blitz.cloud privacy policy

This privacy policy applies to blitz.cloud: the website blitz.cloud, the dashboard at dashboard.blitz.cloud, sign-in at login.blitz.cloud and the interfaces api.blitz.cloud and mcp.blitz.cloud. It explains which personal data we process, what for, on which legal basis, who we pass it to and when we delete it. It exists in German and in English. If the two versions differ, the German one applies.

1. Controller

BlitzWorks UG (haftungsbeschränkt), represented by its managing director Simon Gloël, Graßer Weg 73, 93053 Regensburg, Germany, registered at the Amtsgericht Regensburg under HRB 21609, email hallo@blitzworks.io.

We have not appointed a data protection officer, because we are not required to. Please send questions about data protection to hallo@blitzworks.io or to the address above.

2. Where your data is

blitz.cloud runs on servers we rent from our data centre operator in the EU and operate ourselves. Your account, your apps, their files and their databases are stored in Germany, and for some apps in Finland. Backup copies and the built images of your apps are kept separately, with the same operator, in the EU (Finland). Files of an account that no app has needed for two days are moved, encrypted, to separate storage with the same operator in Germany, and brought back as soon as an app needs them again. Files you upload to import into a database or an app, and exports you download, wait in further separate storage with the same operator in the EU and are deleted there automatically after a day.

Some service providers process data on our behalf or receive it because you use their service. Each is named in the sections below. Where data goes to a country outside the EU, the section also says on which basis.

3. When you visit blitz.cloud

Cloudflare

Every request to blitz.cloud, dashboard.blitz.cloud, login.blitz.cloud, api.blitz.cloud and mcp.blitz.cloud passes through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages, protects them from attacks and runs our name resolution (DNS). In doing so Cloudflare processes your IP address, the address requested, date and time, browser and device details and the content of the request, because Cloudflare accepts the encrypted connection and passes it on to our servers. Cloudflare may set a technically necessary cookie to recognise automated traffic (for example __cf_bm).

Cloudflare acts as our processor. The legal basis is our legitimate interest in secure and fast delivery (Art. 6(1)(f) GDPR). Cloudflare also processes data in the USA and at locations outside the EU that are closest to you. The transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Cloudflare is certified, and on standard contractual clauses. More at cloudflare.com/privacypolicy.

Server log files

With every request our servers process the technically necessary data (IP address, date and time, page requested, browser) to answer it and to detect faults and attacks (Art. 6(1)(f) GDPR). The log files are not collected in a central place and are overwritten continuously. For requests to our own addresses (blitz.cloud, dashboard, login, api and mcp) we keep the page requested without its parameters, the status code, the response time, the browser and the time in our database for 24 hours, without the IP address. This lets us trace faults afterwards.

Fonts

We serve the Geist and Geist Mono fonts from our own servers. No fonts are loaded from Google Fonts or any other provider.

Visitor statistics with Matomo

We count visits to blitz.cloud and the dashboard with the open-source software Matomo, which we run ourselves at matomo.blitzworks.io, on our servers in Germany. No data goes to the makers of Matomo or to anyone else.

The statistics work without cookies and without access to your device. We process the shortened IP address (the last two blocks are removed before it is stored), the pages visited, the page you came from, date and time, browser and device type and your approximate region. In the dashboard we only record which kind of page was opened, such as "an app's overview", without names or identifiers of apps, without addresses and without account data. We respect "Do Not Track" and similar browser settings. The legal basis is our legitimate interest in measuring use of our own service with as little data as possible (Art. 6(1)(f) GDPR).

Matomo sets no cookies and stores nothing on your device, so we don't ask for consent. Until 8 November 2026 Matomo set the cookies _pk_id and _pk_ses to recognise returning visits if you allowed it in Google's consent dialog; it no longer does, and it deletes them when it finds them. Matomo deletes the raw data of single visits after 13 months; what stays are totals that relate to no one.

Where your visit began (the site or link that sent you, the first page you opened on blitz.cloud and a campaign name if the link carried one) travels with the sign-up link itself, as ft= in its address. The website works it out in the open page and keeps it there; nothing goes into a cookie or into your browser's storage. When your account is created we store it with the account, so we can see which pages and links bring sign-ups. The legal basis is our legitimate interest in knowing which of our pages and links work (Art. 6(1)(f) GDPR).

We do not measure the apps that customers run on blitz.cloud with Matomo.

Measuring sign-ups and upgrades

We also want to know how many accounts get from sign-up to a running app and to a paid plan, and which way they came. For this our server, not your browser, sends up to four events per account to our Matomo: sign-up finished, first app online, trial started, paid plan started. Each account gets a random number for this, which we store with the account and delete with it. The events carry that number, the page or the store app the sign-up came from, the kind of source of the first app (such as a store app or a GitHub repository), how many seconds it took until it was online, the moment the trial started, and the plan and billing interval. They carry no email address, no name, no account identifier, no IP address of yours and no app name. Nothing is stored on or read from your device. We only send events for accounts created since 16 October 2026. The legal basis is our legitimate interest in understanding which parts of blitz.cloud lead people to a working app and to a paid plan (Art. 6(1)(f) GDPR). You can object at any time by writing to hallo@blitzworks.io (Art. 21 GDPR); we then send no more events for your account and delete those already sent. Matomo deletes the events after 13 months.

