Neruna Cloud Privacy policy

Privacy policy

This translation is provided for convenience; the German version is authoritative.

In short

Neruna Cloud manages configuration for Neruna Desktop. We don't store email, events or contacts – they stay on the organisation's mail server. Secrets such as certificate keys, account passwords and personal backups are encrypted before they reach us; we cannot read them. No tracking, no analytics, no third-party content.

Controller

Patrik Zimmermann, Switzerland – info@neruna.org. Personal data an organisation records about its staff in the portal is processed on its behalf; the organisation is responsible for it.

Portal account

For a login we store name, email address, a password hash (never in plain text) and the chosen language. We send system emails to it, for example to confirm the address or reset the password.

Organisation data

Company data (name, address, phone, email, website, logo) and the staff profiles the organisation records: name, email, position, department, phone numbers, photo and groups. Signatures and connection codes are built from them; we send connection codes by email on request, never the PIN.

Two-factor sign-in

For two-factor sign-in we store a secret for the authenticator app and recovery codes, both encrypted. They are only used to check the sign-in.

Audit log

We record sign-ins (also failed ones, with the email address entered) and changes in the portal with time, person and IP address – never passwords, keys or encrypted data. The organisation sees its entries; we delete them after two years.

Notifications

The organisation decides who gets notifications – portal access and further email addresses. We store these and which events were already reported.

Connected devices

Device name, operating system and version, signed-in user, version of Neruna Desktop, the public device key and the time of the last connection. The private key never leaves the device.

Encrypted data

S/MIME certificate keys, mail account passwords and personal backups are encrypted in the browser or the app. We only store this encrypted data and cannot decrypt it.

Chat

If the organisation uses the chat, we store the messages unencrypted for as long as it decides (1 day to 3 months) and delete older ones automatically. If the organisation switches the chat off, all messages are deleted.

Crash reports

Only with the person's consent does Neruna Desktop send crash reports: version, operating system, error message and the last log lines, cleaned of email addresses, names, servers and paths beforehand. We delete them after 90 days.

Autoconfig directory

At autoconfig.neruna.cloud we offer a public directory of server settings (based on Mozilla's database). Neruna Desktop queries it when an account is set up and the mail provider publishes no settings of its own. Only the domain of the email address is sent, never the address itself. To find domains hosted by a known provider, we look up their mail servers (MX) in the DNS and keep the result for at most one day. Per domain we count the lookups (number, first and last lookup, whether and how it was answered) – without email addresses and without IP addresses; domains asked for only once are deleted after 90 days. Otherwise the hoster's server log files apply.

Cookies

We only set technically necessary cookies: a session cookie for signing in (including the chosen language) and a protection cookie against forged requests. No cookies for advertising or statistics.

Hosting and server log files

Neruna Cloud is hosted by Infomaniak Network SA in Geneva (Switzerland); the data stays in Switzerland. The hosting provider stores technically necessary information such as IP address, time and page visited in log files, solely for secure operation.

Your rights

You can request information about your data at any time and ask for it to be corrected or deleted (Swiss Federal Act on Data Protection, FADP). For data your organisation recorded, please contact it first. Contact: info@neruna.org.

As of: October 2026