CrowdInbox

Privacy

Privacy policy

This privacy policy explains how ServerCrowd handles personal data. Part A covers this website. Part B covers the CrowdInbox app.

Part A

Privacy policy for the website crowdinbox.com

This is a translation of the German version (website-datenschutz.md), which is the one that counts.

How we handle your personal data, on what legal basis, and what rights you have towards us.

1. Data protection at a glance

General information

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Detailed information on data protection can be found in our privacy policy set out below this text.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section “Information about the controller” in this privacy policy.

How do we collect your data?

Some of your data is collected because you give it to us.

Other data is collected automatically, or after your consent, by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure that the website is provided without errors. If contracts can be concluded or initiated through the website, the data transmitted is also processed for contract offers, orders or other requests for work.

What rights do you have regarding your data?

You have the right at any time to receive information, free of charge, about the origin, recipients and purpose of your stored personal data. You also have the right to request that this data be corrected or deleted. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request that the processing of your personal data be restricted. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this and any other questions on data protection.

2. Hosting

Hosting under our own responsibility

We host this website ourselves. We set up the servers it runs on ourselves and operate them under our own responsibility. The operator of the website and the controller responsible for the processing are therefore one and the same: ServerCrowd GmbH, whose contact details are in section 3.

The servers, and the data centre they are in, are provided to us by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. We have concluded a data processing agreement with Hetzner under Art. 28 GDPR.

Each time this website is accessed, these servers process the information your browser transmits in doing so, in particular your IP address. What of it is logged is described under “Server log files” in section 4.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing this website to you securely and reliably. Insofar as you initiate or perform a contract with us through the website, the processing is additionally based on Art. 6(1)(b) GDPR.

Delivery through Cloudflare

Between your browser and our servers at Hetzner sits the network of Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter “Cloudflare”). When you open a page of crowdinbox.com, your request first goes to a Cloudflare data centre, usually one near you. Cloudflare fetches the page from our servers, keeps frequently requested files for a short time and delivers them to your browser.

We use Cloudflare so that the website loads quickly even under heavy load, and so that attacks, such as mass requests intended to overload it, never reach our servers in the first place. To do this, Cloudflare analyses the requests automatically and turns away conspicuous traffic. With every request, Cloudflare processes in particular:

  • your IP address
  • the address requested, date and time
  • browser type, browser version and operating system
  • the page you came from (referrer)

The encrypted connection from your browser ends at Cloudflare. Cloudflare sets up its own, likewise encrypted connection to our servers and can therefore process the pages it delivers unencrypted.

Cookies and error reports. On an ordinary visit to this website, Cloudflare sets no cookies. If Cloudflare classifies a request as suspicious, it may first show a short check page and, once the check is passed, set the cookie cf_clearance so that you do not meet the check again on every page. Cloudflare also asks your browser to report connection errors (Network Error Logging). If a request fails, for example because of a timeout, your browser may send a short error report to Cloudflare: which address was affected, which error occurred and when. Cloudflare also receives your IP address in the process. Successful requests are not reported. Your browser remembers this request for seven days.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in delivering the website to you quickly and reliably and in protecting it against attacks. Insofar as information is stored in your browser in the process, this is strictly necessary for this purpose (§ 25(2) no. 2 TDDDG).

We have concluded a data processing agreement with Cloudflare under Art. 28 GDPR. Because Cloudflare has its registered office in the USA, data may also be processed there. Cloudflare is certified under the EU-US Data Privacy Framework. The transfer is based on the European Commission’s adequacy decision for this framework (Art. 45 GDPR). In addition, the contract with Cloudflare contains the European Commission’s standard contractual clauses. You can find the contract at https://www.cloudflare.com/cloudflare-customer-dpa/ and Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. Further information can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5666.

3. General notes and mandatory information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

Please note that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website is:

ServerCrowd GmbH
Represented by: Moritz Witte
Riehestraße 34a
31535 Neustadt am Rübenberge, Germany

Phone: +49 5034 2562541
Email: data-protection@servercrowd.de

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (e.g. names, email addresses or the like).