No advertising

blitz.cloud shows no ads: not on the website, not in the dashboard, not at sign-in and not in our customers' apps. No page loads an ad script. Until 8 November 2026 the website showed ads from Google AdSense on its articles and loaded Google's consent dialog ("Privacy & messaging") on every page, and until 6 November 2026 the dashboard showed ads on the free plan and checked whether an ad blocker stopped them. All of that has ended. Google's cookie FCCDCF, which held your choice in that dialog, is no longer read; you can delete it in your browser's settings, together with the cookies Clickio left until 19 October 2026 (__lxG__consent__v2 and similar). What we recorded about the ad blocker check (when its note was shown and what you clicked) stays with your account's usage history (section 6) until it is deleted.

4. Cookies and browser storage

We only use cookies and browser storage that are technically necessary, which are allowed without consent (Section 25(2) no. 2 TDDDG):

In your browser's local storage (Local Storage and Session Storage) we also keep: whether you want a light or dark look, an unsent draft in the wizard for new apps, small notes such as "this tip was already seen", whether you are signed in to the dashboard (so the website shows the right button), and the code from an invite link. These entries stay on your device. Except for the invite code, which goes to us with sign-up, they are not sent to us. You can delete them in your browser's settings.

Nothing on blitz.cloud needs your consent. Until 8 November 2026 the website kept blitz_ft in Session Storage and the dashboard set the cookies blitz_sk and blitz_from if you had allowed statistics, and the dashboard remembered that answer in blitz_consent. None of them is written anymore, and the dashboard deletes the three cookies when your browser still sends them.

5. Your account

Signing up and signing in

For sign-up and sign-in we run the software Keycloak ourselves, at login.blitz.cloud on our servers in Germany. When you sign up we process your email address and your password (only a hash is stored), and your name if you give it. If you set up a second step, we store what it needs: the secret for one-time codes or the public key of your passkey. We send you an email with a confirmation link. The contract for the free plan is made once you confirm. blitz.cloud is for people aged 16 and over (terms section 2). We do not knowingly process data of younger children.

The legal basis is performing the contract for blitz.cloud and the steps before it (Art. 6(1)(b) GDPR). If you sign up to install an app from the store or to deploy a repository through a "Deploy on blitz.cloud" link, we store the store page you came from (for example /store/n8n, with the source of the link) or the repository the link names, and the time, on your account, so the dashboard can open that app or repository once you are set up. We remove both once you have chosen your blitz.cloud address, at the latest after seven days. The legal basis is performing the contract (Art. 6(1)(b) GDPR). We also store with your account, once, where your sign-up came from: the campaign named in the link (source, medium, campaign), the address of the site that linked to us, the first page you opened on blitz.cloud, how you signed up (password, Google or GitHub), your country as your connection shows it and your language. If you allowed statistics, the website keeps this note while you browse (section 4, blitz_ft). Otherwise only the page you are on knows it and adds it to the link into the dashboard, unless you refused statistics. If no note arrives, we take what the sign-in request itself shows: the campaign in its address, the page that linked to it, or the mail or link it came from. We delete this with your account. The legal basis is our legitimate interest in knowing which ways bring people to blitz.cloud and to a paid plan (Art. 6(1)(f) GDPR). We also check whether the email address of an account belongs to a throwaway mail service. That check runs against a list on our own server; nothing is sent anywhere. The list comes from a public source and our own additions. If an account uses such an address, we may refuse it or suspend the account, as section 2 of the terms describes. We also check whether the mailbox already has an account. For that we turn the address into one standard form: lower case, without an addition after a plus sign and, for Gmail, without dots. We store that form with the account and remove it together with the address. If a mailbox already has an account, we refuse another one; if a mailbox has several accounts, we suspend all but the one used last, as section 2 of the terms describes. The legal basis for these checks is performing the contract (Art. 6(1)(b) GDPR) and our legitimate interest in being able to reach every account and in preventing several accounts per person (Art. 6(1)(f) GDPR).

Protecting sign-up and the report form with Cloudflare Turnstile

The sign-up form and the form for reporting illegal content carry a Cloudflare Turnstile check, so accounts and reports come from people and not from scripts. For this your browser loads a script from Cloudflare when the form opens. Cloudflare processes your IP address and details about your browser and device and gives us a result, which we have Cloudflare confirm together with the IP address. The legal basis is our legitimate interest in preventing abuse, automatically created accounts and automated reports (Art. 6(1)(f) GDPR). For the transfer to the USA, what section 3 says about Cloudflare applies. There is no such check when you sign in, or when you sign up with GitHub or Google.

