OkeanosPrivacy policy
Last updated: 10 November 2026
1. Controller
Pixelbauer OG, Eichengasse 11, 8160 Weiz, Austria
Email for privacy requests:
We have not appointed a data protection officer because the legal requirements for one are not met. We process personal data under the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Telecommunications Act 2021 (TKG 2021). This policy covers the website okeanos.tools, the shop, the customer portal and the connections the Okeanos software makes to our servers.
2. Principle: Okeanos works locally
Okeanos stores connections, credentials, passwords, keys and vault contents only on your devices or in places you choose yourself (such as a shared folder or a Git repository for sync, encrypted there). We never receive this data. Neither we nor the software send the contents of your terminal sessions, files, commands or the data on your servers. Okeanos sends no telemetry, no usage statistics and no crash reports.
The software connects to our servers only for:
- licence activation, the regular licence check (subscriptions and trials) and deactivating a computer,
- starting a trial,
- the update check and downloading updates (can be turned off in the settings).
The table below lists the data sent in each case.
3. Purposes, data, legal bases, recipients and retention
| Purpose | Data | Legal basis | Recipients | Retention |
|---|---|---|---|---|
| Visiting the website, server logs | shortened IP address (IPv4 without the last byte, IPv6 shortened to /48), time, requested address without sign-in and order tokens, status code, browser identifier | Art. 6(1)(f) GDPR (secure and stable operation) | our hosting provider (processor, Art. 28 GDPR; data centre in the EU) | overwritten continuously, at most 50 MB per service (usually a few weeks) |
| Protection against overload and attacks | IP address in memory (request rate counters), security messages with IP address in the application log, block lists (email addresses, domains, IP ranges) | Art. 6(1)(f) GDPR (security, preventing abuse and fraud) | our hosting provider (processor, Art. 28 GDPR; data centre in the EU) | counters 1 minute; log as above; blocks until they expire or are lifted |
| Order and contract | company, contact person, email address, address, country, VAT number, order reference, licence chosen, coupon code, language; proof of acceptance of the terms and EULA (version, time, IP address) | Art. 6(1)(b) GDPR (contract); (f) (proof of the contract) | our hosting provider (processor, Art. 28 GDPR; data centre in the EU); our email service provider (processor); Mollie B.V., Amsterdam (payment processing, its own controller) | paid orders: for the customer relationship, then until the retention period for invoices ends; orders never paid: 90 days |
| Payment | Mollie processes payment details directly; we receive the payment ID, status, method and amount, and for subscriptions the Mollie customer and mandate ID | Art. 6(1)(b) GDPR | Mollie B.V., Amsterdam (payment processing, its own controller) | as the order |
| Invoices and bookkeeping | invoices and credit notes (PDF), booking data | Art. 6(1)(c) GDPR (§ 132 BAO, § 11 UStG 1994) | tax adviser, tax authorities | 7 years from the end of the calendar year (§ 132 BAO); we delete after 8 years at the latest |
| VAT number check | VAT number and country | Art. 6(1)(b) and (c) GDPR | European Commission (VIES) | result 1 day in memory, then with the order |
| Licence activation, check and deactivation | licence key, licence ID, salted hash of the device ID (the device ID itself never leaves the device), computer name, time of activation and of the last check, IP address and the country derived from it locally | Art. 6(1)(b) GDPR (licence agreement); (f) (fraud prevention, country restrictions) | our hosting provider (processor, Art. 28 GDPR; data centre in the EU) | licence data for the life of the licence and the retention period of its invoice; IP address 30 days |
| Trial | email address, hash of the device ID, time | Art. 6(1)(b) GDPR; (f) (one trial per device and address) | our hosting provider (processor, Art. 28 GDPR; data centre in the EU) | 24 months |
| Update check of the software | version, channel, operating system and package format, licence ID; IP address only shortened in the server log | Art. 6(1)(b) GDPR (updates under the licence) | our hosting provider (processor, Art. 28 GDPR; data centre in the EU) | not stored, only in the server log (see above) |
| Customer portal | email address, sign-in link (stored only as a hash, valid 20 minutes, single use), session (stored only as a hash, 12 hours), session key in the browser (sessionStorage) | Art. 6(1)(b) GDPR | our hosting provider (processor, Art. 28 GDPR; data centre in the EU); our email service provider (processor) | sign-in link 20 minutes, session 12 hours; in the browser until the tab is closed |
| Sign-up and abuse log | for trials, orders, payments, portal sign-ins and refused activations: time, email address, IP address, country, browser identifier, result and reason for a refusal | Art. 6(1)(f) GDPR (preventing fraud and abuse, traceability) | our hosting provider (processor, Art. 28 GDPR; data centre in the EU) | IP address and browser identifier 30 days, the rest 24 months |
| Change log (audit) | changes to licences, orders, prices, coupons and blocks, with who made them, time, values before and after, IP address | Art. 6(1)(c) GDPR (records) and (f) (security, traceability) | our hosting provider (processor, Art. 28 GDPR; data centre in the EU) | as the licence and order data concerned; IP address 30 days |
| Emails | recipient, subject and content (licence keys, invoices, sign-in links, payment reminders), delivery status; a copy of licence and invoice mails to our bookkeeping | Art. 6(1)(b) and (c) GDPR | our email service provider (processor) | mail queue 30 days after sending; bookkeeping copies as invoices |
| Support requests | your message and contact details | Art. 6(1)(b) GDPR (contract) or (f) (answering requests) | our email service provider (processor) | until resolved, then at most 3 years |
| Backups | encrypted backups of the database, invoices and downloads (all of the data above) | Art. 6(1)(c) GDPR (retention duties) and (f) (recovery after failures) | our hosting provider (processor, Art. 28 GDPR; data centre in the EU); the location of the off-site backup copy (processor) | daily backups 60 days, monthly backups 8 years; deleted data disappears when the backup expires |
The order and invoice data are needed to conclude the contract; without them we cannot sell a licence. Activation needs the licence key and the device hash. Everything else (such as a contact person or an order reference) is optional.
