GeGroups privacy notice

Who is responsible

For an instance you run, you are, and we process nothing.

Where we host it, the group owner is the controller of their members' data and we are their processor. For our own account and infrastructure data the controller is Gelhaus Solutions, Eichenwald 3, 49624 Löningen, Germany, egelhaus@ennogelhaus.de.

The thing to know first

A mailing list archives messages. Not a summary of them — the message.

For every post, GeGroups keeps the HTML and plain-text bodies, a sanitised copy for display, a snippet, the headers, and the original raw message as it arrived. If you wrote it to a list, it is stored, and it is visible to whoever the list's settings say may see the archive.

Email addresses are not masked in an archive unless the list owner turned masking on, and that setting is off by default. On a list with a public archive that means your address is public.

What is stored

Your account. Email address, display name, avatar, biography, message signature, locale, timezone, the interface preferences you set, and the link to your identity in our self-hosted Hexclave. You may hold several verified addresses; each carries its verification state.

Your subscriptions. Which lists, in what role, the delivery mode, posting privilege, whether you are moderated, moderator notes about you, labels, muted hashtags, how you joined, who approved you, and when you were last delivered to.

Messages and topics. As above: bodies, sanitised body, snippet, headers, raw message, sender name and address, edit count, reaction counts, view count, attachments, and moderation state with the reason and who decided.

Everything else a group holds: files, photos and their captions, wiki pages and every revision with its author, calendar events and RSVPs, polls and individual votes, chat messages, user-defined tables, drafts, and reactions.

Custom member fields. A group owner can define fields and collect answers. What is in them is set by that owner, not by us.

Joining and leaving. Pending membership answers, invitations, and the ban list — which holds addresses and domains as well as accounts.

Delivery. Every delivery attempt: the recipient address, the outcome, the remote server's SMTP response, the number of attempts, and a VERP token used to attribute a bounce. Bounce state is tracked per subscription with counts and probe attempts.

Activity log. Who did what, when, in which group, with the target — plus IP address and user agent.

DMARC reports. Other people's mail servers report to a group's domain about messages claiming to come from it. Those reports contain the source IP addresses of the sending servers.

Where messages go

To wherever each member's address is hosted. Sending an email means handing it to the recipient's provider, and that provider may be anywhere in the world. Nobody chooses it but the member.

That is not a sub-processing arrangement. It is what a mailing list does, and no configuration changes it.

Who else touches it

Where we host it: IONOS SE (Germany), Contabo GmbH (Germany, being wound down), and our own hardware in Germany. Mail is handled by our own Stalwart servers and file storage is our own MinIO. Identity runs on Hexclave, our own self-hosted fork of Stack Auth — not a third party. All of it in the EU.

No error reporting service, no analytics, no advertising network, no AI provider.

Why

Operating the service and your account is performance of a contract, Art. 6(1)(b).

Delivering messages to a list you subscribed to is Art. 6(1)(b) between you and the group.

Bounce handling, abuse controls, the activity log and DMARC processing are legitimate interests under Art. 6(1)(f): the interest is in mail arriving, in a domain not being forged, and in a group being able to see who did what.

How long, and what an archive means for erasure

Account data lasts until the account is deleted. Deleting a group, list, topic or message marks it deleted rather than erasing it immediately, so a moderation mistake can be undone.

A message in an archive is a message somebody else received. We can remove it from the archive, and the group owner can. We cannot recall it from the inboxes of every member it was delivered to, and neither can they. That is the honest limit here, and it is the same limit that applies to any email you have ever sent.

Where you ask to be removed from a group, your subscription goes and delivery stops. What you posted remains in the archive unless the group owner removes it; ask them, because it is theirs to decide.

Your rights

Access, rectification, erasure, restriction, portability and objection. Where we host the instance, ask the group owner first — they are the controller and can act, and we assist them.

You may complain to a supervisory authority. Ours is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.