Privacy policy
In force from 17 October 2026
1. Who we are
Axomek (the desktop app, the web app at this address and the
axm command line) is provided by Ahmad Zulhazmi Zulkefli, Dürerstr. 13/1, 73033 Göppingen, Germany (“we”). We are the
controller under the EU General Data Protection Regulation (GDPR) for the personal data
described here. Contact: support@axomek.com. The imprint has our full
details.
2. The short version
- The web app works without an account. An account is needed for the desktop app, the command line, cloud projects and the assistant: your email address or your Google sign-in. We use it to run your account and its licence.
- Your calculations run on your device. Projects you save locally stay there.
- Projects reach our servers only when you save them to the cloud or ask the assistant about them.
- No advertising, no third-party trackers in the apps, no sale of data. Our emails are counted anonymously by the provider that sends them (section 6).
- Feature statistics (both apps) and usability replays (web app only) run only if you allow them, and you can turn them off at any time. We never collect your projects, numbers, dimensions, loads, names, drawings or files through them. Diagnostic reports, feedback and answers to the app's occasional quick questions are sent only when you send them.
- About a week after you create an account we send you one welcome email asking how Axomek works for you, if the sign-up form told you so when you created it (accounts created before that get none). You can opt out at any time, with the link in the email or in Settings → Account.
- You can delete your account and its cloud data yourself, in Settings → Account.
3. What we collect and why
| Data | When | Purpose and legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Email address, account id, sign-in provider, for Google sign-in your Google name and profile picture; a password hash when you sign in with email | When you create an account | To provide the account (contract) |
| Your plan and its licence (account id, email, plan, expiry) | When you sign in, and when the app renews the licence | To unlock the features of your plan, also offline (contract) |
| Your email address and account id, for one welcome email; a record that the sign-up form showed you the notice about it when you created the account (when, and which wording); a record that it was sent (when, and the provider's message id, without your address); your choice of emails from us, and a one-way hash of the code in the email's unsubscribe link | The notice record when you create an account; the email once, about a week later, unless you have opted out. Only accounts created with the notice shown get it: accounts created before we showed it, or with an app version that does not report it, get no welcome email. |
To welcome you and ask how the service works for you: a single message about the
service you signed up for (legitimate interest). Next to the buttons that create an
account, the sign-up form says: We'll send you one email about a week after you sign up, to ask how Axomek works for you. You can opt out at any time, free of charge: in Settings or with the link in the email.You can object at any time, free of charge, with the unsubscribe link in the email or in Settings → Account; we then send you no such email. |
| Projects you save to the cloud, their earlier saves (when, and with which app) and deleted projects in the trash; with each, a short summary of the project (its name and description, modules, part designations, materials, the verdict of its checks and a few key results) and a small thumbnail picture, kept beside it so that your project list can be searched and previewed without downloading the projects. They are deleted with the project, its trash entry and your account | Only when you save to the cloud | To store and sync them for you, and to let you go back to an earlier save or undo a deletion (contract) |
| Your settings (units, theme, report header, logo and look, sign-off names, report templates and defaults for new projects) and your own project templates (the projects you save as templates, with their name, description and the parts you chose to include) | Only when you are signed in | To keep them with your account, so that the web app, the desktop app and axm share them (contract). Each is replaced by its next change; there are no earlier copies |
| Assistant conversations: your messages, the project you have open and the assistant's replies | Only when you use the assistant | To answer you (contract). We do not store the conversations on our servers. |
| A daily count of assistant requests per account, with the tokens each model used, and any limit set for the account | When you use the assistant | To enforce the daily limit, prevent abuse and estimate the service's cost (legitimate interest) |
| A record of administrator actions on your account (plan changes, revoked licences or keys, assistant limits): when, by whom, what changed | When an administrator changes your account | Accountability and security (legitimate interest) |
| Feature statistics (usage analytics): which modules and features were used, how long solves took and their error codes, the app version, platform (web or desktop and the operating system family), plan, unit system, language, window size class, a random id for the browser or computer and, when signed in, your account id; your approximate location (country and city), which we derive from the network address of the request; the address itself is not stored. Never project data, dimensions, loads, names, file names or anything you type | Only if you allow feature statistics | To learn which features matter and where the app fails (consent) |