Signing in with GitHub or Google

Instead of a password you can sign up and sign in with your GitHub or Google account. We then send you to GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA) or Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). At the first sign-in we take your email address from there and, from Google, your first and last name. From GitHub we only ask for permission to read your email address, from Google for "openid email profile". We also store which GitHub or Google account belongs to your blitz.cloud account.

The legal basis is performing the contract (Art. 6(1)(b) GDPR), since you choose this way yourself. GitHub and Google process the sign-in under their own responsibility and their own privacy notices. GitHub processes data in the USA, based on the EU-US Data Privacy Framework.

Sign-in log and sessions

Keycloak logs sign-ins, failed sign-in attempts, changes to your password, passkeys and second step, and the sending of sign-in emails, each with the time and IP address. We use this to send you security notices, for example when your password was changed, and to detect attacks on accounts. We also use the same entries to detect whether several accounts were created or signed in to from the same IP address (section 14). After eight wrong passwords in a row Keycloak blocks sign-in for a while. The entries are deleted automatically after 30 days. The legal basis is our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).

A session ends after one hour without activity and after ten hours at the latest. Under Settings you can see where you are signed in (browser and operating system, IP address, start and last activity) and end single sessions. An AI assistant you connect over MCP gets its own access. It stays connected as long as the assistant uses it, and expires after at most 30 days without use. Under Settings you disconnect it at any time.

Signing in to your own apps with blitz.cloud

Some apps from the store show a "Sign in with blitz.cloud" button on their own sign-in page. If you use it, our sign-in checks that the app belongs to your account and then passes your email address, your name and your user name to that app, so it can sign you in. Some apps make you their admin this way. Only the account that owns the app can sign in like this. The app runs in your account, so from then on you decide what it does with this data (section 14). The legal basis is performing the contract (Art. 6(1)(b) GDPR), since you choose this way yourself.

One free Pro trial per person

The free 14-day Pro trial is once per person (terms section 5a). Before a trial starts, we check whether you already had one on another account. For that we compare data we already hold for other reasons: the standard form of your mailbox (above), the GitHub or Google account you sign in with, the name on the account together with the IP addresses from the sign-in log, the parent domain of your own domains and the GitHub account your apps' repositories come from. When you add a card during the trial, we also compare the fingerprint Stripe makes of the card (section 9). If the check matches an account that already had a trial, you get no free trial and can buy Pro straight away. We note the refusal and the kind of match, not the other account, in the account's log (section 6). The legal basis is our legitimate interest in giving the free offer to each person once and in limiting the cost of trials (Art. 6(1)(f) GDPR). The data is removed together with your account, as section 13 describes.

6. When you use blitz.cloud

What we store

To provide the service we store for your account:

• your email address, your name, your blitz.cloud address (such as lena.prod.page) and your plan,
• your apps with their settings, addresses and versions, your databases, custom domains and DNS records,
• your apps' settings (environment variables, including passwords and connection details). We encrypt these before storing them,
• build logs, meaning what was printed while an app was built, and for apps from GitHub the message of each commit,
• an app's activity (deployed, restarted, went to sleep, restored) and a log of every change to your account: who (you, an AI assistant over MCP, one of our staff, or the system) did what and when,
• traffic numbers per app (requests, data volume, errors), aggregated without IP addresses,
• API keys (only as a hash) and the AI assistants you connected over MCP,
• how you use blitz.cloud: every night, how many apps, databases, storage and builds your account has, and when you hit a limit of your plan, click a button for Pro, open the payment page, leave it without paying or cancel, with the reason if you give one (when you leave the payment page, you can pick one from a short list), which steps of the new-app wizard you take, when you open a "Deploy on blitz.cloud" link, where it came from and which repository or store app it names, which answer you click when a reminder mail asks why no app is online yet, and when a store search finds nothing, which app from a fixed list of known app names you looked for,
• what you tell us in the welcome tour after sign-up: what you came to put online (a store app, your own code, a Docker image, or just looking around), a domain you looked at while picking your address, and whether you hid the card with set-up tips on the Apps page,
• when you open the dashboard: the start of each visit, counted on our server from your signed-in requests (a new visit after 30 minutes without one). Nothing is stored on your device for this,
• when you last signed in, deployed an app or opened the dashboard. On the free plan this decides when a background app stops (terms, section 4).

We show your apps' running output (logs) live. We do not store it in a database of our own. It stays on the server only until newer output overwrites it or the app restarts.

The legal basis is performing the contract (Art. 6(1)(b) GDPR). We keep the change log also out of legitimate interest, to be able to clear up errors, abuse and disputes (Art. 6(1)(f) GDPR).

Addresses and certificates

Addresses on blitz.cloud are public. HTTPS certificates are issued for them, and every certificate is listed in public logs (Certificate Transparency), as everywhere on the internet. Those logs show your main address and, for custom domains, their names. So don't pick an address name that says more about you than you want to make public.

