Privacy policy

Last updated: Oct 20, 2026

This policy explains which personal data Freevy processes, why, and what rights you have. It covers this website, the optional Freevy account with sync, the web snippet manager and the Freevy desktop app for Windows. It is written to meet the EU General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

1. Who is responsible

The controller is Ozan Kurt , not provided yet
Email: [email protected] ("we", "us").

We are not required to appoint a data protection officer. Write to the address above with any privacy question.

2. The short version

• Your snippets are end-to-end encrypted. They are encrypted on your device with a key derived from your password, and we only ever store the encrypted result. We cannot read them, and neither can anyone who gets hold of our database.
• Your password never leaves your device. We receive a value derived from it that is useless for decrypting your data.
• The desktop app works fully offline. Without an account it sends nothing to us.
• No analytics, no advertising, no tracking, no third-party scripts and no data sales.

3. Visiting this website

When you open a page, our server processes your IP address, the date and time, the address requested, the response status, the amount of data sent, the referring page and your browser's user agent. This is technically needed to deliver the page and to detect and stop attacks. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days, unless a specific entry is needed to investigate an attack, in which case we keep it until that is resolved.

The website loads no fonts, scripts or images from other services, so your browser does not contact any third party when you visit.

4. Your Freevy account

An account is optional. If you create one, we process:

• Email address and the times you signed up and confirmed it.
• Login verifier: your device derives a key from your password with Argon2id and sends us a hash of that key, which we hash again with bcrypt before storing it. We also store the random salt and the Argon2id settings so your devices can repeat the derivation.
• Encrypted key material: your data key, encrypted once with your password and once with your recovery key. We cannot decrypt either copy.
• Signed-in devices: the name of each computer you sign in from, when it signed in and when it last synced.
• Browser sessions: while you are signed in on this website, your IP address, user agent and last activity are stored with your session.
• Settings: whether you allow access to your snippets from the website.

We use this data to provide the account you asked for (Art. 6(1)(b) GDPR). Providing your email address is required to have an account, because we need it to identify you and to send confirmation and password reset links. Without an account, the desktop app keeps working with all local features.

5. Sync and online backup

When sync is turned on, the app uploads your snippets, folders, settings that belong to them and your master password check as encrypted items. For each item we store a random identifier, the encrypted content, its size, a revision number, whether it was deleted and when it changed. Items are padded before encryption so their size reveals little about their content. To let you restore something you deleted or overwrote, we keep earlier encrypted versions of each item for 30 days, at most 20 versions per item.

Even we cannot tell which item is a snippet, a folder or a setting, or what any of them says. The legal basis is the contract with you (Art. 6(1)(b) GDPR).

6. Web snippet manager

If you turn on website access in your account settings, you can open your snippets at freevy.app. Your browser downloads the encrypted items and decrypts them locally with your password. Decryption keys are kept only in the memory of that browser tab and are dropped when you lock it, after 15 idle minutes or when you close the tab. Changes are encrypted in your browser before they are sent. Website access is off by default and you can turn it off again at any time.

7. The desktop app

• Keystrokes: to expand abbreviations, the app watches what you type on your computer. It keeps only the last few characters in memory to compare them with your abbreviations. Typed text is never written to disk and never sent anywhere. The app counts typed and inserted characters for the statistics page; those counts stay on your computer.
• Local data: snippets, settings and backups are stored in your Windows user profile. Protected snippets are encrypted with your master password. Saved secrets such as your sync token and SFTP password are encrypted with Windows (DPAPI) so only your Windows account can read them.
• Network: the app contacts our server only when you sign in to sync. It has no telemetry, no crash reporting, no advertising and no automatic update check.
• Backups you set up: backups to an SFTP server or a Google Drive or other synced folder go directly from your computer to the destination you choose. We are not involved; the terms and privacy policy of that provider apply.
• Imports: importing a Breevy file happens entirely on your computer.

8. Emails

We send only emails you need for your account: address confirmation, password reset links and important notices about the service, such as changes to these documents or the end of a feature you use. We do not send newsletters or marketing. Password reset links expire after 60 minutes. Legal basis: Art. 6(1)(b) GDPR.

9. Protection against abuse

To slow down password guessing and other abuse, we count requests per IP address and per email address for a few minutes. These counters expire automatically. Legal basis: our legitimate interest in keeping accounts safe (Art. 6(1)(f) GDPR).

10. Cookies

We only use cookies that are strictly necessary for features you ask for: keeping you signed in and protecting forms against forged requests. They do not need consent (Section 25(2) No. 2 TDDDG). The cookie policy lists every cookie.

11. Who receives data

• Hosting: Hetzner Online GmbH, Gunzenhausen, Germany , which runs our server in the European Union (Germany) on our behalf under a data processing agreement (Art. 28 GDPR).
• Email delivery: our own mail server, hosted by Hetzner Online GmbH in Germany , which delivers account emails. Where this is an outside provider, it works on our behalf under a data processing agreement.
• Authorities: only where the law obliges us, for example on a court order. Because your snippets are end-to-end encrypted, we can only ever hand over encrypted data.

We do not sell personal data and do not share it for advertising.

12. Transfers outside the EU

We aim to process all data within the European Union or the European Economic Area. If a provider processes data outside it, we only use providers in a country with an adequacy decision of the European Commission or under the Commission's standard contractual clauses (Art. 44 to 46 GDPR). You can ask us for a copy of those safeguards.

13. How long we keep data

• Account data and synced items: until you delete your account, which you can do at any time in your account settings. Deletion removes your account, all synced items and all stored versions immediately.
• Accounts whose email address is never confirmed: deleted automatically after 7 days.
• Earlier versions of synced items: 30 days, at most 20 per item.
• Signed-in devices: until you sign the device out, from the app or from your account page.
• Browser sessions: 2 hours after your last activity. If you tick "Keep me signed in", a sign-in cookie keeps you signed in for up to 400 days or until you sign out.
• Server logs: 14 days.
• Password reset links: 60 minutes.

Where the law requires us to keep data for longer, we keep it only for that purpose and delete it afterwards.

14. Security

Besides end-to-end encryption, all connections use HTTPS, login verifiers are stored with bcrypt, access tokens are stored hashed, login attempts are rate limited, and changing your password signs out all other devices. No method is perfectly secure, but the design means a breach of our server would not reveal your snippets.

Because only you hold the keys, we cannot restore your data if you lose both your password and your recovery key. Keep the recovery key in a safe place.

15. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• have incorrect data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20); your snippets can be exported in the app at any time,
• object to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21).

Write to [email protected] from the email address of your account. We answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is not provided yet .

We do not use automated decision-making or profiling.

16. Children

Freevy accounts are not intended for children under 16. If you are younger, ask a parent or guardian before creating one.

17. Changes

We update this policy when the service or the law changes. The date at the top shows the current version. If a change affects how we process your account data, we tell account holders by email before it takes effect.