Storage period

Unless a more specific storage period has been stated in this privacy policy, your personal data remains with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or withdraw a consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data is deleted once these reasons no longer apply.

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR, or Art. 9(2)(a) GDPR if special categories of data under Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, the data processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your terminal device (e.g. via device fingerprinting), the data processing is additionally based on § 25(1) TDDDG. Consent can be withdrawn at any time. If your data is required to perform a contract or to carry out pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data on the basis of Art. 6(1)(c) GDPR if it is required to fulfil a legal obligation. Data processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. The legal bases relevant in each individual case are set out in the following paragraphs of this privacy policy.

Recipients of personal data

In the course of our business activities, we work with various external bodies. In some cases this also requires personal data to be transferred to these external bodies. We only pass personal data on to external bodies if this is required to perform a contract, if we are legally obliged to do so (e.g. passing data on to tax authorities), if we have a legitimate interest in passing it on under Art. 6(1)(f) GDPR, or if another legal basis permits the data to be passed on. When using processors, we only pass on our customers’ personal data on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Many data processing operations are only possible with your express consent. You can withdraw a consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS ON WHICH A PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION UNDER ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged breach. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this is only done insofar as it is technically feasible.

Information, correction and deletion

Within the framework of the applicable statutory provisions, you have the right at any time to information free of charge about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to correction or deletion of this data. You can contact us at any time about this and any other questions on personal data.

Right to restriction of processing

You have the right to request that the processing of your personal data be restricted. You can contact us about this at any time. The right to restriction of processing exists in the following cases:

  • If you dispute the accuracy of your personal data stored by us, we usually need time to check this. For the duration of the check, you have the right to request that the processing of your personal data be restricted.
  • If the processing of your personal data happened/is happening unlawfully, you can request the restriction of data processing instead of deletion.
  • If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request that the processing of your personal data be restricted instead of deleted.
  • If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed against each other. As long as it has not yet been determined whose interests prevail, you have the right to request that the processing of your personal data be restricted.

If you have restricted the processing of your personal data, this data may, apart from being stored, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a member state.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser’s address line changing from “http://” to “https://” and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Cloudflare delivers the pages of this website on our behalf. The encrypted connection from your browser therefore ends at Cloudflare and not only at our servers; details are in section 2 under “Delivery through Cloudflare”.

Objection to advertising emails

We hereby object to the use of contact details published under the obligation to provide an imprint for sending advertising and information material that has not been expressly requested. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, for example through spam emails.

4. Data collection on this website

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

  • browser type and browser version
  • operating system used
  • referrer URL
  • host name of the accessing computer
  • time of the server request
  • IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and the optimisation of its website; for this, the server log files must be recorded.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, your enquiry, including all personal data arising from it (name, enquiry), is stored and processed by us for the purpose of dealing with your request. We do not pass this data on without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is required to carry out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the enquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if this has been requested; the consent can be withdrawn at any time.

The data you send us in contact enquiries remains with us until you ask us to delete it, withdraw your consent to its storage or the purpose for storing the data no longer applies (e.g. after your request has been dealt with). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

5. Buying and cancelling CrowdInbox Plus

This section is written for crowdinbox.com; ServerCrowd has it reviewed legally before anything is sold.

Purchase through Paddle

On the page “CrowdInbox Plus” you can buy a subscription. The seller is not ServerCrowd GmbH but Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom (“Paddle” below), as reseller (“merchant of record”). Paddle handles the order, the payment and the invoice and is itself responsible for processing the data of the purchase.

The page asks you for the email address the subscription is for. As long as you do not open the checkout, that address stays in your browser and is not transmitted. Only when you click “Continue to Paddle’s checkout” does your browser load a script from Paddle’s servers (cdn.paddle.com) and open Paddle’s checkout. In doing so Paddle receives your IP address, details of browser and device, and the email address you entered; in the checkout you give Paddle your payment details and, as far as tax requires, country and postal code. We do not receive your payment details. Nothing is loaded from Paddle before that click.

