Privacy

This is a translation for your convenience; the German version applies.

In short: this website sets no cookies and measures nothing. Glassbird sends no data to us. Thunderbird asks our server for updates to Glassbird and Glassbird Pro. Glassbird Pro activates a licence key with our activation service and has it checked there regularly, in the background about every 30 days. Otherwise it only connects to services you use yourself.

Controller

DMRC.IT, Dominik De Marco, Speicherstraße 100, 44147 Dortmund, Germany, glassbird@dmrc.it

This website

The site is static. It sets no cookies, uses no analytics or advertising services and loads no content from third-party servers, not even fonts. The site is hosted on a server of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, in Germany. When you visit, the web server processes your IP address, the time, the page requested and your browser identification, as technically necessary to deliver the site to you. The legal basis is Art. 6(1)(f) GDPR. It keeps no access log and writes down no error messages containing your IP address. Cloudflare resolves the names glassbird.app and relay.glassbird.app as DNS provider; the pages and all requests to our server do not pass through Cloudflare. A data processing agreement under Art. 28 GDPR is in place with netcup.

Glassbird

Glassbird runs entirely inside Thunderbird and sends no data to us. Thunderbird asks our server for updates, as described under “Updates”.

Report a Problem prepares a mail to us. You see what it contains (system details, error messages, Glassbird's settings and, if you like, a screenshot) beforehand, and you send it yourself. We use it only to reply to you and fix the error, and delete it once that is done. The legal basis is Art. 6(1)(f) GDPR.

Glassbird Pro

Glassbird Pro checks the trial period on your computer, without contacting us. It activates a licence key with our activation service, as described under “Licence check and activation”. Boards, notes, style profile and settings are kept in your Thunderbird profile. Passwords, tokens and AI keys you enter in Glassbird Pro are kept there unencrypted; Thunderbird's Primary Password does not protect them, and whoever can read the profile can read them too. A backup only includes them if you encrypt them with a password.

Other outside connections are made only for features you use, and go directly from your computer to the service in question. The privacy notices of those providers apply; we receive none of it, except with the unsubscribe relay below.