Domains you buy on blitz.cloud

When you buy a domain on blitz.cloud, the registry needs to know who owns it. For that we store the owner's details you enter: name, organisation if any, postal address, phone number and email address. We pass them to our registrar, netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, which creates a contact record from them and registers the domain with the registry for its ending (for .de DENIC eG, Frankfurt am Main; for other endings the registry named on the domain's page at netcup). Registries keep the owner's details as long as the domain is registered, and for most endings they don't publish them; a few registries outside the EU may show them in their public WHOIS. The domain's DNS records are kept at Cloudflare (section 3). The legal basis is performing the contract (Art. 6(1)(b) GDPR). We delete the details with your account, unless a domain is still registered in your name; then we keep them until its registry year ends.

How we plan plans and prices

From this usage data we sort each account into a group, such as "runs finished apps" or "builds their own code", and calculate a score from usage, limits and activity that shows how well Pro might fit the account. Only we see this classification. It changes nothing about what you get or pay. We use it to decide which plans, prices and features we offer. The legal basis is our legitimate interest in running and developing blitz.cloud economically (Art. 6(1)(f) GDPR). You can object (section 17). We delete this data after 400 days and with your account.

In the dashboard we ask some customers once two short questions: who uses their app (just them, people they know, the public or customers, or a bot) and how they would pay for hosting (card, PayPal, Google Pay or Apple Pay, or not online). The answer is voluntary. We store it as part of your usage history and delete it after 400 days. Section 13 says what happens to it if you delete your account earlier. Answers to our earlier question about four prices, with the note and the permission to contact you if you gave them, stay until you delete your account. We only write to you about them if you ticked that we may (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by email to hallo@blitzworks.io.

Recommendations in the App Store

To suggest apps in the App Store, we count every night which store apps are installed together on the same accounts, including apps that were deleted again. From this we keep only a score per pair of apps, such as "accounts with Paperless often also run n8n". A pair only counts once at least three accounts share it. The scores contain no account. When you are signed in, we compare them with the apps your account runs and show you apps you don't run yet. We record which recommendations we showed you and which you clicked, to find out which way of recommending works better. We delete that record after 90 days and with your account. The legal basis is our legitimate interest in showing you apps that fit (Art. 6(1)(f) GDPR). You can object (section 17).

We also test which layout of the App Store helps people find an app that runs for them. In each test your account sees one of two versions, for example which row the store's start page shows first, or which rule fills "You might also like". We work out the version from your account's identifier each time. We do not store it, and nothing is saved on your device. We record when you open the store's start page or an app's page, which app it was, and whether we had suggestions from other accounts for it. With the recommendations we showed you, we also record which version you saw. Per version we count how many accounts start an app from the store and get it running. Only we see these numbers. The page records are part of your usage history, and we delete them after 400 days. If you delete your account, we remove the link to your account and keep the records only under a random number until the 400 days are over. The legal basis is our legitimate interest in improving the App Store (Art. 6(1)(f) GDPR). You can object (section 17).

Invites

Under Settings you find an invite link with a code for your account. If someone signs up through this link, we store who invited whom and whether the invite counts. You only see numbers about this: how many signed up, how many counted, and how many months of Pro you earned. An invite counts once the new account has had an app online for seven days. It doesn't count if both accounts share the same mailbox or the same custom domain, the new account has a disposable address, or both accounts were created or signed in to from the same IP address (section 5). We credit the reward as balance at Stripe or as a free month of Pro. The legal basis is performing the contract (Art. 6(1)(b) GDPR), and for checking abuse our legitimate interest (Art. 6(1)(f) GDPR). We delete the data with your account.

How long we keep it

7. Builds from GitHub and other git hosts

When you deploy a project from GitHub, blitz.cloud fetches the code of the chosen commit, builds an image from it and stores it in our own registry. Builds run on our build servers in Germany or Finland. The images are stored in our data centre operator's object storage in the EU (Finland). For each project we keep the last ten versions that were online, so you can go back to an earlier one. Images of deleted apps are removed in the nightly clean-up.

Public projects are fetched without signing in to anything. For private projects and for automatic updates on every push you connect our GitHub App to your GitHub account. You decide at GitHub which repositories the app may access. For this we store the installation's identifier, the GitHub account's name and profile picture, and whether the app may access all or selected repositories. GitHub sends us a message on every push. You can disconnect the app at any time in your settings at GitHub.

You can choose that an app builds on your own GitHub Actions instead of on our build servers, for each app or for every new app. Our GitHub App then commits the file .github/workflows/blitz-cloud.yml to that app's repository, and the Dockerfile we wrote for the project once it has put the app online, if the project has none. When the app needs a new version, we start that workflow. GitHub runs it on its own machines under its own terms and counts it toward your Actions minutes. The run sends us a token signed by GitHub that names the repository, the workflow and the run; we answer with what to build and a credential that can only store this app's images and expires with the build. Afterwards the run sends us the end of what the build printed, which we keep like any other build log (section 6). We store whether and when you made this choice, the commit our files went in with, and the run's address on GitHub. Switching it off stops this; the files stay in your repository until you delete them.