Our legitimate interest (Art. 6(1)(f) GDPR) is in each case the secure operation of the website, shop and licence service, preventing fraud, abuse and attacks, proving contracts and keeping changes traceable.
4. Country lookup, blocks and automated decisions
We look up the country of an IP address in a database on our own server (DB-IP.com IP-to-Country database, licensed under CC BY 4.0, or MaxMind GeoLite2). No request goes to a third party; your IP address does not leave our server for this.
Orders, trials, portal sign-ins and licence activations can be refused automatically when the email address, its domain or the IP address is blocked, or when the request comes from a country we do not supply (for example because of sanctions or repeated fraud). If this affects you, write to us: a person will review the case, and you can state your view and contest the decision.
5. The Okeanos AI plugin and AI providers
The optional "Okeanos AI" plugin connects Okeanos to an AI service you choose yourself (such as Anthropic, OpenAI, Google, Mistral or a model you run locally). Requests go directly from your computer to that provider, with your own API key and under its terms and privacy policy. They never pass through our servers; we receive neither your requests nor the answers. The AI provider, or you, are responsible for its processing.
You decide through the permissions in Okeanos what the plugin may see (such as connection names, terminal output or command results). A plugin never receives passwords, keys or other secrets. The MCP connection for apps such as Claude Desktop or Claude Code is a local access point on your computer, protected by a key; it cannot be reached from the network and does not go through our servers.
6. Recipients and transfers to third countries
- Hosting: our hosting provider (processor, Art. 28 GDPR; data centre in the EU).
- Email delivery: our email service provider (processor).
- Payments: Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, as an independent controller for payment data (Mollie's privacy statement).
- VAT number check: European Commission (VIES).
- Tax adviser, tax authorities, courts and legal representatives, where required by law or needed to enforce claims.
We do not sell data and do not use it for advertising. We do not transfer data to countries outside the European Economic Area ourselves. Mollie may use service providers outside the EEA for some payment methods; Mollie describes the safeguards in its privacy statement.
7. Cookies and browser storage
This website sets no cookies and uses no tracking, analytics or advertising services. Fonts and all other content come from our own server. The browser stores only what is technically necessary (§ 165(3) TKG 2021), and it never leaves your device: in localStorage theme (light or dark design), lang (chosen language) and checkout-draft (draft of the billing details in the order form); in sessionStorage portal-session (customer portal sign-in, until the tab is closed). You can delete these entries in your browser at any time.
8. Spam protection of the contact details (ALTCHA)
So that address harvesters and spam programs cannot collect our email addresses and phone number, they are not in the website's source code. At the press of a button ("show"), your browser solves a small computing task (proof of work using the open ALTCHA scheme, self-hosted) and then receives the contact details from our server. No personal data is processed or stored for this, no behaviour is analysed, no cookies are set and no third party is involved; only the general server logs and rate limits from the table above apply (Art. 6(1)(f) GDPR, protection against spam and abuse).
9. Security
All connections are encrypted with TLS. We store sign-in links and sessions only as hashes, and backups only encrypted. The shop can only be managed from one fixed address and with an access key. Payment details such as card numbers never reach our servers.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to ; we answer within one month. Legal retention duties, such as for invoices, remain: we block such data until the period ends and delete it afterwards.
If you believe that the processing of your data violates data protection law, you can complain to the supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
11. Changes
We update this policy when our processing or the law changes. The version published on this page applies. See also the legal notice.