• AI provider of your choice: the text you have worked on or translated, including the text of a received mail, and the context you choose for it. With a provider on the net, Glassbird Pro asks before received mail goes there for the first time.
• Contacts from signatures (off by default): recognised inside Thunderbird, without any outside connection; only what you tick goes into your address book. Only when you click “Check more closely with …” on a mail do its From line (name and address) and the part Glassbird Pro takes for its signature, 1500 characters at most, go to the AI provider you set up. That is the text after the closing greeting or after “--”; Glassbird Pro leaves out a PS, list items and whole sentences, and whatever else stands in that part goes along. If the provider does not run on your computer or in your home network, Glassbird Pro asks the first time. That consent covers signatures and that provider only, not Translate, and you can take it back in the settings under “AI and writing tools”. Of the answer Glassbird Pro keeps only name, job title and company, in memory for the last 20 mails; they are gone once Thunderbird restarts.
• LanguageTool: your own text in the compose window, to your server or, with your consent, to the public one.
• Nextcloud, WebDAV, CalDAV, Obsidian, Joplin, Anytype: notes, tasks and mail you file there.
• Dashboard: news from the sites you choose, and your Home Assistant.
• Weather on the dashboard, only once you set up the tile and allow access to the two services: when you click “Search” or save a place not yet searched for, the place name you typed and your Thunderbird's language go to Nominatim of the OpenStreetMap Foundation in Cambridge, United Kingdom. For the forecast, the coordinates of the chosen place, shortened to four decimal places, then go to the Norwegian Meteorological Institute (MET Norway) in Oslo, Norway, as soon as the dashboard shows the tile and has no current forecast. Both services see your IP address and the identifier “GlassbirdPro” with the version number and our contact address, which they require; no cookies are sent. Norway is part of the EEA, where the GDPR applies. For the United Kingdom, the European Commission has found an adequate level of data protection (Art. 45 GDPR, Implementing Decision (EU) 2021/1772, extended by Implementing Decision (EU) 2025/2574). According to MET Norway, it keeps IP addresses for up to 90 days. The privacy notices of MET Norway and the OpenStreetMap Foundation apply. Glassbird Pro keeps the places searched for and the results on your computer for up to 90 days (7 days without a result). These searches pass through the network of Fastly, Inc. in the USA, which also sees your IP address and the place searched for; for Fastly, the adequacy decision on the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795) applies.
• Contact photos from Gravatar and place suggestions from Photon (OpenStreetMap), both off by default.
• Paperless-ngx, wallabag, Readeck, FreshRSS: attachments, articles and feeds you file there or fetch from there.
• Reader view and Read later: the page of the article you open, fetched from your computer.
• Unsubscribe: the unsubscribe request goes from your computer directly to the sender's server, as a one-click unsubscribe, as a mail from your own account or as a link in your browser; if you have set up a relay of your own, it goes through that. Only if you switch on Glassbird's unsubscribe relay and your network blocks the address do the unsubscribe address and your licence key, which holds your name and email address, go to our server relay.glassbird.app in Germany, which sends the request. It sees your IP address in doing so. To limit abuse, it counts in memory for one hour how many requests came from your IP address and with your licence, and then forgets the counts. It writes nothing to disk and keeps no log. The legal basis is Art. 6(1)(b) GDPR, for the counts Art. 6(1)(f) GDPR.
• DKIM check (off by default): Glassbird Pro looks up the key of a signed mail's sending domain at the DNS service you choose (Quad9, Mullvad or your own): when the mail arrives, when you click Check now on a mail, and once for the latest 500 mails of each inbox, in random order, each time you switch the check on and, if it was on already, after the update to Pro 0.2.4. The service sees the name of the key and your IP address, not the mail; the DNS server of the sender's domain learns, without your IP address, that the key was looked up, so on arrival roughly when the mail arrived. On a click on Check now the time of the lookup can reveal that you are reading the mail just then. If you also switch on Also check when opening, Pro also looks up keys when you read mail without a stored result, and the time of the lookup can then reveal when you open it. If fetching changed a mail's text, as Proton Bridge does, Pro shows in the bridge's account the result Proton wrote into the mail on arrival, but not for mail imported from Gmail; nothing goes out for that. If it changed only signed header fields, that result counts only after the key lookup. The check runs on your computer, and the results (at most 10,000) stay there.
• Business: your phone system or sipgate for calls. For transcripts, Pro downloads the speech recognition model from Hugging Face once; recognition then runs on your computer. If you set up a recognition server instead, the recording, with the voices of everyone on the call, goes there. If an AI provider is set up, Pro sends it the finished transcript for the summary. Pro uses a server or AI provider outside your computer and your network for this only if you switch on “Allow cloud services” under “Call Recording”.

The Glassbird MCP is off by default. If you switch it on, it only listens on your own computer and cannot be reached from outside. What an AI tool you connect to it reads through it, such as mail, notes, events or contacts, goes to that tool and, depending on the tool, to its provider; that provider's privacy notices apply.

Licence check and activation

A Glassbird Pro licence covers at most five devices at a time, a Business licence five per seat. Each Thunderbird profile in which you use Glassbird Pro with your key counts as a device. So that this limit holds and a key does not keep working after a refund, a chargeback or being published, Glassbird Pro activates your licence key with our activation service at glassbird.app/aktivierung and has it checked there regularly. The trial and Free need no activation, and nothing goes to the service for them.

When Glassbird Pro contacts the service: when you enter a key, click “Check now”, “Activate again” or “Activate this device”, have the devices of your licence shown, deactivate a device or remove the licence. If a new key replaces one of another licence, Glassbird Pro first deactivates this device with the old one. Without you doing anything, it asks in the background from 30 days after the last successful check and, until one succeeds, each time Thunderbird starts and at most every six hours, after too many requests no sooner than an hour later, after a block at most once a day. On top of that it asks at once when your computer's clock is more than two days behind or was set back by more than two days in total, and, while it is behind, as above each time Thunderbird starts and at most every six hours, even when the check succeeds. It also asks at once when the service asks for a new activation after it was set up anew.