You can also enter the address of any public git repository, for example on GitLab or Codeberg. We then read its branches without signing in and fetch the code of the chosen branch from that address. We store the address with the app. If you connect an account on GitLab, Gitea, Forgejo or Codeberg, you paste an access token from that server. We store it encrypted together with the server's address and your user name there, and never show it again. We use it only with that one server: to read your projects and their branches, fetch their code, and set up, renew and remove the push hook that tells us about a new push. You remove the connection under Settings, and you can also revoke the token on that server. When you delete your account, we delete the connection too.

The legal basis is performing the contract (Art. 6(1)(b) GDPR). GitHub, GitLab or any other git host is responsible for what it does with your data itself.

8. AI assistance from Anthropic (Claude)

For some steps we use the language model Claude by Anthropic. Anthropic never receives account data, your email address or the values of your apps' settings. What Anthropic receives depends on the step:

• When you set up an image from Docker Hub: the image's name and version, the ports and folders it declares, and the names of its environment variables.
• When we write a Dockerfile for a project that has none, or improve it after a failed build: the repository's name and commit, the list of files, the content of project files such as package.json or requirements.txt, the start of the README and of the file the program starts in, and after a failure the Dockerfile that was used and the end of the build output.
• When we explain why a build or start failed and suggest steps to fix it: the same project details, the end of the output, and also the app's name and address, the names (not the values) of its settings and the names of your other apps. This also applies to projects that bring their own Dockerfile.
• When a project has several Dockerfiles and we work out which one is for what: the same project details and the project's Dockerfiles.

For a private repository this means parts of code you have not published. We keep the model's answers for 90 days, but not the questions. We keep the answer the live version of your app was built from for longer, see section 6. A Dockerfile written for a public repository is reused for the same repository for other customers too.

The legal basis is performing the contract (Art. 6(1)(b) GDPR), since these steps are part of what blitz.cloud does for you. The provider is Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. Anthropic processes the data in the USA. The transfer is necessary to perform the contract with you (Art. 49(1)(b) GDPR).

We use no other AI providers for blitz.cloud. What data Claude sees when it helps us run the operation is in section 16.

9. Paying through Stripe

When you buy Pro or Business, a Pro app or a domain, we handle the payment through Stripe. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. When you go to the payment page we create a customer record at Stripe with your email address, your name and your blitz.cloud account's identifier. You enter your payment details directly at Stripe; card and bank details never reach our servers. Even when you try Pro free for 14 days, we create a customer record and a subscription in trial at Stripe, and Stripe keeps the card you add.

Stripe processes your name, your email address, your billing address (for some purchases, such as a Pro app, only country and postcode), for businesses the VAT ID, the payment details and information about subscription, invoices and payments. From Stripe we only receive whether and until when your subscription runs, invoices and payment status, the amount and currency of a checkout, and for a trial a fingerprint of the card. The fingerprint identifies the card without showing its number. We use it only to check that each person gets one free trial (section 5). If you pay from outside the euro area, Stripe may use your location to show you the amount in your own currency.

The legal basis is performing the contract for your purchase (Art. 6(1)(b) GDPR). We keep invoices and accounting records for eight years, and books and annual accounts for ten years, as tax and commercial law require (Art. 6(1)(c) GDPR together with Section 147(1) and (3) AO, Section 257 HGB and Section 14b UStG). Stripe may also transfer data to the USA. The transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Stripe is certified, and on standard contractual clauses. More at stripe.com/privacy.

You can also cancel Pro without signing in, on the cancel page. For that we process the email address and name you enter there, and the reason if you give one, and send you a confirmation (Art. 6(1)(c) GDPR together with Section 312k BGB).

10. Emails

We send our emails from noreply@blitz.cloud through Google Workspace's mail relay. Google processes your email address and the email's content for this as our processor. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Google may also process data in the USA, based on the EU-US Data Privacy Framework and standard contractual clauses.

We email you about these topics:

