virus.sucks in vitro veritas

Privacy Policy

Last updated: 2026-10-22

Lucentia gGmbH is a German non-profit and regulated under Europe's strict GDPR privacy rules. We do not want any of your personal data and we go to great lengths to avoid collecting it unless it's absolutely necessary.

The virus.sucks website does not collect, process or shared any of your personal data (PII). We operate our own dedicated servers hosted at Hetzner in Germany, without involving any third-party service providers.

This is why we don't have a cookie banner - we don't need one!

Who is responsible

Lucentia gGmbH
Auguststr. 71
10117 Berlin, Germany
E-mail: hi [ät] virus.sucks

See the Impressum for details. We are not required to appoint a data protection officer.

Hosting, logs and cookies

The website and the backend behind the Pluslife Analyzer runs on our own infrastructure. We do not use any CDNs or intermediaries like Cloudflare, and our website does not load any third-party resources or trackers.

We do not store any IP addresses in our logs, including our web server access logs. Connections are encrypted (TLS). There are no cookies, analytics, tracking pixels, embedded fonts or anything of the sort.

Anonymous test data

The Pluslife Analyzer application uploads test data results to our backend. This data is fully anonymous. It contains no identifiers, only low-entropy information that cannot single anyone out, and since our servers do not log any IP addresses or other identifiable information, it cannot be de-anonymized. This data is not considered PII under GDPR and no legal basis is required for processing it, but we are declaring it here for full transparency.

The upload happens automatically while a test runs and when it finishes. Test results can be shared using a link you can give to someone else so that they can follow your test and see its result. We also use the uploaded data for research into how the tests behave in practice (curve shapes, run times, invalid rates, differences between device and kit variants), and we may publish anonymous aggregated statistics derived from it.

This is how the data uploaded to our servers looks like:

test_id: "9b3f0c6e-1d2a-4f7b-8c1e-5a6d7e8f9a0b"    # random per test, generated by your browser
upload_key: "\x8f\x14\xe4..."                      # random per test; only a hash is stored
snapshot {
  device {
    family: DEVICE_FAMILY_PM005        # PM001, PM003, PM005, PM001 Ultra or PM003 Ultra
    hw_version: "HV1.0.0"              # Minidock hardware version (truncated)
    sw_version: "SV1.1.0"              # Minidock software version (truncated)
    manufactured: "2026-05"            # month the device was made at the factory
  }
  state: TEST_STATE_DONE
  event: TEST_EVENT_TEST_FINISHED
  kit { brand: "PL" proj_id: 21 version: "CV21.24.12.9" }
  temperature_samples { time_ds: 300 temperature_c: 66.98 }
  temperature_samples { time_ds: 20700 temperature_c: 63.02 }
  samples { channel: 0 time_ds: 300 temperature_c: 66.98 value: 60 }
  samples { channel: 3 time_ds: 300 temperature_c: 66.98 value: 62 }
  samples { channel: 3 time_ds: 20700 temperature_c: 63.02 value: 241 }
  result {
    overall: RESULT_NEGATIVE
    channels: [RESULT_NEGATIVE, RESULT_NEGATIVE, RESULT_NEGATIVE, RESULT_POSITIVE,
               RESULT_NEGATIVE, RESULT_NEGATIVE, RESULT_NEGATIVE]
    groups: [RESULT_POSITIVE, RESULT_NEGATIVE, RESULT_NEGATIVE, RESULT_NEGATIVE]
    invalid_reason: INVALID_REASON_NONE
  }
  lot { lot: 21 mfg: "2026-05-06" expires_on: "2027-06-05" }   # the card's batch
  total_time_s: 2100
  app_version: "cb95ae2"                                       # the app's release
  project_config: PROJECT_CONFIG_V4    # program format: V1 (PM001, PM003) or V4 (PM005, Ultra)
  stop_source: STOP_SOURCE_USER        # only if you stopped the test with the app's Stop button
  # observations: [OBSERVATION_RECONNECTED, OBSERVATION_ATTACHED]   PM001, PM003 only: why the app missed part of the test
}

The details about the device and test kits is information shared by many other users, and cannot be used to individually identify you.

What it deliberately does not contain:

During a test run, the Analyzer offers a few optional questions that help our research. Anything you enter here is never shown on the test's share page and will only be visible to us. This is what the dataset looks like:

user_metadata {
  kit_mfg: "2024-05-11"
  sample_site: SAMPLE_SITE_NOSE
  acidic_food: ACIDIC_FOOD_NO
  purpose: TEST_PURPOSE_EXPERIMENT     # only if you marked it as "not a real test"
  note: "Second try today."            # free text, see below
}

The link you can use to share your test result contains only a random test_id. Anyone who has the link can see the test, including its result, and we cannot tell who they are, either. Share it as you would share the result itself - it is functionally the same as if you sent someone a screenshot of your test results, just more convenient.

If you would rather not share your test data, you can click here to disable any backend functionality, including test sharing:

Turning uploads off here needs JavaScript. Without JavaScript the Analyzer does not run, so it uploads nothing either.

This anonymous data is very valuable to the community since it lets us perform quality assurance on Pluslife's products as an independent third party.

Webhooks

If you enter a webhook address in the Analyzer's settings, the app sends your test data directly to that address. We are not involved and do not see it. See the webhook documentation.

Error reporting

When any virus.sucks app encounters an error, an anonymous error report is sent to our servers. Any identifying metadata is stripped from this error report inside your browser, and no IP address is logged.

When you email us

We use Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for e-mail. When you write to an @lucentia.org or @virus.sucks address, your e-mail address, the content of your message and anything you attach are processed by Google on our behalf under Google's data processing terms, the EU standard contractual clauses and Google's certification under the EU-US Data Privacy Framework, which may involve processing outside the EU (though we have configured Google Workspace to process data exclusively on EU servers).

The legal basis for handling your message is Art. 6(1)(b) GDPR where you contact us about a service or a request of yours, and otherwise our legitimate interest in answering correspondence (Art. 6(1)(f) GDPR). We keep correspondence for as long as needed to deal with it, and longer only where commercial or tax law requires us to retain business records (up to ten years under German law). We do not use your personal data - including your name and email address - for anything else and do not pass it on to anyone else outside of Lucentia.

We hope to migrate to self-hosted email eventually, but as any infrastructure engineer can tell you, it is famously difficult to run a secure and reliable email server yourself, which would exceed our current resources.

This site links to other sites, for example the app store page of the Bluefy browser for iOS. Their respective privacy policies apply.

Your rights

Where we do process personal data about you (in practice: your e-mails to us, and anything identifying you that you entered into a test's free-text note despite our request), you have the rights under Art. 15 to 21 GDPR to access, correct, delete and receive that data, to restrict or object to its processing, and to withdraw any consent you gave. Write to the address above. You may also complain to a data protection authority; for us that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

For the anonymous test data these rights do not apply, because there is no way, for us or anyone else, to tell which test is yours.

Changes

We will update this page when the site or the Analyzer changes what it does with data. The date of the current version is at the top.