Privacy Policy

1Summary

First Move is built so that your work does not leave your device. In short:

• Your projects stay in your browser. There are no accounts, passwords or project databases on any server. We never receive your projects, so we cannot read, share or recover them.
• No tracking on the website. There is no analytics, no advertising, no social widget and no third-party script, font, map or embed. E-mails we send carry minimal tracking, described separately under E-mail tracking.
• Our web host processes the technical data that every website visit involves, such as your IP address, to deliver the site and keep it secure.
• If you write to us, we process your e-mail to answer it. Messages to agent@mail.firstmove.energy are answered by an AI system, after you confirm once (E-mail).
• AI features, once available, are optional. Your browser then talks directly to the AI provider you chose, with your own key. We receive neither the content nor the key.
• Your rights are set out under Your rights. To exercise them, write to human@mail.firstmove.energy.

You are not obliged by law or contract to provide personal data. Without the technical data of a request, however, your browser cannot load the site, and without your e-mail address we cannot reply to you.

2Controller

The controller responsible for the processing of personal data in connection with First Move (Art. 4(7) GDPR) is:

• Kiarash N.A., an individual who operates the service under the name First Move
• Postal address: Postfach 13 02 66, 20102 Hamburg, Germany
• E-mail: human@mail.firstmove.energy (read by a person)

We have not appointed a data protection officer, because none is required.

Please send privacy questions and requests about your rights only to human@mail.firstmove.energy. The address agent@mail.firstmove.energy is answered by an AI system and is not the channel for these requests (see E-mail).

3Visiting the website (hosting)

First Move is delivered by Vercel Inc. (USA, https://vercel.com). When you open a page, your browser sends a request to the host's servers, as with any website. Like any web host, the provider processes the following data in its server logs:

• your IP address;
• the date and time of the request;
• the requested address (URL);
• information about your browser and device (user agent);
• the response status, for example whether the page was delivered.

Purpose: to deliver the site to you and to keep it secure.

Language: when you open the site without choosing a language, it reads the language your browser prefers (the Accept-Language header) and redirects you to the English or German version. The NEXT_LOCALE cookie then remembers the language (en or de) and is sent with later requests. It contains no personal data. Details are in the Cookie Policy.

Every file the site needs, including its fonts, comes from the same site. Loading a page contacts no other server.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to deliver the website reliably and securely.

Recipient: Vercel Inc. processes this data on our behalf as a processor (Art. 28 GDPR).

Transfer outside the EU: the provider is based in the USA. The transfer rests on the provider's certification under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR).

Retention: the log data is kept as long as needed for these purposes and is not combined with other data.

4Your projects in the browser

Your projects, settings and choices are stored only in your own browser: in its IndexedDB database, its local storage and its session storage. None of this is sent to us or to the host. We never receive, see or store your projects, and there are no accounts or databases on any server. The Cookie Policy lists every cookie and storage entry by name.

• Export: you can export a project as a .firstmove.json file. It contains your inputs, is created in your browser and is saved where you choose.
• Import: a file you import is read and checked in your browser. It is not uploaded.
• Linked file: in Chromium-based browsers you can optionally link a project to a file on your own disk (File System Access API). Nothing is uploaded.
• Persistent storage: the app asks your browser to keep its storage persistent, so the browser is less likely to remove your projects on its own.

Legal basis: storing and reading this information on your device is strictly necessary to provide the service you expressly requested (§ 25(2) no. 2 TDDDG; Art. 5(3) ePrivacy Directive 2002/58/EC), so no consent is needed. To the extent the stored data is personal data, the legal basis is Art. 6(1)(b) GDPR (providing the app you use) and Art. 6(1)(f) GDPR (our legitimate interest in an app that keeps your work on your own device).

Retention: the data stays in your browser until you delete it. If you clear your browser's data for this site, your projects are deleted. We cannot recover them, because we never had them. Export your projects to keep a copy.

If you enter personal data about other people in a project, for example the names of contacts, you decide what is stored and you need a legal basis for it. That data, too, stays on your device.

5E-mail

You can write to us at two addresses:

• human@mail.firstmove.energy is read by a person. Use it for privacy questions, requests about your rights and legal matters.
• agent@mail.firstmove.energy is answered by an AI system.

Replies from agent@mail.firstmove.energy are written by an AI system. They may be wrong and are not legally binding statements. Send privacy and legal-rights requests only to human@mail.firstmove.energy.

What we process: your e-mail address, your name if you give it, the content of your message, attached files and anything else you include, and the time it was sent.

