Privacy policy

Last updated Nov 15, 2026

The short version: your screenshot stays in your browser. The editor does not upload it to my server. Your device does all the work. The only image that can reach my server is a background that you choose to upload as a Premium user. I do not sell your data. I use no advertising. I use Google Analytics only if you accept it, and I use no other tracking service. You can download your data and delete your account yourself.

1. Who is responsible

This policy covers screenshoteditor.co. The controller under the General Data Protection Regulation (GDPR) is:

My other websites and apps have their own privacy policies. This policy does not cover them.

2. Your images and your settings

The editor works in your browser. "Stays in your browser" means this: when you add a screenshot, it is drawn, edited and exported on your device. The editor does not send your screenshot to my server, with the free editor and with Premium. An automated test records the network traffic of a free session and checks that no image data is sent.

The editor keeps a draft (your image and your settings) in your browser's own storage, so that you can come back and continue. This draft stays on your device. "Start new" removes it, and so does clearing your browser data.

There is one exception, and it is your choice. It is not your screenshot. With Premium you can save your own backgrounds. Only when you upload one on purpose, it is sent to my server and stored on the server that hosts the website (see section 3), so that you can use it again, also on another device. I store the image file, a small preview of it, the name you gave it, its size and the time you added it. I remove the metadata of the file from the stored copy. This includes camera data and the place where a photo was taken (GPS). Only you can open your files, while you are signed in. The number of files and the space you can use have limits. Your screenshots are never part of this. They stay in your browser.

The editor also uses your browser's session storage for one thing: it remembers which plan you chose while you sign in. It is cleared when you close the tab.

Your answer to the question about analytics (section 5) is kept in your browser's local storage, under the name sft_analytics. It stays on your device. I do not receive it.

3. Hosting and server logs

The website runs on a server of Alfahosting GmbH, Edmund-von-Lippmann-Straße 13-15, 06112 Halle (Saale), Germany. Alfahosting processes data only for me, as my processor.

When you open a page, the web server records technical data in log files: your IP address, the date and time, the address you asked for, the answer code, the referring page if your browser sends it, and your browser type. This data is needed to deliver the website and to keep it secure and working. I do not combine it with other data. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a working and secure website).

The editor's own server program writes a shorter log: date and time, the path, the answer code and how long the answer took. It has no IP address, no image, no sign-in token and no full email address.

4. Cookies

The site sets two cookies to sign you in. Both are needed for that and neither is used for tracking. You get them only when you press "Sign in". If you accept analytics (section 5), Google sets two more cookies. You get those only after you press "Accept". The bar that asks you is the only banner on the site.

Legal basis for the sign-in cookies: § 25 (2) No. 2 TDDDG (strictly necessary for a service you asked for) and Art. 6 (1) (b) GDPR. Legal basis for the Google cookies: your consent, § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

5. Analytics with Google (only if you accept)

I would like to know how many people use the site and which pages they open, so that I can improve it. For this I use Google Analytics 4, loaded through Google Tag Manager. I use it only if you press "Accept" in the bar that asks you. If you press "Decline", or if you do not answer, nothing from Google is loaded and Google sets no cookie.

After "Accept":

• Your browser loads a script from Google (googletagmanager.com) and sends measurements to Google's servers. Your IP address reaches Google with each request. Google says that Google Analytics 4 does not log or store IP addresses (support.google.com/analytics/answer/2763052).
• The measurements are the pages you open, the time, the page you came from, your browser and device, your approximate location, and simple actions such as scrolling and clicks on links that leave the site.
• Google Analytics does not receive your screenshot or your settings. The editor does not send them to Google.
• The sign-in page can be measured. The page where you return from payment is not: its address holds a payment reference, so the script is not loaded there.

Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time, with effect for the future. Press "Analytics settings" in the footer of any page, then "Decline". That removes the Google cookies of this site and reloads the page. Withdrawing does not make the earlier processing unlawful.

Google processes the data for me under Google's data processing terms. Google keeps the measurements for no longer than 14 months. Google's privacy policy applies: policies.google.com/privacy.

6. Sign-in with Google

You can sign in only with Google. When you press "Continue with Google", your browser goes to Google. You sign in there. I never see your Google password. Google tells me your Google account ID, your email address, your name and whether the address is verified. Google also sends the address of your profile picture. I store that address, not the picture. Your settings use it to show your picture: your browser loads the picture from Google (from a Google picture server such as lh3.googleusercontent.com), and Google can see your IP address when it does. I do not copy the picture. If the picture cannot load, the settings show the first letter of your name instead.

I store your email address, your name, your Google account ID, the address of your profile picture and the time you joined. I use them to know who you are when you sign in, to show your name and picture in your settings, and to connect a purchase to your account. Legal basis: Art. 6 (1) (b) GDPR (an account is needed for Premium).