• Account, security, plan and billing, and service notices (maintenance, incidents, changes to the terms). You can't unsubscribe from these while you have an account, because they are part of the contract (Art. 6(1)(b) GDPR).
• Notices about your apps: failed and successful deploys, stopped apps, finished restores, overnight updates, and, in the first week after sign-up, up to two reminders if no app is online yet. They are on by default, and you can switch off each topic under Settings or with one click on the link in the email (Art. 6(1)(b) and (f) GDPR). The last of these reminders asks why no app is online yet. If you click an answer, we store it with your account to improve sign-up and our plans (Art. 6(1)(f) GDPR).
• A weekly newsletter about what went live on blitz.cloud that week. We send it to every account that has not objected. The legal basis is our legitimate interest in telling you about our own service (Art. 6(1)(f) GDPR). New accounts see this notice when they sign up, and every issue repeats it. You can object at any time, free of charge (Art. 21(2) GDPR): with one click on the link in every newsletter or with the switch under Settings > Notifications. We then send you no more newsletters and keep a note of when and how you objected.
• Offers for our own products that fit how you use blitz.cloud: one offer in the weekly note about your apps; one reminder if you start a checkout and don't finish it, at most one a week; in the mails near the end of a free trial and next to a payment that failed, the offer to keep one app running as a Pro app; the yearly price about a month after your first payment for a monthly plan; an offer to come back about 30 days after a paid plan has ended; and now and then a mail about a new product such as the Pro app, if you paid for Pro before. The legal basis is our legitimate interest in telling you about our own products (Art. 6(1)(f) GDPR). You can object at any time, free of charge (Art. 21(2) GDPR): with the Offers switch under Settings > Notifications or with one click on the link in the email. The offers then stop, and the mails about your account, your plan and your apps keep coming without them. If you object to the newsletter, the offer in the weekly note goes away too.
• If you objected to the newsletter and then delete your account, we keep a hash of your email address with the time and the way you objected. That way you won't get the newsletter if you sign up again later with the same address. The legal basis is our legitimate interest in respecting your objection for good (Art. 6(1)(f) GDPR). If you want us to delete the entry, write to hallo@blitzworks.io. The newsletter then comes again after a new sign-up.
• News about blitz.cloud, a few times a year at most, only if you switch it on under Settings (Art. 6(1)(a) GDPR). You can switch it off again at any time.

To find out which emails help, we sometimes send an email to only half of the accounts, or a different version to each half. Which half an account is in follows from its identifier each time; we store nothing extra for this. We then compare how many accounts in each half come back to the dashboard. The legal basis is our legitimate interest in sending emails that are useful to you (Art. 6(1)(f) GDPR). You can object (section 17).

We keep a log of which email went to whom, so we can answer questions about delivery (Art. 6(1)(f) GDPR). We delete the content after 30 days and the entry after 180 days.

11. Backup copies

Every night we back up:

• managed databases. We keep the copies of the last 7 nights on which a database was copied on the free plan, and of the last 30 on Pro. A database that sleeps with its apps is copied once just before it goes to sleep and not again while it sleeps, so its last copies stay until newer ones replace them after it wakes. Before every restore we save the current state, and that copy is kept for the same time.
• on Pro, the files your apps keep. We keep these copies for 30 nights, the copy taken before a restore for 7 days.
• the platform's own database, with all accounts and sign-in data. We keep these copies for 30 days.

If you delete a database, we delete its backup copies with it.

All backups are encrypted before they leave our servers and are stored separately from them, with our data centre operator in the EU (Finland). The legal basis is performing the contract (Art. 6(1)(b) GDPR) and our legitimate interest in being able to restore the service after a failure (Art. 6(1)(f) GDPR).

12. Private networks with Tailscale or WireGuard

You can set apps to be reachable only from your own private network.

With Tailscale you sign in at Tailscale and so add a blitz.cloud device to your Tailscale network. The device is named after your address (such as blitz-lena), and your private apps show up in it under their names. Tailscale learns what it learns for every device on your network: the device's name, addresses and connection times. The connections themselves are end-to-end encrypted. Tailscale is your own provider and processes this data under its own responsibility and privacy notice. We store your Tailscale network's name, the name of our device in it, when its key expires and, if you connected Tailscale with an OAuth client, that client's secret, encrypted.

With WireGuard you upload a configuration file. We store it encrypted and only decrypt it to connect to your router. Nothing goes to third parties.

You can also connect devices to our own WireGuard gateway, without a router or server of your own. For each device you add in the dashboard we store the name you give it, its public key, the tunnel address we assign it and when you added it. The private key is in the configuration file and the QR code we show you once. We do not keep it. While a device is connected, the gateway knows its current internet address and when it last connected. That stays in the gateway's memory and is not written to a log.

Only traffic to your own private apps goes through the gateway. Everything else your device sends, such as visits to other websites, does not pass through us. The gateway decrypts the tunnel and passes the traffic on to your app inside our network in the EU. We do not record or read that traffic. Nothing goes to third parties.

The legal basis is performing the contract (Art. 6(1)(b) GDPR). We delete the data when you disconnect the network or delete your account, and a device's data as soon as you remove the device.

13. Deleting your account and downloading your data

Under Settings you can download everything we hold about your account as one JSON file. It includes the values of your apps' settings, which is why it asks for a sign-in within the last hour. The file does not contain your apps' files or what your databases hold. You can copy those yourself with your databases' connection details.