What is transmitted:

• Your licence key. It holds your name, your email address, the licence ID, the day of the order or issue and the end of your updates, for Business also the plan and the number of seats, for a replacement key also which replacement it is. The service needs the whole key, as only then can it check our signature. It goes along with every request, not only the first.
• A random installation ID that Glassbird Pro creates once per profile. It reveals nothing about your device.
• When you deactivate another device, that device's identifier from the device list.

As with any connection, the server sees your IP address and your Thunderbird's identification (user agent, with version and operating system). Thunderbird also sends the language of your interface and a random identifier of Glassbird Pro in this profile (Origin, new after each reinstall of Glassbird Pro). The service stores none of this. Nothing else goes along: no version of Glassbird Pro, no time from your computer, no mail, notes or settings. The connection is encrypted with TLS.

What the service stores, for each activated device exactly four items:

• the licence ID, to count the devices per licence and show the device list;
• a device identifier that the service computes from the licence ID and the installation ID with a secret key of the server (HMAC), to recognise the device. It does not store the installation ID itself, and without the secret key the identifier cannot be matched to any device;
• the day of the first activation, for the device list;
• the day of the last check, for the device list and the deletion period.

When you deactivate another device, from the device list in Glassbird Pro or on the page below, the service stores the licence ID, the day of the deactivation and the day the place is free again, without the device's identifier. As long as there have not already been five such deactivations in the last 92 days (for Business five per seat), the place is free at once. Otherwise it stays taken until the 92nd day after the deactivated device's last check, when Glassbird Pro has surely ended there. So a key cannot be used on any number of computers by deactivating them in turn. The service deletes these entries on the 92nd day after the deactivation, when a place that stayed taken is free as well, and earlier together with all devices of a licence (below). A device that deactivates itself leaves no such entry.

There are also two values that relate to no person: a random value of the database and a checksum of our public activation key.

The service deletes a device's entry

• at once when you deactivate the device, in Glassbird Pro or on the page below, or remove the licence in Glassbird Pro, except with a blocked key, for which the points below apply;
• on the 92nd day after the last check, if the device has not been in touch for that long; by then its last proof has surely expired;
• at once for all devices of a licence when we block a published key. If we block a key for another reason, for example after refunding a renewal, the entries stay, so that devices with another key of the same licence that is still valid keep working;
• on the 30th day after the block when we block a licence;
• at once for all devices of a licence when you ask for it by mail (below).

We do not back up the service's database, not in snapshots of the server either. The periods above therefore hold exactly.

Blocks are set by hand only and only in the cases of section 3 of the terms: when we have refunded a purchase or a payment was charged back, when a key is publicly available, and for a key we replaced with a new one at your request. For a block the service stores the licence ID or a checksum of the key and the day of the block, without a reason, name or address. The checksum of a blocked key also goes into new versions of Glassbird Pro (below). The entry stays as long as the block applies: licences have no end date, and without it the key would work again. If we lift the block, we delete the entry. We tell you about a block by mail to the email address from your purchase or from the key, for a published key together with the new one. The mail goes through Proton like the licence mail (section “Purchases and donations”, Art. 6(1)(b) GDPR). We keep its copy as long as that of the licence mail (section “Purchases and donations”): as a business letter for six years from the end of the calendar year in which we sent it (Art. 6(1)(c) GDPR, § 147(1) no. 3, (3) and (4) AO).

What the service does not store: your IP address, your licence key, your name, your email address, the installation ID, times of day, the user agent, the language and the identifier from the Origin, and refused attempts. Key and installation ID are held in memory only during the request. Neither the service nor the web server in front of it keeps a log, not even an error log with IP addresses. There are no cookies and no accounts.

Protection against abuse: To protect the service against overload and abuse, it counts in memory how many requests came from your IP address (for IPv6 from its /64 network) and with your licence ID. It forgets all counts at every full hour and until then refuses too many requests.