Purpose and legal basis: to read and answer your message. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in answering messages sent to us, and Art. 6(1)(b) GDPR where your message concerns your use of First Move under our Terms of Use.

E-mail provider: e-mails to and from both addresses are sent and received through Resend (Resend, Inc.) (https://resend.com), using its EU region. The provider processes them on our behalf as a processor (Art. 28 GDPR). Because it is a company based in the USA, access from outside the EU cannot be fully excluded. That transfer relies on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

AI-answered mailbox: the first time you write to agent@mail.firstmove.energy, we keep your message, encrypted, and send you a link to confirm once. Nothing is processed by AI before you confirm, and an unconfirmed message is deleted after 7 days. By confirming you accept the Terms of Use and e-mails about your request, with no marketing. After that, a decision model (Jev by TypeSafe AI, requested through Vercel's AI Gateway with zero data retention) checks each message for relevance and misuse, and Claude Haiku by Anthropic reads your message and any attached files to answer from our public docs and to fill in project values. Quick Check results are computed by First Move's own calculation, not by AI. We process mail only if the sender passes e-mail authentication (DMARC); other mail is ignored. Replies are written by an AI system, and you are told so (Art. 50(1) AI Act, Regulation (EU) 2024/1689). The legal basis is Art. 6(1)(b) GDPR for the service you ask for once you have confirmed, and Art. 6(1)(f) GDPR, our legitimate interest in checking messages and preventing misuse. If you do not want your message processed by an AI service, write to human@mail.firstmove.energy instead.

Rules of the AI mailbox: it handles questions about First Move and fifth-generation district heating and cooling. A first off-topic message gets one warning; a second one pauses the mailbox for you for 30 days. Attempts to manipulate the assistant, harassment and other misuse block the sender, and we are told what happened. For these records we keep your address only in hashed form; the conversation itself is stored encrypted (How long data is kept).

Retention: we keep e-mails as long as needed to handle your request and then delete them, unless statutory retention duties apply. The periods for agent@mail.firstmove.energy are listed under How long data is kept.

6E-mail tracking

The website itself has no tracking. E-mails are a separate matter: our e-mail provider Resend (Resend, Inc.) adds minimal tracking to the e-mails we send from both addresses.

• Opens: a tiny invisible image records whether and when an e-mail was opened.
• Clicks: links in our e-mails pass through the provider's tracking address, which records the click and then takes you to the link.

Purpose: to see whether our replies arrive and are read. We build no profiles, do not combine this with other data and do not use it for advertising.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in knowing that our replies reach you.

How to avoid it: if your e-mail program blocks images, no open is recorded. Links still pass through the tracking address.

Retention: the provider keeps these events with the e-mail for 30 days.

7AI features in the app

First Move plans two optional AI features: answering questions about your project data, and reading documents you supply (for example PDFs) to propose values for a project's fields. The AI transparency page shows whether they are available today and which providers you can choose. The providers are Anthropic and OpenRouter (including OpenRouter's Auto Router, which picks a model for each question).

When the AI features are available, they work as follows:

• Off until you set them up: nothing is sent to an AI provider until you set up a feature and use it.
• Your own key: your browser sends your request directly to the AI provider you chose, with your own API key. We run no AI server.
• We receive nothing: we never receive the content you send or your key, and we are not a processor for this data. The provider is a separate party, and its own terms and privacy policy apply to what you send. As with any server your browser connects to, the provider also sees your IP address.
• Your key stays with you: the key is kept only in your browser: for the current session only, or, if you choose, on this device, encrypted and locked with a 6-digit PIN. Five wrong PINs delete it. You can remove it in the app at any time.
• You decide what is sent: a question sends the question itself, the open project's inputs and results, and the documents you attach; nothing from your other projects. Do not send personal data of other people or confidential documents unless you are allowed to.
• You confirm every value: the AI only proposes values. Nothing is applied to a project until you confirm it.
• Set a spending limit: requests are billed to your account with the provider. Set a spending limit for your key there before you use it; the app asks you to confirm that you have.
• Chat history: kept only in your browser, per project. You can switch it off and clear it.

Keeping your key, your chat history and your settings for these features on your device is strictly necessary for a function you expressly set up (§ 25(2) no. 2 TDDDG). The AI transparency page explains in detail how the features work and what to check.

8Links to other websites and GitHub

First Move contains a few links to other websites: the Business Plan guidance links to geothermie-oesterreich.at, and the footer links to the source code on GitHub. Nothing is loaded from these sites until you follow a link. When you do, your browser connects to that site, and the site's own privacy policy applies.