Google processes your data for the sign-in under its own privacy policy: policies.google.com/privacy.

7. Premium and payment (Stripe)

Premium is paid through Stripe. When you choose a plan, your browser goes to Stripe's page. You enter your payment details there. I never see or store your card number.

The "Billing" tab in your settings lists your payments. Each time you open it, my server asks Stripe for them, using your Stripe customer ID, and passes them to your browser. I keep no copy of that list. The links to the invoice, the PDF and the receipt lead to Stripe's own pages.

From Stripe I receive and store: your Stripe customer ID, the subscription ID, the plan (monthly, yearly or lifetime), its status, the end of the paid period, whether it ends at the end of the period, and the date of a lifetime purchase. Legal basis: Art. 6 (1) (b) GDPR (the contract). Stripe is responsible for the payment data it collects. Its privacy policy applies: stripe.com/privacy.

The price of the lifetime plan depends on how many lifetime plans were sold before. I keep that count without any link to a person, so deleting an account never changes it.

8. What I do not do

• I do not sell your data. I give it only to the service providers in section 9, for the purposes named there.
• I use no advertising. I use no analytics or tracking except Google Analytics, and only if you accept it (section 5).
• I store no passwords.
• I do not look at your images. The editor never receives your screenshots. The only images I store are the backgrounds that you upload yourself with Premium.

9. Service providers and transfers

• Alfahosting GmbH, Germany: hosting (see section 3).
• Google: sign-in, only if you sign in. Analytics, only if you accept it (section 5).
• Stripe: payment, only if you buy Premium.
• InsightKit: feature requests and support, only if you open the Feedback or Support tab of your settings (section 12). It runs on the same server as this website.

Google and Stripe belong to groups based in the USA, so data may go to the USA. Google LLC and Stripe take part in the EU-U.S. Data Privacy Framework, for which the EU Commission decided that the protection is adequate (Art. 45 GDPR).

10. How long I keep data

11. Your rights

Under the GDPR you have the right to:

• get information about the data I store about you (Art. 15)
• have wrong data corrected (Art. 16)
• have your data deleted (Art. 17)
• restrict the processing (Art. 18)
• get your data in a portable format (Art. 20)
• object to processing based on legitimate interest (Art. 21)

You can use two of these rights yourself, at any time, in your account settings (press your round picture at the top right, then "Profile"):

• Download my data gives you a zip file with all data I store about you. It includes the backgrounds you uploaded.
• Delete account removes, at once: your email address, your name, your Google account ID, the address of your profile picture, your sign-in sessions on every device, your plan record and the backgrounds you uploaded. It asks Stripe to cancel your subscriptions and to delete your customer record there. Stripe keeps payment and invoice records where the law requires it.

I cannot promise to restore a file that is lost. Keep your own copy of any background that matters to you.

For everything else, write to apps@romankoch.online. You can also complain to a data protection authority. The authority for me is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany.

12. Feedback and support (InsightKit)

The "Feedback" and "Support" tabs in your settings are screens of this site. They use InsightKit, a service for feature requests and support conversations. InsightKit runs on the same server as this website (see section 3). You need no account there. Its own privacy policy also applies: insightskit.co/privacy.

The editor sends nothing to InsightKit until you open one of these two tabs. Then your browser calls InsightKit (api.insightskit.co) directly. It uses no cookie for this. It sends:

• the public key of this app. It tells InsightKit which app you write to.
• a random installation ID that your browser makes, and a credential that InsightKit gives back for it. Your browser keeps both in the local storage of this site, under the names sft_ik_installation and sft_ik_credential_live. They are not your name or your email, and I cannot connect them to your account here. They let you see your votes and your conversations again. They belong to this browser: another browser does not show them, and people who share this browser see them too.
• what you write: the title and the details of a feature request, or your support message, your email address if you give one (it is only for replies), and a picture or a video only if you pick one yourself. The editor never adds your screenshot or your canvas by itself.
• the version of this app, and, with a support message, the language of your browser

Like every request to a website, these calls also reach InsightKit's server with your IP address, your browser type and the address of this site (screenshoteditor.co) as the page you came from. Like every web server, InsightKit's server writes your IP address to its log file.

Legal basis: Art. 6 (1) (f) GDPR (my interest in answering questions and in learning what is missing). The two entries in local storage are needed for the function you asked for, to show your own votes and conversations again: § 25 (2) No. 2 TDDDG.

I keep a feature request until I delete it. I keep a support conversation until you or I delete it. You can delete your own conversation in the Support tab at any time. You cannot delete a feature request yourself: write to apps@romankoch.online and I delete it. "Delete account" in your settings does not remove what you wrote at InsightKit, because I cannot connect it to your account.

13. Changes

I update this policy when the product changes. The date at the top shows the latest version.