Privacy Policy

This is a translation for your convenience; the German version is legally binding.

Controller

[First and last name], [Address], Email: [kontakt@phrasepop.app]

Our approach

PhrasePop is built to collect as little data as possible: the desktop app works entirely without an account and without an internet connection. Your snippets are stored locally on your device, encrypted. Only if you turn on the optional cloud sync is an additional copy, end-to-end encrypted on your device, stored on our server (see below). This website does not use cookies for tracking and does not embed any third-party services.

Server log files

When you access this website, the update/download server (update.phrasepop.app, dl.phrasepop.app) or the API (api.phrasepop.app), the web server necessarily processes: your IP address, the time, the requested address, the HTTP status code and the user agent of your browser or the app. These logs are used solely to keep the service secure and stable (legal basis: Art. 6(1)(f) GDPR) and are deleted after 14 days at the latest.

Update check

When the app checks for updates, it downloads a static manifest file from update.phrasepop.app. This only produces the server log data mentioned above; no content or identifiers are transmitted.

Optional user account and cloud sync

Signing up is voluntary and is required for cloud sync and for logging in on this website. We process the following (legal basis: Art. 6(1)(b) GDPR):

  • Email address – as your login name,
  • Password – only as a cryptographic hash (PBKDF2-SHA256); the plain-text password is never stored,
  • Personal sync data – your own snippets are end-to-end encrypted on your device before they leave it (Argon2id, AES-256-GCM). The server only stores the encrypted data block and cannot read its content at any time. The key (your sync password) never leaves your device.

You can delete your account at any time in the account area of this website. This immediately removes your account data, login sessions and your encrypted sync data from the database. Company PhrasePops and invitations you created remain with the respective company; their link to your account is removed. If you are the owner of a company, you must transfer or delete it first. Deleted data may still be contained in backups until they are overwritten in the regular rotation.

In the account area you can also download all data stored for your account as a file (Art. 15, 20 GDPR).

Emails

We only send you emails that are necessary for your account: confirming your email address and – when you request it – a link to reset your password. These links can be used once and expire after one hour (password) or three days (confirmation). To send them we use [Enter email service provider or own mail server]. We do not send advertising or newsletters.

Cookies

This website only sets technically necessary cookies. After you log in: pp_access (proof of login, valid for 15 minutes) and pp_refresh (extends your login, up to 60 days, deleted when you log out). Neither can be read by scripts (HttpOnly) and both are only sent over encrypted connections. If you explicitly choose a light or dark theme in the footer, we store that choice in the cookie pp_theme (only the value “light” or “dark”, valid for one year; it is deleted when you choose “System”). If you choose a language in the footer, we store that choice in the cookie pp_lang (only the value “de” or “en”, valid for one year), so you see the website in your language on your next visit; it is not used to recognize or track you. We do not use tracking or analytics cookies.

Company accounts

If an account is assigned to a company, we additionally process: the company and department name, your role (e.g. employee, department head) and the email addresses to which company administrators send invitations (legal basis: Art. 6(1)(b) GDPR, as part of the usage relationship for companies). Unlike personal snippets, PhrasePops provided company-wide or department-wide are not end-to-end encrypted, because administrators and department heads need to maintain them centrally and distribute them to employees. They are only visible to members of the same company or department and their administrators.

Disclosure to third parties

We do not pass any data on to third parties. All services run on our own servers in [Enter country/data center].

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), as well as the right to lodge a complaint with a supervisory authority (Art. 77). To exercise them, please contact the email address given above.

Last updated: October 2026