Privacy Policy

Last updated: October 17, 2026

This Privacy Policy explains how Aetherium ("Aetherium", "we", "us", or "our") processes personal information when you visit our websites, create or use an account, use Aetherium Drive, use Aetherium Mail, use supported applications, or interact with other services operated as part of the Aetherium ecosystem (collectively, the "Service").

The information processed depends on the features you use, your configuration, and how the relevant Service operates. This policy should be read together with our Terms of Service.

1. Scope and responsibility

Aetherium provides software, websites, account functionality, and related services. Different features may process different categories of information. Not every category described in this policy is collected from every user.

Where applicable law requires identification of a data controller or other responsible legal entity, that entity must be identified in the appropriate legal documentation. The name "Aetherium" alone does not identify a legal entity or establish a particular company's registered address.

2. Information we may process

Depending on the Service and the features you use, information processed may include the following categories:

Account information: usernames, email addresses, account identifiers, profile information, and other details you provide.
Authentication information: password verification data, cryptographic password hashes and salts where implemented, session identifiers, and authentication events. Passwords should not be stored in plaintext.
Device information: device identifiers, device names, manufacturer, model, application version, and other technical information sent by a supported client.
Drive information: files you choose to upload, storage usage, filenames, file sizes, timestamps, object identifiers, and other metadata needed to provide storage and file management.
Mail information: email addresses, message contents, attachments, delivery information, synchronization state, and related metadata to the extent required by the Mail features you use.
Subscription information: plan selection, subscription status, billing intervals, transaction references, trial status, cancellation records, and storage quota information.
Technical and security information: IP addresses, request timestamps, user-agent information, error reports, authentication events, rate-limit events, and security logs.
Activity information: activity records submitted by a client or generated by a Service feature that requires those records.
Communications: information you submit through any forms or other communication mechanisms that Aetherium actually makes available.

The exact information processed depends on the relevant implementation. We do not claim that every listed category is collected in every application or for every account.

3. How we use information

Information may be processed for the following purposes, as applicable to the Service:

Creating and managing accounts.
Authenticating users and maintaining sessions.
Providing Drive storage, file access, and synchronization.
Providing Mail delivery and synchronization features.
Displaying account, device, and activity information.
Calculating storage usage and enforcing plan limits.
Processing subscriptions, payments, cancellations, and refunds.
Detecting fraud, abuse, unauthorized access, and security incidents.
Diagnosing errors and maintaining the Service.
Meeting legal obligations and responding to valid legal requests.

We should not use personal information for purposes incompatible with the original purpose of collection unless permitted by applicable law.

4. Legal bases for processing

Where applicable law requires a legal basis for processing, the relevant basis may include:

Contract: processing necessary to provide an account or a Service feature you request.
Legitimate interests: processing necessary for proportionate security, fraud prevention, service reliability, and abuse prevention, where permitted by law.
Legal obligation: processing necessary to comply with applicable legal requirements.
Consent: processing for which consent is required and has been obtained.

The appropriate legal basis depends on the particular processing activity and the laws applicable to the user and the responsible entity.

5. Cookies and authentication sessions

The website may use cookies or similar technologies to maintain sessions, remember preferences, and provide essential functionality.

Where implemented, authentication cookies should use appropriate security attributes such as HttpOnly, Secure, and an appropriate SameSite setting. Actual cookie names, domain scope, expiration, and attributes depend on the deployed authentication system.

The website may store a theme preference in browser localStorage under the key aether.theme. This preference controls the display theme and is not itself an authentication credential.

We do not intentionally expose authentication session secrets to ordinary page scripts when the authentication system is configured to keep those secrets in protected cookies. This statement does not guarantee the behavior of every third-party application or every future implementation.

6. Aetherium Drive

When you use Aetherium Drive, the files you upload and the associated information may be processed to provide storage, file retrieval, folder management, synchronization, quota enforcement, integrity checks, and account administration.

Drive infrastructure may include Cloudflare R2 and associated services where configured. Relevant metadata may be processed by the systems needed to store, retrieve, secure, and manage your files.

Access to Drive features and available storage may depend on your subscription. Subscription expiration, cancellation, account deletion, and storage retention can have different effects. Refer to the applicable plan terms and Terms of Service for the rules governing access to stored files.

You are responsible for ensuring that you have the right to upload and store your files. You should keep independent backups of important information. Do not assume that a file stored in Drive is permanently retained or that deleting a local copy deletes every remote copy immediately.

7. Aetherium Mail

When you use Aetherium Mail, information may be processed to provide email addressing, message composition, delivery, synchronization, account management, and abuse prevention. The categories of information involved depend on the features you enable.

Mail data may include message contents, sender and recipient addresses, timestamps, attachment data, and delivery or synchronization metadata where required to provide the relevant feature.

Some implementations may store mailbox data locally on supported devices and may use temporary cloud copies for delivery or synchronization. The precise storage behavior depends on the deployed Mail implementation. Temporary delivery copies should not be treated as an independent backup.

Email is not inherently confidential against every possible intermediary. Depending on the delivery path and technical configuration, email service providers and recipient systems may process message data and associated metadata.

8. Android applications and device activity

When an Android application interacts with the Service, it may transmit device and application information needed for authentication, device management, synchronization, and requested activity features.

Depending on the application, this may include a device identifier, device name, manufacturer, model, application version, and activity events that the client is designed to submit.

The application should request only the device information and permissions reasonably necessary for its functionality. Information available to an application depends on Android permission controls and the application's implementation.

9. Security and abuse prevention

Technical and security information may be processed to protect accounts, prevent unauthorized access, enforce rate limits, investigate incidents, and maintain service reliability.