One exception: if you open the page through a link Paddle itself sent you, for example to pay an invoice or change a payment method, Paddle’s script is loaded at once, because you have already asked for the checkout by doing so.

As far as Paddle’s script stores or reads information in your browser in the process, that is strictly necessary for the checkout you asked for (§ 25(2) no. 2 TDDDG).

After the purchase we receive from Paddle: Paddle’s number for the subscription, which price it is, what state it is in, how long it is paid for and whether money was refunded, and the email address given. Our service turns the address into a fingerprint and does not store it; details are in part B, section 6. In Paddle’s administration we can see, for your purchase, your name, your email address and the country you paid from, and in some countries the postal code. We use that for questions about your purchase, such as a cancellation or a refund.

The legal basis is Art. 6(1)(b) GDPR. For the United Kingdom there is an adequacy decision of the European Commission. As far as Paddle transfers data to other countries, it relies, by its own account, on standard contractual clauses. Details are in Paddle’s privacy notice: https://www.paddle.com/legal/privacy.

Cancellation form

On the page “Cancel a contract here” you can cancel a subscription bought on this website. The form asks for the email address the purchase was made for, the kind of cancellation (for an extraordinary one, the reason), and the time wanted.

On sending, these details go, together with your IP address, to our service relay.crowdinbox.com, which runs on servers in Germany at Hetzner Online GmbH. It passes the declaration on to us by email and sends a confirmation to the address given if a purchase is known for it, and to no other. The page learns when the declaration arrived, but not whether a purchase is known for the address. If an unusual number of declarations arrive within an hour for addresses no purchase is known for, it does not pass further ones of that kind on during that hour; that is why the page asks you to write to us if no confirmation comes. It does not store the declaration itself; for the current day it counts how often a cancellation was declared for an address, by a fingerprint of the address, so that the form cannot fill a mailbox. We then end the subscription with Paddle and keep the email with your declaration for as long as we have to be able to prove the cancellation.

The legal basis is Art. 6(1)(b) and (c) GDPR: § 312k BGB requires a cancellation to be taken and confirmed in this way.

6. Downloading the apps

You do not download the desktop app for macOS and Linux from this website but from our own server git.servercrowd.de. Only when you click one of the download links does your browser fetch the file there; nothing is loaded from this server before that. The server is located in Germany at Hetzner Online GmbH (see section 2), and Cloudflare is not involved. With every download it processes the details your browser transmits, in particular your IP address, and logs them as described under “Server log files” in section 4, together with the file you fetched.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the app for download securely and reliably and in protecting the server against misuse.

You get the app for Windows in the Microsoft Store, and the app for the iPhone, until its release in the App Store, through Apple’s TestFlight. These links take you away from our website. What Microsoft and Apple process in doing so is governed by their own privacy policies.

Source of the model texts used: e-recht24.de. We wrote sections 2, 5 and 6 ourselves.

As of: 22 October 2026

Part B

Privacy policy for the CrowdInbox app

As of 22 October 2026. Written from what the app actually does (what-the-app-does-with-data.md, and the code behind it). This is a translation of the German version (datenschutzerklaerung.md), which is the one that counts.

CrowdInbox is an email app for iPhone, Windows, macOS and Linux. It fetches your mail directly from your mail provider and keeps it on your device. ServerCrowd never sees your mail, with two exceptions you switch on yourself, described in full below: instant notifications on the iPhone, and scheduled messages sent while your devices are off.

1. Who is responsible

ServerCrowd GmbH Riehestraße 34a, 31535 Neustadt am Rübenberge, Germany Amtsgericht Hannover, HRB 224128 · Managing director: Moritz Witte Email: services@servercrowd.de · Phone: +49 172 5825268

Questions and requests about your data: Moritz Witte, data-protection@servercrowd.de. We have not appointed a data protection officer.