| Usability replays (session recordings, web app only): how the page changes, clicks and scrolling, with every input, every text containing a number, results, lists, inspectors, the names of your project and file, drawings, charts and 3D views blanked out, and without the account, sign-in, licence, access key, settings, cloud, assistant and feedback screens; the same random id and, when signed in, your account id; the approximate location (country and city) the replay starts from, which we derive from the network address of the request; the address itself is not stored | Only if you allow usability replays in the web app; the desktop app never makes replays | To see where the app is hard to use and reproduce faults (consent) |
| Feedback and diagnostic reports: your message, an email address for a reply if you give one, a category; for a report also the app version, platform, language, window size class, browser identification, the app's last error messages and, if you add and keep it, a screenshot; your account id when signed in | Only when you send feedback or a report, after you have seen what it contains | To answer you and fix problems (consent; legitimate interest in fixing faults) |
| Answers to quick feedback questions (a short question the apps ask now and then, for example after a report export or an error; you can turn them off in Settings → Privacy): which question it was, your answer (yes or no, and the line you type), the module that was open, the app version and platform (web or desktop and the operating system family) and, after an error, the error's code; your account id when signed in. Never project data, numbers, file names or anything you did not type into the answer | Only when you send an answer | To learn what is missing and what fails (consent; legitimate interest in improving the apps) |
| Daily request counts per random id and per network address (stored as a one-way hash) | When the apps send feature statistics, usability replays or feedback | To limit abuse (legitimate interest) |
| IP address, time and request details in server logs | Every request to our servers, including the desktop app's update check | Security and operation (legitimate interest) |
In the table, contract means Art. 6(1)(b) GDPR, consent Art. 6(1)(a) and legitimate interest Art. 6(1)(f). You can withdraw consent at any time in Settings → Privacy; this does not affect what was processed before.
4. Data on your device
Project files you save locally stay on your device. The apps also keep your settings (units, theme, last module and view), your own project templates, an unsaved draft of the open project, your sign-in session and your licence in the browser's or app's storage (local storage and IndexedDB; the desktop app's recent files also in a file in its settings folder), your privacy choices, in the web app that you have seen the first-visit notice and, in the desktop app, which update it last told you about, your recent files and the folders you index, with a summary and thumbnail of each project for the Projects screen (summaries of older cloud projects are kept the same way, apart for each account and shown only while that account is signed in). These summaries never leave your device. If you allow feature statistics or usability replays they also keep a random id for this browser or computer and, while offline, the events not yet sent (at most three days); turning both off deletes the id. The web app sets no cookies of its own, no advertising or third-party analytics, and loads no fonts from other sites. Signing in with Google loads Google's sign-in script and opens Google's own sign-in page, which use Google's cookies under Google's privacy policy.
5. Feature statistics, usability replays and reports
Both are off until you choose. The web app asks with a banner, the desktop app once after you sign in; declining (No thanks) is one click, and Settings (Privacy) changes your choice at any time, or forgets it and asks again (Ask me again). If your browser sends Global Privacy Control or Do Not Track, the web app does not ask and both stay off unless you turn them on in Settings. Your choice and the version of these texts are kept on your device and sent with each batch of statistics or replay chunk, so that we store only what you allowed.
A choice is the person's who made it: when another account signs in on the same browser or computer, or someone signs in after a choice made signed out, both are off again and the app asks again. A usability replay ends when you sign in or out.
- Feature statistics count what is used, never with what: the events are a fixed list (a module opened, a solve with its duration and error code, an example opened, a report or export made, the assistant used, a few features opened), checked again on our servers, which drop anything else.
- Usability replays exist only in the web app. A recorder in the page writes down how the page changes; it blanks out what section 3 lists before anything leaves the browser, pauses while a private screen is open, and stops after ten minutes without input or 30 minutes in all. Some sessions may not be recorded at all (sampling).
- Diagnostic reports show everything they contain before you send them. A screenshot shows what is on screen, your project included: it is sent only if you add it and keep it.