Where configured, Cloudflare Turnstile and related infrastructure may process technical request information to distinguish legitimate traffic from automated abuse. Such processing is subject to the relevant provider's documentation and privacy terms.

Security logs and abuse-prevention records should be access-controlled and retained only as reasonably necessary for the applicable security or legal purpose. No online service can guarantee absolute security.

10. Service providers and third parties

Aetherium may rely on third-party providers to operate particular parts of the Service. Depending on the features deployed, these may include:

Cloudflare: hosting and application infrastructure, Workers, D1, R2, security features, and bot protection, where used.
Paddle: payment processing, subscription administration, invoicing, tax handling, or refunds, where Paddle is the payment provider for the transaction.
Other necessary providers: infrastructure or technical services actually used to provide the requested feature.

These providers may process information under their applicable agreements, privacy notices, and legal obligations. Their processing is governed by the relevant provider terms and applicable law.

We do not claim that a provider processes a particular category of information unless that processing occurs as part of the relevant integration.

11. Sharing and disclosure

Personal information may be disclosed to service providers when necessary to operate the Service, to the extent permitted by applicable law.

Information may also be disclosed where necessary to comply with a binding legal obligation, respond to a valid request from a competent authority, protect the rights and safety of users, or investigate serious abuse and security incidents, subject to applicable law.

We do not describe personal information as being shared with a particular recipient unless that sharing is part of the relevant Service or is otherwise legally permitted.

12. International data processing

Service providers may process information in countries other than the country in which you live. International processing and transfers are subject to applicable legal requirements.

Where required, appropriate safeguards must be used for international transfers of personal information. The safeguards applicable to a particular transfer depend on the relevant countries, provider, and legal framework.

13. Data retention and deletion

Information should be retained only for as long as reasonably necessary for the purpose for which it is processed, subject to applicable legal obligations, security needs, and legitimate record-keeping requirements.

Different categories of information may have different retention periods. For example, session information may expire or be removed separately from billing records, security logs, account records, or files stored in Drive.

Deletion from one system may not immediately remove information from backups, temporary copies, or systems operated by providers. Where such copies exist, they should be handled in accordance with the applicable retention schedule and legal requirements.

Specific retention periods should be documented when they are established by the deployed systems. This policy does not promise a fixed deletion deadline unless that deadline is expressly stated.

14. Your privacy rights

Depending on your location and applicable law, you may have the right to:

Request access to personal information about you.
Request correction of inaccurate information.
Request deletion of personal information where applicable.
Request restriction of certain processing.
Object to certain processing where the law provides that right.
Request a portable copy of eligible information.
Withdraw consent where processing relies on consent.
Lodge a complaint with the competent data protection authority, where applicable.

These rights are subject to applicable legal conditions and exceptions. We may need to verify your identity before processing a request to protect against unauthorized disclosure or deletion.

This website does not currently advertise a dedicated customer support channel. Do not assume that a support form, support email address, or privacy request portal exists unless it is explicitly published by Aetherium. A verified privacy contact mechanism should be published before this policy is relied on as the complete process for exercising privacy rights.

15. Account deletion

If account deletion is available through the application, use the deletion controls provided there and review any warnings about files, messages, subscriptions, or other data that may become inaccessible.

If no account deletion mechanism is available, this page does not imply that a functioning deletion request channel exists. Aetherium should provide an accessible method for submitting applicable privacy requests.

Deleting an account may affect access to Drive files, Mail features, device associations, and subscriptions. Some information may need to be retained where required by law or reasonably necessary for security, fraud prevention, disputes, or legally required accounting. Any such retention remains subject to applicable law.

16. Children's privacy

The Service is not intended for use in circumstances where a user is legally prohibited from using it. Where applicable law requires parental consent or additional safeguards for children, those requirements must be followed.

We do not knowingly process children's personal information in violation of applicable law. If information has been collected unlawfully, it should be handled in accordance with the relevant legal requirements.

17. Security safeguards

Appropriate technical and organizational safeguards should be used to protect personal information. Depending on the Service, these may include encrypted transport, protected authentication sessions, server-side authorization, input validation, access controls, rate limiting, and protected storage infrastructure.

Security depends on the actual configuration and implementation of the Service. Listing a safeguard in this policy is not a substitute for implementing, testing, and maintaining it.

No website, application, or storage system can guarantee that information will always be secure. Users should protect their credentials and maintain independent backups of important data.

18. AetheriumOS and the web installer

Where AetheriumOS builds and installation features are offered, visiting release pages or downloading builds may result in the processing of technical request information such as IP addresses, request timestamps, and security logs by the infrastructure serving those resources.

If an installer offers an optional WebUSB feature, the browser may communicate directly with a device you select after you grant the relevant browser permission. The exact data exchanged depends on the installer implementation and the device operations you authorize.

We do not claim that device contents are never transmitted to a server unless that behavior has been verified for the actual installer and its network requests.

19. Changes to this Privacy Policy

This policy may be updated when the Service, its infrastructure, its data processing practices, or applicable legal requirements change.

The current version will be published on this page with a revised update date. Where applicable law requires advance notice or consent for a material change, the required notice or consent must be provided.

20. Contact and privacy requests

Aetherium does not currently provide a dedicated customer support channel on this page. No unverified email address or nonexistent support portal is listed here.

Before publishing this policy as final, provide a working and accessible privacy contact method or implement an appropriate privacy request mechanism within the Service. Applicable data protection obligations may require a way for individuals to exercise their rights regardless of whether a general customer support team exists.

For payment-related matters, consult the transaction receipt and the payment provider's published procedures, where applicable. Payment providers may be able to assist with their own transactions, but this does not replace Aetherium's obligations as applicable under privacy law.