2. The app on your device

When you add a mailbox, CrowdInbox connects directly to your mail provider’s server (IMAP to read, SMTP to send), always encrypted. On your device the app keeps:

  • your mail: headers, text, cleaned-up HTML, and attachments you opened;
  • senders and recipients of your mail, from which it works out whom you have written to;
  • your settings, sorting rules, drafts and reminders;
  • your password: only in the operating system’s protected storage (iOS Keychain, Windows Credential Manager, macOS Keychain, Linux Secret Service), never in a file of the app’s and never in a log.

All of this stays on your device. The app has no usage statistics, no error reports, no advertising and no tracking libraries, and it needs no account with ServerCrowd. There is an optional one for CrowdInbox Plus only (section 6).

Sorting (“Smart Inbox”): mail is sorted into People, Notifications and Newsletters on your device, by rules that can be explained: headers, the sender’s address, whether you have written to them, and words in the text. The app shows you the reason for each decision. No profile is built, and none of it leaves your device.

Pictures in notifications (iPhone): a notification shows the icon of the sender’s website, which your iPhone fetches from that website (its front page, to see which icon it names, and then that icon) at most once a month, and keeps; for personal addresses it shows the sender’s initials instead. Nobody else is asked, and no address of yours is sent anywhere. Contacts are only searched (on your iPhone) if you allow it while writing a message.

Verification codes in a mail (the digits a website sends to sign you in) are found on your device. The app shows them with a Copy button, and on the iPhone, if you turn CrowdInbox on under Settings → General → AutoFill & Passwords, offers them to Safari’s AutoFill for the website the mail came from. A code is kept for a quarter of an hour in the app’s own storage on the iPhone, then deleted; it is not sent anywhere.

Summaries and reply suggestions (iPhone, when you ask for them) are made on your iPhone by Apple’s on-device language model (Apple Intelligence). The conversation is not sent anywhere for it: not to ServerCrowd, not to Apple. They are part of CrowdInbox Plus (section 6). Whether your iPhone has Plus, it knows from the App Store or, when it is signed in to an account, from the relay.

Pictures and other content from the internet in an HTML mail load only once you allow it for that mail or that sender. That way a sender does not learn whether and when you opened their mail.

3. What is kept in your own mailbox

So that your devices agree, CrowdInbox keeps a few things in your own mailbox with your mail provider, not with us:

  • snoozed mail, in the folder CrowdInbox/Snoozed;
  • drafts, in your mailbox’s Drafts folder;
  • one small message per device in the folder CrowdInbox/Settings, with your sorting rules, settings, templates and reminders.

Your mail provider processes these on its own terms, like any other mail in your mailbox.

4. Instant notifications on the iPhone (optional)

An iPhone cannot notice new mail by itself while CrowdInbox is closed. For that, ServerCrowd runs a service, the relay. It is off until you turn it on for a mailbox under Settings → Account → Instant Notifications; the app explains what that means at that moment, and asks.

What the relay keeps for a mailbox it is on for

  • the mailbox’s IMAP server, address and password. The password is checked with a test login, then encrypted (AES-256-GCM) with a key that lives only on the relay machines, never on the machine with the database, never in a backup. Technically the password would let the relay read your mailbox; it is built to read only the numbers of new messages in the inbox, to notice that one arrived: no sender, no subject, no content;
  • for your device: a public key (the private one stays in your iPhone’s Keychain and signs every request), that it is an iPhone, Apple’s push token for your device, and when it was last heard from.

What the relay passes on

To Apple (Apple Push Notification service), for your iPhone, only “new mail” and a count, with no sender, subject or address. Your iPhone itself then fetches sender, subject and the beginning of the message from your mail provider, to show them and to find a verification code in it; none of it passes through ServerCrowd.