On your computer Glassbird Pro keeps the installation ID, the service's last proof, the latest time it has seen and how far the clock has been set back since, by which it notices a clock set back, and details of the state of the check, such as when it last asked and with what result and when you entered the key. We sign the proof. It holds the licence ID, a checksum of the installation ID, a random value of the database and its validity, but neither name nor email address, and Glassbird Pro checks it without a connection. After 30 days it asks for a new check and stays valid for 60 days after that. If no check succeeds for 90 days, Glassbird Pro carries on as Free: your data stays, reminders keep ringing, and Pro is back as soon as a check succeeds. These items do not go into Glassbird Pro's backups, and of them only the installation ID goes to the service. If the companion add-on is installed, the installation ID is also kept in its setting glassbird.pro.install in your Thunderbird profile. It stays there if you remove Glassbird Pro, so that a reinstall takes no second device place.

Trial: Glassbird Pro also keeps the start of the trial and the latest time it has seen in the companion add-on's setting glassbird.pro.trial. It stays in the profile if you remove Glassbird Pro, so that a reinstall starts no second trial. We create the setting when you click “Try Free for 30 Days”, after Glassbird Pro has pointed this out to you; a trial that Glassbird Pro has already stored, for example from an older version, is written there without a new click once the companion add-on is running. Glassbird Pro checks the trial on your computer, without contacting us.

Deleting the two settings: If you remove Glassbird Pro for good, you can delete the two settings it leaves in the profile: in Thunderbird, under Settings › General, at the bottom “Advanced settings” (in Thunderbird 153 “Config Editor…”), search for glassbird.pro. and delete glassbird.pro.trial and glassbird.pro.install. The terms do not allow a new trial in the same profile after that.

Blocked keys in new versions: Each new version of Glassbird Pro holds the checksums of blocked keys and compares your key with them on your computer. Without the key, a checksum reveals nothing.

Device list: You see which devices are active in Glassbird Pro's settings under “License” with “Show devices”, with “Activated on”, “Last checked on” and “This device”, and can deactivate each one there. Without Glassbird Pro you can do this at glassbird.app/aktivierung/ by pasting your licence key there. The page sets no cookies and loads no script. The key goes only in the form, never in the address, and is only checked, as above.

Legal basis: Activation, re-checks, the device list and deactivation serve to perform your licence contract, which includes activation under section 3 of the terms (Art. 6(1)(b) GDPR). The days on which other devices were deactivated serve the device limit of the same contract, which section 3 of the terms describes together with this rule, so that a key is not passed on by deactivating in turn (Art. 6(1)(b) GDPR). If you received your key for the beta test, the beta conditions you agreed to when it was issued apply (Art. 6(1)(b) GDPR). For the counts against abuse the legal basis is Art. 6(1)(f) GDPR; our interest is to keep the service available to everyone and protect it against overload and abuse. For blocks and the checksums of blocked keys the legal basis is also Art. 6(1)(f) GDPR; our interest is that a key does not keep working after a refund or chargeback, that a replaced key can no longer be activated, and that strangers do not use a published key and so take up the places of the person the licence belongs to. You can object as set out in the section “Your right to object”.

Do you have to provide the data? Not by law. Activation is part of the licence terms, though: without it a licence key does not unlock Glassbird Pro, and if no check succeeds for 90 days, Glassbird Pro carries on as Free. Your data in Glassbird Pro stays in any case.

Recipients: The service runs on our server at netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, in Germany. netcup provides the server and processes the data on our behalf. A data processing agreement under Art. 28 GDPR is in place with netcup. Cloudflare resolves the name glassbird.app as DNS provider; requests to the service do not pass through Cloudflare. There are no other recipients, and we transfer nothing to a country outside the EU and the EEA.

Automated decisions: The service acts automatically only on three rules of the licence terms: the number of devices, the period of 90 days and the quota for deactivating other devices, beyond which a place stays taken until the day it is free. We set blocks by hand only. If you think a decision is wrong, write to glassbird@dmrc.it and a person will look into it.

Your rights for activation: The device list gives you access. It shows your devices with their days and places that stay taken with the next day one is free, and at glassbird.app/aktivierung/ also whether the licence is blocked. Not shown are the device identifiers, the days on which another device was deactivated in the last 92 days and the days on which further places that stay taken are free; we give you all of this on request. You can erase entries yourself by deactivating devices. We delete all devices of a licence and the days of their deactivations on request by mail to glassbird@dmrc.it; for this we need the licence key or the licence ID. Otherwise the section “Your rights” applies.

