Privacy policy
Last updated: 27 October 2026
This policy explains which personal data Companas (companas.org) processes, why, and what rights you have. It applies to the website, the Companas web app and the Companas agent that you install on your devices.
1. Controller
Flamur Veliqi, Weektab
Vitusstraße 65, 41061 Mönchengladbach, Germany
Email: [email protected] · Contact form
We are not required to appoint a data protection officer. For any question about your data, write to the address above.
2. What Companas is, and where your files are
Companas lets you reach storage you already have: devices you link (for example a Raspberry Pi, PC or Mac) and external storage you connect (S3, WebDAV, FTP, SFTP). Your files stay on your devices and storage; Companas does not keep copies of them. When you upload, download or open a file through Companas, it passes through our server on its way (see section 7).
3. Hosting
Companas runs on servers of dogado GmbH, Saarlandstraße 25, 44139 Dortmund, Germany, in a data centre of KAMP Netzwerkdienste GmbH in Germany. They process data on our behalf, bound by our instructions, under a data processing agreement (Art. 28 GDPR). Legal basis: Art. 6 (1) (b) and (f) GDPR (providing the service reliably).
4. Cloudflare
The domain companas.org is served through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which protects the site against attacks and delivers it quickly. Every request, including your IP address, browser information and the data you transfer, passes through Cloudflare’s network, where the encrypted connection ends before it is passed on to our server. Cloudflare is certified under the EU-U.S. Data Privacy Framework; data may be processed in the USA. Legal basis: Art. 6 (1) (f) GDPR (security and availability of the service). More: cloudflare.com/privacypolicy.
5. Visiting the website
When you open a page, the web server automatically records technical data: IP address, date and time, the page requested, the referring page and your browser and operating system. We need this to deliver the pages and to detect and fend off misuse. These log files are deleted after a short time, at the latest after 30 days, unless a security incident requires keeping them longer. Legal basis: Art. 6 (1) (f) GDPR.
We don’t use analytics, tracking or advertising, and no third-party content (such as fonts or videos) is loaded from other servers; fonts are delivered from our own server.
6. Your account
- Sign-up and login: your email address and name. There are no passwords: we send a 6-digit code by email that is valid for 3 minutes; only a keyed hash of the code is stored. To protect accounts, failed attempts are counted per address.
- Profile: if you enter them in Settings, your display name, phone number and address. These details are optional.
- Organizations: if you create or join an organization, its name, the members’ email addresses, roles, departments and invitations.
- Notifications: when something is shared with you or you are invited, we store a notification for your email address so you can see it in the app.
Legal basis: Art. 6 (1) (b) GDPR (providing the service you signed up for). We keep this data while your account exists and delete it when the account is deleted.
7. Using Companas: devices, storage and files
- Linked devices: the Companas agent sends the device’s name, host name, operating system, agent version and the size and usage of the storage folder, and keeps a connection open so the website can send it requests (list a folder, upload, download, rename, delete).
- External storage: the login details you enter (address, username, password or key). Passwords and keys are stored encrypted.
- Files: when you upload, download or open a file, it is streamed through our server without being stored. Large uploads to external storage are held in a temporary file on our server until they’re complete and are deleted right after; unfinished uploads are deleted automatically.
- Information about files: to show the file browser we process file and folder names, sizes and dates. We store who uploaded or created an item (shown in organizations), what you shared with whom, and guest links (with an optional password, stored only as a hash, an expiry date and a usage count).
Legal basis: Art. 6 (1) (b) GDPR. You decide which files are on your devices and storage. If you share files with others, make sure you’re allowed to.
8. Malware scanner
To protect you and the people you share with, Companas checks files for known malware:
- Uploads and downloads are scanned with ClamAV on our own server while they pass through, in memory and without being stored. Their fingerprints (SHA-256, SHA-1, MD5) are compared with lists of known malware.
- Files placed on a linked device directly: the agent sends only the fingerprints of new or changed files, never the files themselves. They are compared on our server with the fingerprint lists of ClamAV and MalwareBazaar (abuse.ch), which we download regularly. No fingerprint or other data of yours is sent to these providers.
- Stored: the result of the last check for each file (path, size, fingerprint, result) and any findings with the action taken. If something is found, the owner of the storage (or the organization’s owners and admins) is notified.
You can turn the checks off in the Malware Scanner settings. Legal basis: Art. 6 (1) (f) GDPR (security of the service and its users, Recital 49 GDPR) and Art. 6 (1) (b) GDPR. The scanner is basic protection and can’t guarantee that a file is free of malware.
9. Emails
We send emails that belong to the service: login codes, invitations, notices about shares and changes to your account. They’re sent through the mail servers of our hosting provider (section 3). Legal basis: Art. 6 (1) (b) GDPR. We don’t send newsletters.
10. Contact form and email
If you contact us, we process your name, email address and message to answer you. Messages from the contact form are sent to us by email. Legal basis: Art. 6 (1) (b) GDPR if your request is about the service, otherwise Art. 6 (1) (f) GDPR. We delete the messages once your request is settled, unless we have to keep them by law.
11. Cookies and browser storage
Companas only uses what is technically necessary for the service (§ 25 (2) TDDDG); no consent is needed and nothing is used for tracking:
companas_session: keeps you logged in (up to 7 days).companas_ws,companas_last_org: the workspace you’re in (Personal or an organization).companas_view_…: whether you prefer the list or grid view.companas_guest_…: lets a guest browse a shared folder for up to an hour after opening a guest link.- Browser storage (
companas-theme,companas-files-sort): light or dark mode and the sort order of files. This stays in your browser.
12. Organizations using Companas
When an organization uses Companas for its team, the organization decides which files and data are processed. For the members’ files and data, the organization is the controller and we process them on its behalf (Art. 28 GDPR).
13. Recipients
We only pass on data to the service providers named above (hosting, Cloudflare) and to the people you share with or invite. We don’t sell data. We disclose data to authorities only where the law requires it.
14. Your rights
You have the right to:
- access the data we hold about you (Art. 15 GDPR),
- have incorrect data corrected (Art. 16 GDPR),
- have your data deleted (Art. 17 GDPR),
- restrict processing (Art. 18 GDPR),
- receive your data in a common format (Art. 20 GDPR),
- withdraw a consent you gave, with effect for the future (Art. 7 (3) GDPR).
Right to object (Art. 21 GDPR): where we process data based on Art. 6 (1) (f) GDPR, you can object at any time for reasons arising from your particular situation. We then stop, unless there are compelling legitimate grounds or the processing serves legal claims.
To use your rights, write to [email protected]. You can also complain to a data protection supervisory authority, for example the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, ldi.nrw.de.
15. Security
Connections are encrypted (HTTPS). Login codes, device secrets and guest link passwords are only stored as hashes; passwords and keys of external storage are stored encrypted.
16. Changes
We update this policy when Companas changes or the law requires it. The current version is always available on this page.