Where, how long, on what basis

  • Legal basis: your consent (Art. 6(1)(a) GDPR), for each mailbox separately. You withdraw it by turning the switch off.
  • Location: machines in Germany, run by ServerCrowd at Hetzner Online GmbH (processor, contract under Art. 28 GDPR).
  • Retention: the password is deleted as soon as you turn the switch off. Your device is deleted when you turn off the last mailbox, or when it has not been heard from for 30 days, unless a message you scheduled is still waiting there (section 5), and then a month after it went. When your device is signed in to an account (section 6), its entry stays beyond that: the public key, that it is signed in, and the subscription it showed the relay (section 6). The entry is deleted after 400 days without contact. The password and the watching of the mailbox are deleted after 30 days all the same, and Apple’s push identifier as soon as no mailbox is switched on any more. When your device no longer has Plus while the relay asks for it, the relay pauses the watching: it closes the connection to your mailbox and takes the password out of memory; after 30 days paused, the watch and the password are deleted. Logs are kept 7 days, nightly database backups also 7 days (they hold encrypted values only).
  • Security: encrypted transport (TLS), encrypted storage, every request signed by your device, maintenance access only through ServerCrowd’s VPN.

Without instant notifications CrowdInbox works just the same; new mail then shows up when you open the app, or when iOS gives it time in the background.

5. Sending later without the app (optional)

A message you schedule goes out at its time only if one of your devices is awake then, unless you turn on Send Later Without the App (on the iPhone under Settings → Mail, on the computer under Settings → Plus). The app explains beforehand what that means, and asks. Mailboxes that sign in with Google or Microsoft keep sending from your device.

What the relay keeps for a scheduled message

  • the message, as it will go out: sender, recipients (including Bcc), subject, text and attachments;
  • the mailbox’s SMTP server, address and password, to send it through your own mail server;
  • when to send it, and afterwards whether it went;
  • for your device, the same as in section 4, for a computer without the push identifier.

Message and password are encrypted (AES-256-GCM) with the same key as in section 4. The relay reads the message only to hand it to your mail server at its time; it passes it to nobody else.

How long: message and password are deleted the moment the message has gone, or failed for good, after about a day of attempts. If you change, reschedule or delete the message before its time, or turn the switch off, the relay’s copy is deleted. That it went, and when, is kept until your device has asked, at most 30 days. Logs (7 days) contain no addresses and no content.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you withdraw by turning the switch off. Location and security as in section 4.

6. CrowdInbox Plus and the account (optional)

CrowdInbox Plus is a subscription. It covers the two things in sections 4 and 5 (what a machine of ours has to run for) and on the iPhone the summaries and reply suggestions of section 2. While the relay does not ask for Plus, sections 4 and 5 work without it; the Plus page in the app tells you whether it is needed right now. Everything else in the app needs no subscription.

The purchase on the iPhone goes through Apple’s App Store. Apple handles the payment and processes your data for that under its own privacy policy. Apple tells us neither your name nor your Apple ID, your address or your payment details.

The purchase on the website goes through Paddle (Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom). Paddle is the seller there and itself responsible for the data of the purchase; what happens on the website for it is in part A. Our relay learns from Paddle: Paddle’s number for your subscription, which price it is, what state it is in, how long it is paid for and whether money went back, and the email address you bought for. The relay turns that address into a fingerprint (see “The account” below) and does not keep it. The relay does not get your name, your postal address or your payment details. In Paddle’s administration, which we can look into as the supplier, your purchase shows your name, your email address and the country you paid from, and in some countries the postal code; we use that for questions about your purchase, such as a cancellation or a refund.

What the app shows the relay: on the iPhone, the Apple-signed transaction for your subscription, when the relay asks for Plus, when you ask for a sign-in code, or when your iPhone is signed in to an account. The relay checks Apple’s signature itself and asks nobody for it.

What Apple tells the relay: Apple notifies our relay when a subscription of the app renews, when it ends, and when Apple refunds money. Such a notice names Apple’s number for the subscription, no name and no Apple ID. The relay uses it only for a subscription a device has already shown it; any other it reads and drops without keeping anything.