From the network address of the request we derive your approximate location (country and city) when you send feature statistics or usability replays; the address itself is not stored. We look the address up in a database of address ranges kept on our own servers (from DB-IP, section 6), so the address goes to no one else, and we keep only the country and city, never the address or anything more precise.
All of it goes only to our own servers (Google Cloud and Firebase, section 6); we use no third-party analytics or recording service. Storing what the apps need to work (your settings, draft, session and licence) is necessary to provide the service you asked for (§ 25(2) TDDDG); the random id for feature statistics and usability replays is stored only with your consent (§ 25(1) TDDDG).
6. Service providers
We use these processors, under their data processing terms:
- Google Cloud and Firebase (Google LLC): sign-in, account data, cloud project storage, feature statistics, usability replays and feedback, hosting and server functions. Region: United States (us-central1).
- Claude, Anthropic's AI model, through the Anthropic API (Anthropic PBC): answers assistant requests. Under their commercial terms inputs and outputs are not used to train models.
- DB-IP (db-ip.com): the source of the offline database of network address ranges with which our servers derive the approximate location (country and city) of feature statistics and usability replays (“IP geolocation by DB-IP”, licensed CC BY 4.0). We download the database to our servers; no data about you is sent to DB-IP.
- Brevo (Sendinblue SAS, France): sends the replies we write from support@axomek.com and the welcome email. It receives the message and your email address; email to us reaches us through our domain's mail forwarding. Brevo counts how often our emails are opened and their links clicked, for delivery statistics: it adds a small image to each email and passes the links through its own address, but records these counts anonymously, not against your address or profile. If your mail app blocks the image, the email works the same.
7. International transfers
Our servers and most providers are in the United States. Transfers there rely on the EU–US Data Privacy Framework where the provider is certified under it (Google LLC is), and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
8. How long we keep data
- Account data, plan history, cloud projects and assistant limits: until you delete your account.
- Earlier saves of a cloud project: the 20 most recent, each for 90 days after a later save replaced it, then deleted automatically.
- Deleted cloud projects (the trash, with their earlier saves): 30 days, then deleted automatically, unless you restore them or delete them for good sooner.
- Your settings and own templates: until you change or delete them, or delete your account.
- Daily assistant counts: 13 months, then deleted automatically.
- Records of administrator actions: kept after an account is deleted, for accountability, but without its email address (only the anonymous account id remains).
- Feature statistics: 13 months, then deleted automatically.
- Usability replays: 30 days, then deleted automatically.
- Feedback, diagnostic reports and answers to quick feedback questions: until 90 days after we mark them resolved, and at most 12 months.
- Daily request counts: two days.
- The record that the welcome email was sent: 30 days. Your choice of emails, the record of the sign-up notice and the hash of the unsubscribe code: until you delete your account.
- Server logs: as kept by Google Cloud, normally up to 30 days; Brevo's logs of the emails it sends for us, as kept by Brevo.
Deleting your account (Settings → Account → Delete account) removes your cloud projects with their summaries and thumbnails, their earlier saves and the trash, your settings and own templates kept with the account, assistant counts and limits, licences, access keys, plan history, the feature statistics, usability replays, feedback, reports and answers sent while signed in, your choice of emails, the record of the sign-up notice and the record of the welcome email, and the account at once, and removes your email address from the records of administrator actions. What was sent while signed out carries only the random id and is not linked to you; it expires as above, and turning feature statistics and usability replays off deletes the id on your device. Copies in provider backups expire on their normal schedule.
9. Your rights
Under the GDPR you can ask for access to your personal data (Art. 15), its correction (Art. 16) or deletion (Art. 17), restrict processing (Art. 18), receive it in a portable form (Art. 20; projects are plain JSON files you can download), object to processing based on legitimate interest (Art. 21) and withdraw consent at any time (Art. 7(3)). Write to support@axomek.com; we answer within one month. You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work, or the one responsible for us in Germany (Art. 77).
10. Security
Data travels encrypted (HTTPS). Cloud projects are readable only by your account. Licences are signed so they cannot be forged. No system is perfectly secure; tell us at support@axomek.com if you find a weakness.
11. Children
The service is for professionals and students aged 16 and over. We do not knowingly collect data from children.
12. Changes
We will publish changes here with a new date, and tell account holders by email before material changes take effect.