Privacy & data

ULDA websites · Updated 25 October 2026

Your room is encrypted in your browser. We count page opens in daily groups, without cookies or visitor IDs. Hosting still involves technical data, including IP addresses.

Who runs this demo

ULDA Room at demo.ulda.io is a collaboration between Mark Shaposhnik, based in Switzerland, and Vitalii Radko, based in Germany. Mark holds the hosting account and handles the hosting arrangements. Vitalii develops and administers the application. For privacy questions and requests, contact us at admin@ulda.io.

The ULDA concept and algorithm were created by Mark Shaposhnik, based in Switzerland, who also wrote an early implementation. Vitalii Radko reworked and developed the implementation into its current form.

This notice covers our hosted Room demo (demo.ulda.io), landing page (ulda.io) and documentation (docs.ulda.io). Deployments run by other people have their own privacy arrangements. The encrypted-room sections apply only to Room.

Your encrypted room

Room names, furniture names, positions and other planner content are encrypted on your device before being sent to the server. The server stores ciphertext and the technical records needed to synchronize it: resource IDs, public verification data, sizes and expiry times.

The room secret stays in the part of the invitation after #, which browsers do not send in HTTP requests. Anyone with the full invitation can open and edit that room. We do not receive that secret through the demo's normal requests. Encryption does not hide connection metadata or protect a link you share with someone.

Each encrypted resource expires 24 hours after creation. Editing does not extend this period. A background task deletes expired resources, so deletion can be delayed while the service is unavailable or clearing a backlog. Room data is temporary and should not be used as permanent storage.

A small, aggregate page counter

For each UTC day we store the total number of Room page opens and counts in these fixed categories:

The landing page and documentation use the same kind of daily counter, with separate totals for each site. Their fixed categories are direct / other, from landing, from documentation, from Room, navigation within the same site, and reload. Documentation navigation between articles counts as another page open; changing an anchor or search query on the same page does not. Article addresses, search terms and individual page identifiers are not sent to the counter.

The browser sends only the category, without the room ID, secret, full URL or referrer. Navigation markers contain no unique value and are removed from the address bar after use. We do not use analytics cookies, browser storage identifiers, fingerprinting or third-party analytics scripts.

We keep only daily totals for 180 UTC days, not individual visit records. These are opens, not unique people: reloads, tests and automated browsers can count. Shared or modified markers and browser behavior can affect classification. We do not reconstruct a person's journey or match visitors across devices. Opening this notice itself does not increment the Room counter.

Technical data and security

Our server and hosting provider process IP addresses and network/request details to deliver the demo and protect it from abuse. The application keeps bounded, temporary IP rate-limit buckets in memory; their one-minute windows are pruned in a minute-based cleanup cycle.

Ordinary access logging is disabled for all three sites at the edge proxy and their static web servers. Error logs can still include IP addresses, request paths and other technical details. Logs are rotated by size rather than a fixed number of days; older logs from before access logging was disabled may remain until rotation. The daily counter does not store any of these fields. Aggregate statistics are available only through an administrator-protected dashboard or administrative server access. The dashboard itself is not counted.

No account or email address is required to use Room. If you email us, your message and address are processed to handle your request and any applicable legal obligations. Do not send your room secret or a full invitation when contacting support.

Hosting in the United States

These sites run on a VPS supplied by Dynu Systems Incorporated in the United States. The provider supplies the infrastructure on which encrypted records, aggregate counters and technical data are processed. US laws and access by public authorities may differ from those in Germany and the rest of the EEA.

We do not sell visitor data or use it for advertising. Data may be disclosed where required by law or necessary to address abuse. Contact admin@ulda.io for information about hosting and international-transfer arrangements. This notice does not claim that Dynu is certified under a Data Privacy Framework or that encryption alone removes international-transfer obligations.

Purposes and your choices

We process the data described here to provide encrypted collaboration, maintain security, troubleshoot faults and understand overall use of this demo. For personal data processed for these purposes, we rely on our legitimate interests in operating and protecting the demo and measuring its aggregate usage under Article 6(1)(f) of the EU General Data Protection Regulation (GDPR).

You can contact us about access, correction or deletion and, where applicable, objection, restriction or portability. We may need enough information to identify the relevant technical record or verify that a request is yours. Daily totals cannot be linked back to an individual visitor, and we cannot recover a lost room secret.

You have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU country where you live or work, or where you believe an infringement occurred. A directory of German supervisory authorities is available from the Hessian authority. Material changes to this notice will be reflected in its update date.