Privacy policy

This policy describes which personal data tippkraft processes, why and for how long. Last updated: 5 November 2026. The German version is legally binding.

1. Controller

2. Hosting and server logs

The website and the web app run on a server by AlphaVPS (DA International Group Ltd., Bulgaria) in a data center in Dallas, USA. AlphaVPS processes the data on our behalf (Art. 28 GDPR). Because the server is located in the USA, your data is transferred to a country outside the EU.

For every request, the web server (nginx) stores your IP address, date and time, the requested address, the status code and the browser identifier. We need these logs to detect errors and attacks (legitimate interest, Art. 6(1)(f) GDPR). They are deleted after 14 days. To protect against too many login attempts, the web app keeps IP addresses in memory for up to one hour without storing them.

3. Account and snippets

For an account we store your email address, your password as a hash (never in plain text), your chosen language and the sign-up date. We also store everything you create in the web app: snippets, groups, excluded programs and connected devices (device name, connection date and date of last use). Snippets may themselves contain personal data, such as your address.

The legal basis is the performance of the usage agreement (Art. 6(1)(b) GDPR). The data is kept until you delete your account. Until there is a button for this, an email to the address above is enough.

3a. Sign-up, confirmation and password reset

After you sign up, we send you an email with a link to confirm your email address (valid for 24 hours). For "forgot password" we send a link valid for 1 hour. We only store a hash of these links and their expiry time. Accounts not confirmed within 7 days are deleted automatically with all their data.

We send these emails through Migadu (Switzerland) as a processor. The EU Commission has issued an adequacy decision for Switzerland.

To protect sign-up, password reset and repeated login attempts against bots, we use Cloudflare Turnstile (Cloudflare, Inc., USA). Your IP address and technical characteristics of your browser are transmitted to Cloudflare and checked without you having to solve a puzzle. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework. Turnstile is only loaded on these pages.

4. Cookies

tippkraft sets only two cookies, both strictly necessary (§ 25(2) no. 2 TDDDG), so there is no cookie banner:

• session: keeps you logged in, valid for 30 days, not readable by scripts.
• sprache: remembers the language you chose without logging in, valid for 1 year.

There are no analytics tools and no tracking. Apart from Turnstile on the pages named in section 3a, no content comes from third-party servers, and the font is served from our own server as well.

5. Desktop app

The desktop app has to read keystrokes to recognize abbreviations. It keeps only the last 64 or so characters in memory, never writes them to disk and never transmits them. In programs on your exclusion list it doesn’t read along at all.

The app fetches your snippets from tippkraft.com over an encrypted connection and keeps a copy on your computer so it works offline. It sends an access token (stored on our side only as a hash) and the device name. We store when the device last fetched data.

6. Backups

The database is copied daily to an AlphaVPS backup server in Sofia (Bulgaria). Daily backups are kept for 14 days, weekly ones for up to 8 weeks. Deleted data therefore disappears from the backups after 8 weeks at the latest.

7. Domain and DNS

The domain tippkraft.com is managed at Cloudflare. Cloudflare only answers the DNS lookup for the server address, the actual traffic does not pass through Cloudflare.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Just send an email. You can also lodge a complaint with a data protection supervisory authority, for example the one where you live.

9. Disclosure

We do not pass on or sell your data. The only recipients are the providers named above: the hosting provider (sections 2 and 6), Migadu and Cloudflare (section 3a).