Updated: 1 November 2026. This notice covers Community and Hosted Team 1.0 for Android, Linux and the associated browser features. Hosted information applies when the respective service is used.
1. Responsibility and contact
The controller for the processing for its own purposes described below is schukai, postal address Eichenstraße 26, 82290 Landsberied, Germany. Privacy, support and security contact: hey@schukai.com. Full legal-provider details are in the imprint. Do not include real credentials, private keys or payloads in an ordinary support or security report.
schukai is the controller for its own contract administration, entitlement verification and necessary service security. For Hosted contents and associated organization workflows processed on instructions, schukai acts as processor within the agreed scope. The organization determines content purposes and legal bases, including for browser senders without an account or app. Store operators' and external recipients' own purposes remain separate.
2. Local use and device permissions
Community provides encrypted local transfers between paired devices without a Hosted user account. Locally, the app processes transferred content, device and organization identifiers, public and private keys, pairing records, policies, expiry times and records preventing used messages from being presented again.
Camera images are analysed on the device for QR scanning. Camera and Bluetooth access require the respective operating-system permissions. Older Android versions may require location permission for Bluetooth discovery; this does not assert that schukai collects location data. The app has Internet permission for Hosted features; this does not route a local Community transfer through schukai.
Local data reside in private app storage or the device key store. The Android app excludes its data from Android system backup and device transfer. You are responsible for exports and backups you create. Local one-time input holds content temporarily in memory. Other apps or device services may read an alternative clipboard; clearing it later cannot recall those copies. Keyboards may separately process activation codes you enter.
Android device unlocking uses operating-system authentication, such as strong biometrics or the device lock. schukai receives no fingerprint or facial templates. The optional WithinCells input service inserts released content into the target field chosen by the user. The target application may then store or process it.
After copying, Android schedules a clearing attempt within 20 seconds or at earlier message expiry. Operating-system restrictions can prevent background access; the attempt then remains pending until focus permits access again. This does not guarantee erasure from other apps, histories or synchronized clipboards.
The local device audit keeps a bounded history of technical operations. It is not complete server-side access information.
3. Hosted Team and the browser
When Hosted use is activated, encrypted messages and templates and technical metadata are transmitted to the displayed HTTPS service. These include pseudonymous organization and device identifiers, public keys, membership and roles, entitlement state, times, sizes, versions, delivery state and digest-based records for single-use and replay protection. Establishing a connection also exposes the IP address. Abuse-limiting counters process IPv4 addresses or IPv6 /64 network prefixes in memory, with minute-based windows; these counters are not a persistent browsing history.
Content is encrypted and decrypted on participating devices or in the browser. The service does not receive plaintext content or private content keys. This encryption does not protect against a compromised device, an authorized recipient or manipulated browser code. The party serving the browser application is therefore part of its trust boundary. Private recovery packages remain with the user; server-side records do not enable schukai to recover lost private keys.
Domain features process the supplied domain name, DNS proof, check times and validity. Sharing links can contain a secret capability in the URL fragment. Share complete links only with intended recipients, not in support reports or public pages.
4. Email and webhooks
Only when configured, the service processes recipient addresses and delivery metadata for notifications, or the configured webhook destination and its encrypted authentication secret. Notifications contain no plaintext content, secret sharing links or content keys. The user shares any required complete link separately.
Notifications pass through an adapter of the Hosted service and schukai's mail gateway in Landsberied to the designated recipient's mail service. That recipient service processes the message under its own responsibility or its organization's agreements. The configured maximum queue lifetime at the schukai gateway is five days, including bounce messages. Mail logs rotate weekly, with four archived generations in addition to the current file. This describes configuration, not proof of a completed erasure run.
Hosted-service retention and backup exclusions do not automatically apply to gateway logs, gateway backups or recipient systems. Gateway backups can contain delivery metadata. Erasing the application recipient row therefore does not erase all mail copies. Recipients retain received messages under their own rules.
5. Purchase verification and complimentary review rights
For Android purchases, Google Play processes payment and account data under its own terms. schukai receives no payment-card details. The app transmits purchase evidence over TLS to the entitlement service, which verifies it with Google for the intended app, organization, product and current validity. Purchase evidence remains separate from membership and content keys.
The raw purchase token is not stored as an unencrypted database value or included in URLs, logs, exports or QR codes. A separately encrypted retry record may exist for a pending acknowledgement for at most 24 hours from its creation and is not backed up. Durable processing retains only necessary correlation digests and verified status, term and ownership data. Direct orders can also require data outside the app for ordering, invoicing and contract administration; these are used for contract administration and legally required retention.
Reusable review codes grant separate complimentary rights, not a purchase or a consumer trial. Each new installation activates an isolated review organization. The service stores the code digest, validity, revocation, organization ceiling and original device binding, not the raw review code or private device key.
Minimal purchase provenance is additionally retained for the life of the organization: token HMAC, organization identifier, purchase class (paid or Google test purchase), first verification time and any test-window reference. It prevents reassignment of pruned purchases and reclassification of test purchases as paid rights. It contains no raw purchase tokens, order numbers or complete Google responses. Test windows also contain the exact organization identifier, product scope and issue, expiry and closure times. These records have no automatic erasure job and are not covered by the 30-day purchase cleanup.
6. Storage periods and backups
Local app data remain until removed in the app, app storage is cleared or the app is uninstalled. On Android, use Settings → Apps → WithinCells → Storage & cache → Clear storage. This does not erase exports or backups you created separately, or data held by the Hosted service.