Under Settings you can also delete your account. We then:

• remove your sign-in, which ends every session,
• end a running Pro subscription at once,
• delete all apps, databases, custom domains, DNS records, settings, build logs, traffic numbers and the AI's answers about your projects, and your apps' files together with the storage they were on,
• delete your API keys, connected AI assistants, private networks and email settings, your answers to the price questions and to the questions in the dashboard, your invites and the random number for measuring sign-ups,
• remove the link between your account and your usage history. What remains of it carries only a random number and is deleted when its 400 days are over (section 6),
• delete the backup copies of your databases within a day and the backup copies of your app files the following night,
• delete the archived copy of your account's files (section 2),
• release your address again after 14 days.

What stays is a record without email address and without name that only carries the account's internal identifier, the account's change log for three years after each entry, and, if you paid for Pro, the identifiers of your customer and subscription record at Stripe, so invoices stay assignable. Its entries hold that identifier and, where an action concerned one, the name of an app, a database or a custom domain. We keep it so we can still trace later what happened to an account, for example in a case of abuse or a complaint (Art. 6(1)(f) GDPR). We keep invoices as long as the law requires (section 9). Your account data remains in the platform database's backup for up to 30 more days, until those copies are deleted as scheduled. If deleting a disk of your apps or databases fails on one of our servers, we delete the leftover disk once we find it. Before that it stays switched off for 14 days and attached to no app, so that a disk we removed by mistake can still be restored.

If we close an account because of a serious breach of our terms, we keep its email address for three years after the closure so that nobody can sign up with it again (Art. 6(1)(f) GDPR). After that we remove it as if you had deleted the account yourself.

14. The content of your apps: us as processor

For personal data your apps process, such as your users' data in a database or the IP addresses of your app's visitors, you are the controller. We store and process it only on your behalf and on your instructions, as a processor under Art. 28 GDPR. You can download the data processing agreement as a PDF once you are signed in, in the dashboard under Settings, Privacy.

Requests to your apps also pass through Cloudflare (section 3), except on custom domains. Your apps' files and databases are stored on our servers in the EU (Germany or Finland), the backup copies in the EU (Finland). As section 8 describes, parts of your code may go to Anthropic during builds and troubleshooting. How we detect abuse is below. If someone reports content of an app to us as illegal, we look at the reported content (Art. 6(1)(c) GDPR together with Art. 16 DSA). Beyond that we do not analyse the content of your apps.

To tell people from programs, for example to decide when an app on the free plan goes to sleep, we read the log lines of requests to your apps. We keep a visitor's IP address only as a hash with a key that changes every day, for about five hours at most, and store only hourly counts: requests from people, distinct callers, and the requests of the busiest caller.

Detecting abuse

To detect abuse (terms section 8), we watch for these signs:

• An automated check searches the Dockerfile, the build output and the start command of your apps for clear signs of cryptocurrency mining.
• An automated check looks for start commands that rebuild a hidden program from encoded pieces.
• We compare how much computing time, memory, builds, requests and AI steps an account needs against other accounts.
• We see whether an app runs a known VPN or proxy program, or runs a long time without anyone calling it.
• We see whether the names of an app's environment variables match the key names of known proxy-pool providers. We look at the names only, not the values.
• We see whether an account uses a disposable address or the address of a privacy-focused mail provider and recreates its first app within an hour, and whether several accounts were created or signed in to from the same IP address (section 5).
• We see whether several accounts sign up with the same custom mail domain on the same day or choose the same display name with the same mail domain, and whether several accounts create apps from repositories of the same GitHub account or from images by the same author.
• We see whether several free accounts sign up within a short time on the same custom mail domain with addresses that look generated rather than chosen.
• We see whether an app comes from a known image or repository used to resell access to an AI subscription to others.
• We see whether an account wakes its own app from sleep again and again at short, regular intervals, as a script would.
• Among accounts that signed up from the same IP address, we see whether they create apps from the same image, repository or store app, and whether one of them runs an app to resell an AI subscription or a VPN, proxy or tunnel program.

We look more closely at accounts with such signs. AI tools help us with this (section 16). The legal basis is our legitimate interest in protecting the platform and every customer from abuse (Art. 6(1)(f) GDPR). What can follow from this is in section 19.

The "Made with blitz.cloud" link

On the free plan, and on Pro and Business when the app's owner turns it on, the HTML pages of an app show a small "Made with blitz.cloud" link (terms, section 9). It is part of the page the app delivers. It loads nothing from blitz.cloud or any other server, sets no cookie, stores nothing in the browser and sends us nothing. If a visitor hides it, that only applies to the page they are on. We only learn about a visitor if they click the link and come to blitz.cloud. From then on this policy applies as for any visit (section 3), and the browser may tell us the address of the page they came from.

15. Feedback and failure reports

When you write to us through "Give feedback" or "Missing a feature?" in the dashboard, your message goes by email to our inbox feedback@blitzworks.io, with your email address, your plan and the page you were on. When a build or deploy fails for good, we send ourselves a failure report to the same inbox. It contains your email address, your name, your address and your plan, details about the app and the repository, the build logs and the AI's answers. We use both to answer you and to improve blitz.cloud (Art. 6(1)(b) and (f) GDPR). The inbox is hosted by Google Workspace (section 10).

