Privacy policy

Two things are separate here: the website ultimaos.com, which has no accounts, no forms and collects almost nothing, and the uOS product, which is end-to-end encrypted so that the operator cannot read your content.

Data controller

The company that will operate uOS is currently being formed; its name, registered office and jurisdiction will be published here as soon as they are available. Contact: security@ultimaos.com.

What this website collects

ultimaos.com is a static information website. It has no user accounts and no forms: when you request an invitation you do so on uos.sh, a separate service covered by its own notice. On this website we only have:

• Audience measurement (Google Analytics 4). It sets cookies and processes pseudonymous usage data (pages viewed, approximate location, device and browser). No accounts, no names, no content. See the cookie policy.
• Server logs. Our host (Infomaniak, Switzerland) keeps standard technical logs (IP address, timestamp, requested URL) for security and operation.

Purposes and legal bases (GDPR)

• Audience measurement — your consent, or our legitimate interest where permitted.
• Security and technical logs — our legitimate interest in operating a secure service.

The uOS product

uOS is designed so that we cannot read what you store or send. Encryption keys are generated on your device and never leave it; there is no password database; a hacked server or a stolen database only exposes scrambled data. Encryption is post-quantum (ML-KEM-1024 and ML-DSA-87, paired with X25519 and Ed25519). Account recovery uses a 3-of-5 secret-sharing scheme. See the security page.

Where your data is stored

Website and service data are hosted in Switzerland by Infomaniak. Switzerland benefits from an EU adequacy decision. Google Analytics may process data outside the EU/EEA under appropriate safeguards (Standard Contractual Clauses).

Retention

Analytics data is retained for the period set in Google Analytics. Invitation and contact emails are kept as long as needed to handle your request and our relationship. Technical logs are kept for a limited period by the host.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time. To exercise them, write to security@ultimaos.com. You may also lodge a complaint with your data protection authority.