Privacy Policy

At Conserved your privacy comes first. This policy explains what data we collect, why, and what rights you have. Conserved is based in the Netherlands and complies with the General Data Protection Regulation (GDPR/AVG).

1. Zero-knowledge encryption

The core of Conserved is that your content (memories, text, photos, and files) is encrypted in your browser before it reaches our servers. This is called zero-knowledge encryption:

• We have no access to your content and cannot read it.
• Even in the event of a data breach, your content is unreadable without your personal encryption key.
• We cannot recover your content if you lose your key.
• We cannot comply with third-party requests to disclose your content because we are technically unable to do so.

2. What data we collect

Account data (not encrypted)

To manage your account we store the following:

• Email address
• Name (optional)
• Password (as a secure hash, not as readable text)
• Account creation date and last login timestamp
• Subscription tier and payment status

Encrypted content

Your memories, timelines, text, photos, and files are stored client-side encrypted. We cannot view them.

Technical data

For the operation and security of the service, we process limited technical data:

• IP address (for security and abuse prevention)
• Storage usage
• Server logs (kept for at most 30 days)

3. Why we collect data

We process your data exclusively for:

• Performance of the contract — managing your account, storing and displaying your content, processing subscriptions.
• Security — protection against abuse, brute-force attacks, and unauthorized access.
• Legal obligation — complying with applicable laws and regulations.

4. Retention periods

• Account data — for as long as your account is active. After deletion all data is permanently erased within 30 days.
• Encrypted content — for as long as your account is active. Irrecoverably erased on deletion.
• Server logs — up to 30 days.
• Payment data — 7 years (statutory retention requirement).

5. Your rights (GDPR)

You have the following rights:

• Access — you can request which data we hold about you.
• Rectification — you can have incorrect data corrected.
• Erasure — you can have your account and all data deleted.
• Data portability — you can request an export of your data in a common format.
• Objection — you can object to processing of your data.
• Restriction — you can request restriction of processing.

To exercise your rights, contact us via info@conserved.io. We respond within 30 days.

6. Cookies and analytics

What we use

On the encrypted app (the timeline and any signed-in area) we set a single functional cookie:

• Session cookie - to keep you signed in. Expires after 30 days of inactivity.

On our public marketing and legal pages (the landing page, this privacy policy, and the terms of service) we load a self-hosted, cookieless analytics pixel called hozt-analytics. It records pageviews via a daily-rotating hash of your IP address and user-agent. The pixel runs on our own infrastructure (analytics.youno.org), sets no cookies, and stores no third-party identifiers. It is not loaded inside the encrypted timeline or any signed-in area, so your encrypted content is never observable to our analytics.

What we don't use

We do not use tracking cookies, third-party analytics services (such as Google Analytics or Meta Pixel), or advertising cookies. No data is shared with advertisers.

7. Third parties

We do not share your data with third parties, except:

• Payment processor — for handling payments. The processor receives only the data needed for the transaction.
• Hosting provider — our servers are located in the EU. The hosting provider has no access to your encrypted content.

Your encrypted content is never shared with third parties. Because we cannot decrypt it, we also cannot do so on request from governments or other parties.

8. Security

We take the following security measures:

• Client-side encryption (zero-knowledge)
• Encrypted connections (TLS/HTTPS)
• Passwords stored as secure hashes
• Two-factor authentication (2FA) available
• Rate limiting on login attempts
• Regular security updates

9. Children

Conserved is not intended for children under 16. We do not knowingly collect data from children. If you discover that a child under 16 has created an account, please contact us so we can delete the account.

10. Changes

We may modify this privacy policy. For material changes we will notify you at least 30 days in advance by email. The most recent version is always available on this page.

11. Complaints

If you have a complaint about how we handle your data, you can contact us via info@conserved.io. You also have the right to file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

12. Contact

For questions about this privacy policy or your data:

Conserved
Email: info@conserved.io