The following periods describe application lifecycles. Expiry or revocation of rights is distinct from actual erasure of stored data. Maintenance failures can delay physical cleanup; this creates no additional purpose for processing.
| Data | Lifecycle |
|---|---|
| Relay payloads | Deleted on terminal state or expiry; no backup or WAL archive |
| Content-free Relay records | Seven days |
| Notification delivery | Seven days after completion; outstanding delivery follows its lifecycle |
| Email recipient | Encrypted while enabled; cleared immediately on explicit clearing; disabled/completed without an attempt: immediately, otherwise 24 hours after the final attempt; no backup |
| Encrypted Play retry record | Acknowledgement or at most 24 hours from creation; no backup; later verification does not extend the window |
| Play event digests | 30 days after receipt, including ignored events |
| Former Play purchase association | 30 days after terminal expiry once it is no longer the current lineage and no event references it; the current association remains while the entitlement exists |
| DNS verification records | Configured lifetime plus 30 days |
| Recovery-code digest | 30 days after redemption or expiry; a redeemed record is retained while organization rotation remains outstanding |
| Technical response cache for repeated requests | 24 hours; not backed up |
| Signed-request nonce digests | Until one second after the permitted signature window; under the documented clock bounds at most 8 minutes and 1 second from database acceptance |
| Uncompleted template reservation | 15 minutes |
| Deleted-template replay protection | 24 hours; template content is removed on deletion |
| Organization, devices, templates, configuration and recovery receipts | Durable Control data; repair/revocation receipts are bound to the organization or device. No automatic organization-wide erasure in this version; request access or erasure through the contact below |
| Review grant and review association | No automatic row purge in v1; expiry/revocation ends rights without erasing metadata. Used for complimentary-access association and abuse prevention; request erasure through the contact below |
Request access or erasure through hey@schukai.com, using the subject “WithinCells privacy”. Supply only information needed for association; do not send private keys or complete secret links. For data processed on instructions, authority is checked with the responsible organization. The app currently has no automatic organization-wide server erasure. Uninstalling, cancelling a subscription, revoking review access or closing a test window is not data erasure. Durable records are retained only while necessary for the purposes described or statutory duties. Their technical persistence creates no additional justification for indefinite retention.
At the planned launch, implementation and verification of production Control backups are deferred until after release. The documented operator exception runs from 2026-10-27T22:14:10Z until 2026-11-10T22:14:10Z (exclusive). Until implementation and verification, no available or recoverable Control backup is promised; loss of durable Control data may be permanent. Expiry of the exception does not establish that a backup has been implemented.
Separate encrypted Control backups are planned, including encrypted templates and technical entitlement records. Relay content, raw purchase tokens, content keys, transient recipients and retry data do not belong in this planned backup. A production Control backup is not described as available in this version. Provider, location and retention will be disclosed in updated information before such a backup is activated. A backup cannot include later deletion or revocation events retrospectively; these must be reconciled before traffic resumes. Recovery of lost Relay payloads or lost private content keys is not promised.
7. Recipients, legal bases and rights
Hosting is planned with DigitalOcean, LLC in the Frankfurt (fra1) server region, processing the encrypted Hosted content and operational metadata described above. Section 4 describes the mail chain. Google Play processes purchase and store information for its own purposes; recipients and webhook operators designated by the organization may receive data. A German server region does not exclude access outside the EEA. Such transfers are permitted only under Chapter V GDPR, for example an applicable adequacy decision or standard contractual clauses with required supplementary measures. Contact hey@schukai.com for information on the safeguards used for a specific transfer and a copy of them.
| Purpose under own responsibility | Legal basis and provision of data |
|---|---|
| Offers, direct contracts and support for our own contracting party | Article 6(1)(b) GDPR; necessary contact/contract data are required to handle the specific order or request. Without them it cannot be processed. |
| Business contacts and device/purchase association without the data subject's own contract | Article 6(1)(f) GDPR; interests in authorized service delivery, association and abuse prevention. Only necessary metadata; not used for advertising or profiling. |
| Legally required invoice/contract retention | Article 6(1)(c) GDPR with the actually applicable retention rule; accounting vouchers generally eight years and business correspondence six years, counted from the end of the relevant calendar year, subject to statutory extensions. |
| Own service security and abuse prevention | Article 6(1)(f) GDPR; interests in protecting users, service and entitlements. Connection/verification data are necessary for the respective Hosted operation. |
For processing on instructions, the organization determines the legal basis for its contents. Camera and other operating-system permissions control device features; they do not constitute blanket GDPR consent to Hosted or contract processing. Notification destinations are optional; without a recipient address there is no email notification.
The service checks entitlement automatically against purchase validity, organization association and security evidence. A failed check can prevent Hosted access; it cannot restore lost keys. If you dispute an association or suspension, request human review through hey@schukai.com. This check does not assess your creditworthiness or the contents of your messages.
Subject to statutory conditions, you may request access, rectification, erasure, restriction and portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Consent can be withdrawn for the future. Contact hey@schukai.com. Requests concerning processing on instructions are handled with the responsible organization; we cannot supply plaintext or keys we do not hold. Real secrets are not proof of identity. You may complain to a competent supervisory authority, including the Bavarian Data Protection Authority.
WithinCells uses no advertising, analytics or crash-reporting services in the app scope described here. The Hosted guest page uses no cookies, persistent browser storage or third-party telemetry. The general product website has its own privacy notice. The service is not directed at children. Material changes are communicated through the intended distribution channel.