Updates

Glassbird, Glassbird Pro and the companion add-on Glassbird Pro Experiments get their updates from our server at glassbird.app if you installed them from there. Thunderbird asks there by itself and without you doing anything, regularly, by its default about once a day, for new versions, and downloads and installs them as long as automatic updates are on. In doing so the server sees your IP address, your Thunderbird's identification (user agent, with version and operating system) and which files are fetched, and so which of our add-ons you use. The request holds no identifier of you, your profile or your licence key, and the server sets no cookies. It stores none of this: as for this website, it keeps no access log and writes down no error messages containing your IP address. netcup runs the server on our behalf (section “This website”). The legal basis is Art. 6(1)(f) GDPR; our interest is to deliver bug fixes, security updates and adjustments to new Thunderbird versions to you. If you switch off automatic updates in Thunderbird under Add-ons and Themes, Thunderbird no longer installs new versions by itself but still asks for them. The requests end entirely when you remove the add-on or set extensions.update.enabled to false in Thunderbird's advanced settings; this then applies to all add-ons, and Thunderbird only asks when you look for updates yourself.

An add-on you installed from addons.thunderbird.net, Mozilla's add-on service, is updated by Thunderbird from there; Mozilla's privacy policy applies to this. Apart from that, Thunderbird fetches details of your installed add-ons from addons.thunderbird.net, ours included; Mozilla's privacy policy applies to this as well.

Purchases and donations

When you buy, we process your name, email address and billing address as well as product and price to fulfil the contract and issue the invoice (Art. 6(1)(b) GDPR) and to meet tax obligations, that is retention and checking in which country VAT is due; for this the shop only adds up country, amount and day of paid purchases (Art. 6(1)(c) GDPR). Without these details we cannot issue a licence key. You enter your payment details only at Stripe or PayPal; we do not see them.

On the order page (glassbird.app/shop/bestellen) you enter your name and email address, choose the country of your billing address and tick the boxes for your consent to immediate performance, for the limitation of updates to twelve months and for the terms. For a renewal you enter your previous licence key or its licence ID there. Our server checks the key against our signature or, with the licence ID, against your purchase at Stripe; for this, and to take renewals paid since into account, it asks Stripe for the purchases paid with your email address and whether they were refunded. From this it works out the new end of your update period (Art. 6(1)(b) GDPR). When you click “Order with obligation to pay”, our server in Germany creates the payment at Stripe and passes Stripe your email address, so that the payment page has it filled in, your name, the licence, the language, the country chosen, the versions of the consent texts you confirmed and, for a renewal, the licence ID, the licence's order day and the new end of the update period. It sends an acknowledgement of receipt of your order to your email address at once. It stores none of this on disk. To limit abuse, it counts your IP address each time the order page is opened, not only when you order; the counts are kept in memory only and forgotten after an hour at the latest (Art. 6(1)(f) GDPR). We need these details to carry out the order and acknowledge its receipt (Art. 6(1)(b) GDPR) and to be able to prove that you consented before performance began and separately agreed to the limitation of updates (Art. 6(1)(f) GDPR; our interest is proof that your right of withdrawal has expired and that the limitation applies).

Stripe (Stripe Payments Europe, Limited, Ireland) handles the payment on our behalf and also sends you the invoice in our name; the data processing agreement is part of our contract with Stripe. For its own purposes, such as fraud prevention and anti-money-laundering checks, Stripe is itself responsible; Stripe's privacy policy applies to this. Stripe may transfer data to Stripe, LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework; Stripe also uses the European Commission's Standard Contractual Clauses. We keep invoices for eight years from the end of the calendar year in which they were issued (§ 14b(1) UStG, § 147(3) and (4) AO).

If you pay with PayPal, Stripe's payment page takes you to PayPal, where you sign in and confirm the payment. Stripe and PayPal exchange the details of this payment for this purpose (Art. 6(1)(b) GDPR). PayPal is itself responsible for the processing at PayPal: for customers in the EU, Iceland, Liechtenstein and Norway PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; PayPal's privacy statement applies to this.

