limit, not deletion to the day. konto@ is the sender of confirmation mails; replies to them end up here.
On backups: when you delete something, it disappears from live operation immediately, but from backups only once the last backup containing it has expired — after six months at most.
6. Whom we use
| Who | For what | Where | Contract |
|---|---|---|---|
| Contabo GmbH | server and storage | Germany | data processing agreement |
| Mailgun Technologies, Inc. | sending confirmation and recovery mails | USA, sending via the EU region | data processing agreement with standard contractual clauses |
| Cloudflare, Inc. | name resolution (DNS) | USA | data processing agreement as part of its terms, with standard contractual clauses |
On the third-country connection at Mailgun, precisely rather than roughly.
The contracting party is Mailgun Technologies, Inc., based in San Antonio, Texas — a US company. Its parent Sinch AB, on the other hand, is in Stockholm and thus in the EU; so it is the other way round from how it first looks. Sending runs via the EU region; Sinch America Inc. in the USA is among the named sub-processors.
The transfer is based on the provider's data processing agreement with standard contractual clauses and on the EU-US Data Privacy Framework. That does not mean access under US law is excluded — it is not. If you want to avoid it: confirmation mails are the only way your address gets there.
GIF search in the lean client
The client at leicht.knoten.chat offers a GIF search. It queries the service klipy.com, directly from your browser — not through our server. Klipy receives your IP address, your search term and your browser identifier. We see none of it and have no influence on it.
The requests use an access key that belongs to the Sable project, not to us. That project's terms with klipy apply.
If you do not want that, do not use the GIF search.
Similar, but rarer: if you open the theme catalogue in the settings of leicht.knoten.chat, the list of colour themes is loaded directly from GitHub (raw.githubusercontent.com). GitHub sees your IP address. This only happens when you open the catalogue yourself.
Otherwise we use no analytics services, no advertising networks, and we sell no data. There are no cookies other than those needed for login; a consent prompt is therefore not required.
7. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Contact the address above.
You can lodge a complaint with a supervisory authority; the competent one is
Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
poststelle@lfd.niedersachsen.de
This authority is competent because the operator lives in Lower Saxony — not because of the c/o address in the legal notice. That is a postal address, not an establishment.
Limit of erasure: what has already been transmitted to other servers (section 2) we cannot delete. We can delete your account on knoten.chat and remove your data here. We have no access to, and no authority over, other servers. That is uncomfortable, but it would be dishonest to claim otherwise.
8. Moderation
The operator reads and handles abuse reports; decisions are documented. The legal basis is Art. 6(1)(f) GDPR.
A moderation bot is involved — @draupnir:knoten.chat, run by us on the same server. What it can and cannot do is a deliberate decision, not a technical limit:
| It can | ban users and remove messages in rooms where it is installed as moderator |
| It cannot | suspend accounts, shut down rooms or act server-wide — it deliberately has no server admin rights |
| It acts | only in rooms where it was explicitly switched on, not in every room it joins |
Server-wide measures remain manual work of the operator. The reason is not convenience: a bot with full server control would keep its access token as a secret inside the very system it controls.
The bot keeps audit logs of its actions, so that an objection remains traceable and the transparency report can be substantiated.
Moderation decisions are kept for three years. The period follows the standard limitation period: as long as you can still challenge a decision, it must be documentable — in your favour too. Then it is deleted.
9. Changes
This policy is updated when the service changes. We announce significant changes in the announcement room. As of: 06.10.2026.