What the relay keeps of it: Apple’s number for your subscription (the same through every renewal), which product it is, when it was last bought or renewed, how long it is paid for, whether Apple took it back, until when a refunded period would have run, and whether it was a test purchase. These details are tied to your device’s public key from section 4 and, when it is signed in, to your account. When no device carries the subscription any more and it belongs to no account, the entry is deleted; when a device is deleted is in section 4. One exception: when Apple has refunded a subscription, its entry stays until the refunded period and three days are over, even if you have bought again since, so that the refund is not forgotten. What the relay knows of a purchase on the website is deleted 30 days after it ended; a purchase we gave to another address by hand, at your request, it keeps until Paddle reports it cancelled.

The account. So that Plus you bought on one device holds on your others, you can sign in on the Plus page with an email address. There is no password: the relay sends a code to the address, and you type it into the app. Nobody needs an account to read mail; Plus from the iPhone needs one only if it should hold on other devices too.

  • The code comes as an email from ServerCrowd’s own mail server, which is in Germany. The mail server keeps, as for any mail, a log with the recipient’s address and the time. A code goes only to an address that has Plus, or from a device that has it.
  • What the relay keeps: not your address but a fingerprint of it (HMAC-SHA256), under a key that is only on the relay’s machines and never on the machine with the database. With it: which of your devices are signed in; the fingerprint of the code and how often it was tried (the code is good for ten minutes and, if you do not type it, is deleted within an hour after that); and for the current day, how many codes went to a fingerprint.
  • What that does not mean: if you have switched on instant notifications or sending later, that mailbox’s address is kept readable at the relay as before (sections 4 and 5). By signing in, your devices, and with them those mailboxes, recognisably belong to one account.
  • On your device the app remembers the address it is signed in with, to show it to you.
  • When the app asks the relay: a device that is not signed in asks the relay only when you open the Plus page or turn on something the relay does, never at launch. A signed-in iPhone also shows the relay a renewal or a refund as soon as the App Store reports it (which can be when the app starts), and asks it about Plus about once a week, when you use something that needs Plus and the iPhone has no subscription of its own. Every request reaches the relay, like any server, from your IP address. The relay writes it neither to its database nor to a log. To limit abuse it counts requests per network in memory (for a sign-in code, together with the fingerprint of the address asked for) for an hour, in one case for a day, and then forgets them.
  • How long: Sign Out takes your device out of the account. When no device is signed in any more, the account is deleted within the hour. Delete Account on the Plus page signs every device out and deletes the fingerprint at once. A signed-in device that is no longer heard from is deleted after 400 days. A purchase on the website is a contract with Paddle and goes on until you cancel it; its fingerprint is deleted 30 days after it ended. At Paddle and in our mail server’s log your address is kept independently of this: deleting the account does not remove it there.

Legal basis: the contract for the subscription, which the account belongs to when you create it (Art. 6(1)(b) GDPR). Location and security as in section 4.

7. Unsubscribing

When you tap Unsubscribe on a newsletter, the app does what the newsletter itself offers: a request to the sender’s server, a short email from your address to the address it names, or its web page in your browser. It happens only when you tap, and the app says beforehand which of the three it will be. The sender learns from it that your address is read, which is what unsubscribing is.

8. Apple and the app stores

The iPhone app is distributed through Apple’s App Store and TestFlight; Apple processes data for that under its own privacy policy. Notifications the iPhone makes itself (a reminder, say) stay on the device.

9. When you write to us

If you email us, we use your address and message to answer you (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer needed for that and no legal retention period applies.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw a consent at any time for the future (Art. 7(3)), for instant notifications and for sending later, right in the app.

Since nearly all data is only on your device, you delete it by removing a mailbox in the app or deleting the app. For the relay, it is enough to turn instant notifications and sending later off and, if you signed in to an account, to sign out on the Plus page or delete the account there; anything else we answer at data-protection@servercrowd.de.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

11. Changes

When something changes in the app that affects this policy, we change it and the date above. New processing that needs your consent is never switched on without you.