When the payment comes in and each time the page after the purchase is opened, our server in Germany fetches your name, email and billing address from Stripe. It checks whether the billing address is in the sales area and signs your licence key from them; if it is outside, the server has Stripe refund the payment and sends you a short mail instead of the key (Art. 6(1)(b) GDPR). The key holds your name, your email address, the licence ID, the order day and the end of the update period, for Business also the plan and the number of seats, for a replacement key also which replacement it is. So that the same mail does not go out twice, the server remembers the ID of the Stripe purchase and the time of the order, for at most 30 days from the order, but not your name or email address (Art. 6(1)(b) GDPR). The page after the purchase shows the key until 30 days after the order to anyone who has its link; to limit requests, the server counts your IP address in memory for at most an hour (Art. 6(1)(f) GDPR; our interest is protection against abuse).

We send you the acknowledgement of receipt of your order, the licence key and the contract confirmation by email through our mail provider, Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland. Proton processes the mail on our behalf; a data processing agreement is in place with Proton. According to Proton, it stores mail on servers in Switzerland, Germany or Norway. For Switzerland, the European Commission has found an adequate level of data protection (Art. 45 GDPR, Decision 2000/518/EC). The legal basis for sending is Art. 6(1)(b) GDPR.

A copy of the mail with your name, email address, product, price and licence key stays in our mailbox. We keep it as a business letter for six years from the end of the calendar year in which we sent it (Art. 6(1)(c) GDPR, § 147(1) no. 3, (3) and (4) AO); it also proves that and when we delivered and confirmed the contract (Art. 6(1)(f) GDPR). We keep it longer only as long as it matters for a tax assessment that is still open. We then delete it; it may remain in Proton's backups for up to 30 days after that. We keep the copy of the acknowledgement of receipt of your order in the same way (your email address, product, price and country, without your name) if you have paid.

If the payment page expires unused or a SEPA Direct Debit is not honoured, no contract is concluded. We then keep the copy of the acknowledgement of receipt for only six months from the order, to answer questions about this order and to be able to prove that we acknowledged its receipt (Art. 6(1)(f) GDPR), and then delete it; it may remain in Proton's backups for up to 30 days after that. For the payment at Stripe with your email address, your name, the country chosen, the versions of the consent texts, for a renewal the licence details and, if a direct debit was not honoured, the billing address you gave at Stripe, Stripe states no deletion period. After the same period we ask Stripe to redact it; this can take up to 30 days there. What Stripe keeps for its own legal obligations is governed by Stripe's privacy policy.

If you withdraw through “Withdraw from contract here”, we process your name, the email address you bought with, the email address for the acknowledgement of receipt and, if you give them, the licence ID and the order day, in order to handle the withdrawal and acknowledge its receipt (Art. 6(1)(c) GDPR in conjunction with § 356a BGB). There, too, the server counts your IP address in memory for at most an hour to limit abuse (Art. 6(1)(f) GDPR). The withdrawal statement and the acknowledgement go through Proton and are kept for six years like the licence mail.

Donations go through GitHub Sponsors; GitHub's privacy policy applies to them.

Contact and support

If you write to us, we use your mail and your details only to reply to you (Art. 6(1)(b) or (f) GDPR) and delete them once the matter is settled and no retention obligation applies.

Your right to object

Objection to processing based on legitimate interests: Where we process data under Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). This concerns:

• delivering this website and our server's answers to update requests,
• “Report a Problem” and mail to us, as far as we do not need it for a contract,
• the counts against abuse at the unsubscribe relay, on the order page, on the page after the purchase, for withdrawals and at the activation service,
• blocks and the checksums of blocked keys,
• the proof of your consents on the order page and the copies of the licence mail and the acknowledgement of receipt, as far as they prove that and when we delivered, confirmed the contract and acknowledged receipt of an order.

The simplest way is to write to glassbird@dmrc.it. We then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You can also end update requests yourself by removing the add-on or setting extensions.update.enabled to false in Thunderbird (section “Updates”); switching off automatic updates is not enough for this.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (section “Your right to object”). To exercise them, write to glassbird@dmrc.it. You can also lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

As of November 2026