The site sends Referrer-Policy: no-referrer, so a linked site is not told which First Move page you came from.

The source code is published at https://github.com/kiarash-na/first-move. If you open an issue, comment or submit a pull request there, GitHub processes your data under its own terms, and what you post is public. We read and use what you post there to handle your feedback or contribution (Art. 6(1)(f) GDPR).

9Recipients and transfers

We pass personal data only to the recipients below, and only as described on this page. We do not sell personal data and use none of it for advertising.

10How long data is kept

We keep personal data only as long as we need it:

• Server logs: as long as needed to deliver the site and keep it secure, and not combined with other data.
• E-mails: as long as needed to handle your request, then deleted, unless statutory retention duties apply.
• Projects and settings in your browser: they stay until you delete them. We hold no copy.
• Exported files: they stay wherever you saved them, under your control.
• AI mailbox (agent@mail.firstmove.energy): an unconfirmed first message for 7 days; the conversation for 30 days after your last message; warnings for 90 days; a pause for 30 days; a block until we delete it; your confirmation for 12 months after your last message. The e-mails themselves stay with Resend (Resend, Inc.) for 30 days, and its account logs are kept in the USA.
• AI features: what you send to an AI provider is kept according to that provider's terms. Your chat history stays in your browser until you clear it.

11Your rights

Under the GDPR you have the following rights regarding your personal data:

• Access (Art. 15): to learn whether we process data about you, and to receive a copy of it.
• Rectification (Art. 16): to have inaccurate data corrected.
• Erasure (Art. 17): to have your data deleted, unless we still have to keep it.
• Restriction (Art. 18): to have the processing limited, for example while the accuracy of the data is checked.
• Portability (Art. 20): to receive data you gave us in a common, machine-readable format.
• Objection (Art. 21): to object to processing based on our legitimate interests, as explained in the note below.
• Withdrawal of consent (Art. 7(3)): where processing relies on your consent (Art. 6(1)(a)), to withdraw it at any time with effect for the future. Processing up to the withdrawal remains lawful. None of the processing described on this page currently relies on consent.

Right to object: where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop the processing, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

To exercise a right, write to human@mail.firstmove.energy. Do not use agent@mail.firstmove.energy for this. We answer without undue delay and within one month (Art. 12(3) GDPR).

Your projects never reach us, so we cannot access, correct or delete them for you. You control them in your browser: you can change or delete them in the app, export them as a file, or clear the site's data.

Complaint: you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany, https://datenschutz-hamburg.de. You may also complain to the supervisory authority where you habitually live or work, or where the alleged infringement took place.

12No automated decisions

We make no decisions based solely on automated processing, including profiling, that have legal effects on you or affect you in a similarly significant way (Art. 22 GDPR).

• Quick Check and Business Plan results are calculations from published equations and default values, shown to you as an initial indication. They are not decisions about you.
• Replies from agent@mail.firstmove.energy are written by an AI system. They answer your message and are not decisions about you.
• When the AI features are available, they only propose values. You decide what to accept.
• The AI mailbox pauses or blocks a sender automatically after off-topic messages or detected misuse. This concerns only that mailbox and has no legal or similarly significant effect: you can always write to human@mail.firstmove.energy, which a person reads.

13Security

First Move is designed to keep the data that leaves your device to a minimum:

• The host delivers the site over an encrypted connection (HTTPS).
• Your projects are stored only on your device, not on any server.
• A Content-Security-Policy limits the connections the page may open to the site itself. On dashboard pages it also allows the two AI providers of the assistant (api.anthropic.com, openrouter.ai); your browser contacts them only when you use the assistant.
• The site loads no third-party scripts, fonts or embeds.
• The site sends Referrer-Policy: no-referrer, so other sites are not told which page you came from.

Your projects are only as safe as your device. Anyone with access to your browser profile can open them. Protect your device, and keep exported files as carefully as your other work files.

14Children

First Move is a screening tool for energy projects and is not directed at children. If you are under 16, use it only with the consent of a parent or guardian.

15Changes to this policy

We update this policy when First Move or the law changes, for example when the AI features become available or a service provider changes. The date and version shown at the top of this page tell you which text applies.

If the operator transfers the service to a company or another successor, that successor becomes the controller. We announce such a change on the website at least 30 days before it takes effect, as set out in the Terms of Use.

Questions about this policy: human@mail.firstmove.energy.