If you email us directly, for example at hallo@blitzworks.io, we use your address and your message to answer you and, if you ask about an offer, to prepare it (Art. 6(1)(b) and (f) GDPR). These mailboxes are also hosted by Google Workspace. We delete the mail when your question is settled, unless tax or commercial law requires us to keep it.

Questions in the dashboard

Now and then the dashboard asks you one short question, for example how likely you are to recommend blitz.cloud, how easy it was to get an app online, whether an explanation of a crash helped, or why you cancelled Pro. Answering is always optional. When you answer, we store your answer, the note if you write one, the app it is about, your plan, your language and the time. We also note when we showed a question and whether you closed it, so we don't ask too often. We use the answers to find out what works and what to fix (Art. 6(1)(f) GDPR). Only the people who run blitz.cloud read the notes. We do not send them to Matomo or to advertising partners. We delete the answers after 365 days, and earlier when you delete your account. If you don't want any more questions, choose "Don't ask me questions" on any of them. This is your objection under Art. 21 GDPR (section 17), and from then on we only ask about something you just did yourself, like a cancellation or a build that keeps failing. The reason we ask for when you delete your account is optional too. If you give one, it stays without your account in your usage history (section 6) after the deletion.

Reports of illegal content

If you report content to us as illegal (see the imprint), we process your name, your email address and what your report says. We need them to look into the report, confirm that we received it and tell you our decision (Art. 6(1)(c) GDPR together with Art. 16 DSA). We do not give your name and email address to the customer whose app is affected, unless you agree or a law obliges us to. If there is a suspicion of a criminal offence that threatens people's life or safety, we pass the report on to the competent authorities (Art. 18 DSA). We keep reports until claims arising from our decision are time-barred (Sections 195 and 199 BGB). The inbox hallo@blitzworks.io is also hosted by Google Workspace. The form carries a Cloudflare Turnstile check (section 5).

16. Who else sees your data

Within BlitzWorks, only the people who run blitz.cloud and help you see your data. We use AI tools for this: Claude by Anthropic (section 8) helps us answer your messages, check accounts for abuse and fix incidents. For this it sees the data a given task needs, such as your message, your email address, your plan and the details of your apps and builds. Anthropic processes this data in the USA. The legal basis is performing the contract (Art. 6(1)(b) GDPR) and our legitimate interest in a secure and efficient operation (Art. 6(1)(f) GDPR). Our data centre operator in Germany provides servers, network and the storage for backup copies and images and acts as our processor. We do not sell data. For advertising, data only goes to Google and its partners when you visit the blitz.cloud website, as section 3 describes. We never pass on data from your account or your apps for advertising. We only give data to authorities where the law obliges us to.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). You can do much of this yourself in the dashboard: change your name and email address, download your data, delete your account. For everything else write to hallo@blitzworks.io.

Right to object

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop processing the data, unless we can show compelling legitimate grounds that override your interests, or we need it to establish, exercise or defend legal claims.

You can also complain to a data protection supervisory authority. The one responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

18. Data you have to provide

For an account we need your email address, and for Pro also the details Stripe asks for to take the payment. Without them we cannot make a contract with you. Everything else is voluntary.

19. Automated decisions

Technical rules described in our terms and on our pages run automatically, for example that an app on the free plan goes to sleep after 15 minutes without visits or is stopped after 15 failed starts. The classification for plan planning (section 6) has no such effect.

Some decisions we make without a human. If our automated check finds clear signs that an app mines cryptocurrency (terms section 8), it pauses the app at once. This protects the servers all customers share, and with them the performance of our contracts with you and everyone else (Art. 22(2)(a) GDPR). You get an email about it. If you reply, a human reviews the decision. You can state your point of view and contest the decision (Art. 22(3) GDPR). An app that stands out in the abuse check (section 14) can also be paused without a human reviewing the decision first, because AI tools carry out that check. You get an email about it. A human reviews the decision once you reply. If our automated check finds a known VPN, proxy or tunnel program in an app (terms section 8), it pauses the app at once and, unless the account has a paid plan or a trial with a card, also suspends the account. A list of programs we have confirmed as abuse decides this, without a person checking first. This protects the servers and the network all customers share, and with them the performance of our contracts with you and everyone else (Art. 22(2)(a) GDPR). You get an email with the reason. If you reply, a human reviews the decision, and you can state your point of view and contest it (Art. 22(3) GDPR). In every other case we suspend or close an account only after a human decides. Whether we offer you the free Pro trial is also decided automatically (section 5). You can still buy Pro. If you write to us, a human looks at the decision. We make no other decisions based solely on automated processing that have legal effects on you or affect you in a similarly significant way.

20. Changes

We update this privacy policy when blitz.cloud or the law changes. The version published here applies. We tell you about significant changes by email.