Privacy Policy ============== Last updated: October 7, 2026 This policy explains which personal data screeenly collects, why, who receives it, how long it is kept and which rights you have. It applies to the website screeenly.com, the screeenly app, the API and the MCP server. Who is responsible ------------------ Stefan Zweifel, screeenly.com, Rütlistrasse 5, 8307 Effretikon, Switzerland. Email: support@screeenly.com. screeenly is operated from Switzerland and processes data according to the Swiss Federal Act on Data Protection (FADP). If you are in the European Union or the United Kingdom, the GDPR or UK GDPR applies as well. Which data we collect --------------------- **Account data.** Your name, email address and password (stored as a hash). If you turn on two-factor authentication, we store the secret and the recovery codes in encrypted form. **Billing data.** Your plan, subscription status and invoices. Payment details and billing addresses are collected and stored by Paddle, not by us (see "Payments" below). **API and playground requests.** For every request we store the URL or HTML you sent, the request options, the IP address and user agent of the client, and the time of the request. The resulting screenshot, PDF or rendered HTML is stored as well. We count requests per month to enforce your plan's limit. **API tokens.** The name of each token, when it was created and when it was last used. The token itself is stored as a hash. **Emails.** We keep a record of which transactional emails we sent to you, for example the email verification or a usage notification. **Logs and error reports.** Our servers log requests and errors. These logs can contain your IP address, your user ID and the URL you requested. **Product analytics.** We record events on the server, for example "account created" or "monthly limit reached", together with your user ID. We do not use tracking scripts, advertising cookies or fingerprinting in your browser. Why we process the data ----------------------- - To provide the service: create your account, run your requests, store the results and send emails about your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). - To bill you and to meet tax and accounting obligations. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c) GDPR). - To keep the service secure and available: rate limiting, abuse prevention, error tracking and monitoring. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). - To understand how screeenly is used and improve it. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). We do not sell your data and we do not use it for advertising. Cookies ------- The website and the app set a session cookie and a CSRF cookie. They are needed to keep you logged in and to protect forms. We set no other cookies. Who receives the data --------------------- We use the following service providers. They process data on our behalf and under a data processing agreement. ProviderPurposeLocationDigitalOceanHosting of the application and databaseFrankfurt, GermanyAmazon Web ServicesRendering of screenshots, storage of screenshots and backups, sending emailsUnited StatesSentryError trackingUnited StatesPostHogProduct analyticsEuropean UnionLaravel NightwatchApplication monitoringUnited States ### Payments Our orders are processed by Paddle.com, our reseller and Merchant of Record. Paddle collects your payment and billing details and processes them as an independent controller under [its own privacy policy](https://www.paddle.com/legal/privacy). ### Transfers outside Switzerland and the EU Some providers process data in the United States. We rely on the EU–US and Swiss–US Data Privacy Framework where the provider is certified, and on the standard contractual clauses of the European Commission otherwise. How long we keep the data ------------------------- - Screenshots, PDFs and rendered HTML: deleted 24 hours after they were created, or earlier if you set a shorter `cache_ttl`. Playground results are deleted after 60 minutes. Until then, an identical request from the same account gets the stored result. - Request records (URL or HTML, options, IP address, user agent): deleted 6 months after the result expired. - Accounts that never verified their email address: deleted 28 days after registration. - Deleted accounts: when you delete your account, your API tokens are revoked and your files expire immediately. All remaining account data is deleted permanently 28 days later. - Backups: kept for up to 4 months, then overwritten. - Invoices: kept by Paddle for as long as tax law requires. Your rights ----------- You have the right to: - get a copy of the personal data we hold about you, - correct inaccurate data, - have your data deleted, - receive your data in a machine-readable format, - object to processing based on our legitimate interest, - withdraw any consent you gave. You can update your name and email address and delete your account in the app under Account Settings. For everything else, email support@screeenly.com. We may ask you to confirm your identity and will answer within 30 days. You can also file a complaint with a data protection authority. In Switzerland this is the [Federal Data Protection and Information Commissioner (FDPIC)](https://www.edoeb.admin.ch). In the EU, contact the authority in your country. Security -------- All connections to screeenly use HTTPS. Passwords and API tokens are stored as hashes. Backups are encrypted. Access to servers and data is limited to the operator of screeenly. If a breach affects your personal data, we will inform you and the responsible authority as required by law. Changes to this policy ---------------------- We update this policy when we change how we process data. The date at the top shows the last change. For significant changes we will notify you by email.