Privacy policy#

We keep this short because we keep the data short. icons does not run advertising, does not sell personal data, does not enrich profiles with third-party sources, and sets no cookies of any kind on the icon endpoints. We do not log IP addresses, user agents, or referrers. Period.

Who is responsible#

The controller for personal data processed on the icons platform is the operator named in the Imprint (botBrains GmbH); contact details are there too. For the requests a customer's website sends to our icon endpoints on behalf of its visitors, the customer decides to embed us and we act as processor - see the Data processing agreement.

What we process#

Icon requests (/domain/… and /t/…/domain/…) are the heart of the service, so here is exactly what happens when a browser requests an icon:

• We serve the PNG. We write no log line for it - no IP address, no user agent, no referrer, no timestamp tied to a visitor.
• For rate limiting only, the request's IP address is reduced in memory to a salted, truncated hash. The salt rotates every day at 00:00 UTC and the counters live only in memory - they are never written to disk, and after the rotation not even we can connect yesterday's hash to today's. This is the only per-visitor state in the entire system.
• On the tenant path, the request's Referer/Origin host (e.g. app.example.eu - never the full URL) is compared in memory against the tenant's verified domains to select the right rate limit. It is not stored.

The icon cache stores, per requested domain: the fetched favicon data, the rendered PNG, and fetch metadata (source URL, timestamps, ETag). This is public data about websites, not personal data about visitors.

Account data (console users only): your email address, name, and organization, managed by our self-hosted identity service running on our own servers in Germany. Our application database (SQLite) stores your tenant's organization ID, its public tenant ID, and the domains you claimed with their verification tokens and timestamps.

The console keeps your session token in browser storage on your device; we set no analytics or tracking cookies.

Why we process it#

• To serve icons and operate your tenant - the service you are using (Art. 6(1)(b) GDPR).
• To keep the service available for everyone - the in-memory rate limiting described above (Art. 6(1)(f) GDPR, our legitimate interest in a safe and available service). EU law expressly recognizes processing "strictly necessary and proportionate for the purposes of ensuring network and information security" - including preventing abuse and preserving service availability - as a legitimate interest (Recital 49 GDPR). Your consent is not required for this security processing, and no consent banner is shown because none is needed: nothing is stored on your device and nothing about you is stored on ours. The design deliberately minimizes even this processing to a daily-rotating in-memory hash.
• To comply with legal obligations where they apply to us (Art. 6(1)(c) GDPR).

Where your data lives#

All production systems, including our identity service, run on Hetzner Online GmbH servers in Germany. Requests are answered exclusively from the EU and personal data is not transferred to third countries. TLS certificates come from Let's Encrypt, which receives only domain names during issuance. Hetzner is our sole subprocessor - see the Subprocessor list.

To build the icon cache, our servers fetch favicons from the requested domains and from public icon indexes, and domain verification queries DNS-over-HTTPS resolvers (operated by Cloudflare and Google). In all cases only domain names are transmitted - never anything about your visitors, whose requests are answered exclusively from the EU.

How long we keep it#

• Icon-request data: not collected, so nothing to retain. The in-memory rate-limit counters vanish daily with the salt rotation and on every restart.
• Cached icons: retained and refreshed on a rolling basis; they contain no personal data.
• Account data and claimed domains: for as long as your account exists; deleted with the account.

Your rights#

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21). To exercise them, contact us at the address given in the Imprint. You also have the right to lodge a complaint with a supervisory authority (Art. 77); for us the competent authority is the Berlin data protection authority.

Note that for icon requests we hold nothing that could identify you: there is no stored record of who requested which icon, so access and erasure requests about icon traffic have - by design - an empty answer.

Last updated: August 2026.