Privacy policy
Last updated Nov 13, 2026
The short version: your screenshot stays in your browser. I do not sell or share your data. I use no advertising and no tracking services. You can download your data and delete your account yourself.
1. Who is responsible
This policy covers screenshoteditor.co. The controller under the General Data Protection Regulation (GDPR) is:
Roman KochMartin-Opitz-Str. 14
13357 Berlin, Germany
Email: contact@romankoch.online
My other websites and apps have their own privacy policies. This policy does not cover them.
2. Your images and your settings
The editor works in your browser. When you add a screenshot, it is drawn, edited and exported on your device. The free editor does not send your image to my server. An automated test records the network traffic of a free session and checks that no image data is sent.
The editor keeps a draft (your image and your settings) in your browser's own storage, so that you can come back and continue. This draft stays on your device. "Start new" removes it, and so does clearing your browser data.
There is one exception, and it is your choice. With Premium you can save your own backgrounds. When you upload one, it is stored on the server that hosts the website (see section 3), so that you can use it again, also on another device. I store the image file, a small preview of it, the name you gave it, its size and the time you added it. I remove the metadata of the file from the stored copy. This includes camera data and the place where a photo was taken (GPS). Only you can open your files, while you are signed in. The number of files and the space you can use have limits. Your screenshots are never part of this. They stay in your browser.
The editor also uses your browser's session storage for one thing: it remembers which plan you chose while you sign in. It is cleared when you close the tab.
3. Hosting and server logs
The website runs on a server of Alfahosting GmbH, Edmund-von-Lippmann-Straße 13-15, 06112 Halle (Saale), Germany. Alfahosting processes data only for me, as my processor.
When you open a page, the web server records technical data in log files: your IP address, the date and time, the address you asked for, the answer code, the referring page if your browser sends it, and your browser type. This data is needed to deliver the website and to keep it secure and working. I do not combine it with other data. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a working and secure website).
The editor's own server program writes a shorter log: date and time, the path, the answer code and how long the answer took. It has no IP address, no image, no sign-in token and no full email address.
4. Cookies
The site sets two cookies. Both are needed to sign you in. Neither is used for tracking. You get them only when you press "Sign in". No other cookies exist, so there is no cookie banner.
| Cookie | What it does | How long |
|---|---|---|
sft_oauth | Protects the trip to Google and back against forgery. | 10 minutes |
sft_session | Keeps you signed in. It holds a random token. My server stores only a hash of it. | 30 days, renewed while you use the site |
Legal basis: § 25 (2) No. 2 TDDDG (strictly necessary for a service you asked for) and Art. 6 (1) (b) GDPR.
5. Sign-in with Google
You can sign in only with Google. When you press "Continue with Google", your browser goes to Google. You sign in there. I never see your Google password. Google tells me your Google account ID, your email address, your name and whether the address is verified. Google also sends the address of your profile picture. I do not store or use it.
I store your email address, your name, your Google account ID and the time you joined. I use them to know who you are when you sign in and to connect a purchase to your account. Legal basis: Art. 6 (1) (b) GDPR (an account is needed for Premium).
Google processes your data for the sign-in under its own privacy policy: policies.google.com/privacy.
6. Premium and payment (Stripe)
Premium is paid through Stripe. When you choose a plan, your browser goes to Stripe's page. You enter your payment details there. I never see or store your card number.
From Stripe I receive and store: your Stripe customer ID, the subscription ID, the plan (monthly or lifetime), its status, the end of the paid period, whether it ends at the end of the period, and the date of a lifetime purchase. Legal basis: Art. 6 (1) (b) GDPR (the contract). Stripe is responsible for the payment data it collects. Its privacy policy applies: stripe.com/privacy.
The price of the lifetime plan depends on how many lifetime plans were sold before. I keep that count without any link to a person, so deleting an account never changes it.
7. What I do not do
- I do not sell or share your data.
- I use no advertising and no third-party analytics or tracking.
- I store no passwords.
- I do not look at your images. The free editor never receives them.
8. Service providers and transfers
- Alfahosting GmbH, Germany: hosting (see section 3).
- Google: sign-in, only if you sign in.
- Stripe: payment, only if you buy Premium.
Google and Stripe belong to groups based in the USA, so data may go to the USA. Google LLC and Stripe take part in the EU-U.S. Data Privacy Framework, for which the EU Commission decided that the protection is adequate (Art. 45 GDPR).
9. How long I keep data
| Data | How long |
|---|---|
| Account: email, name, Google account ID | Until you delete your account |
| Sign-in sessions | Until you sign out, or until they expire (30 days without use). A job removes expired sessions. |
| Plan record (plan, status, Stripe IDs, dates) | Until you delete your account |
| Backgrounds you upload (Premium): the image, its preview, its name, its size and the time you added it | Until you delete the background or your account. If your Premium ends, they stay. You can still see, download and delete them, but you cannot add new ones. |
| Server log files | No longer than needed for security and for finding errors |
| Payment and invoice records at Stripe | Under Stripe's own rules and the law |
10. Your rights
Under the GDPR you have the right to:
- get information about the data I store about you (Art. 15)
- have wrong data corrected (Art. 16)
- have your data deleted (Art. 17)
- restrict the processing (Art. 18)
- get your data in a portable format (Art. 20)
- object to processing based on legitimate interest (Art. 21)
You can use two of these rights yourself, at any time, in your account settings (press your round picture at the top right, then "Account"):
- Download my data gives you a zip file with all data I store about you. It includes the backgrounds you uploaded.
- Delete account removes, at once: your email address, your name, your Google account ID, your sign-in sessions on every device, your plan record and the backgrounds you uploaded. It asks Stripe to cancel your subscriptions and to delete your customer record there. Stripe keeps payment and invoice records where the law requires it.
I cannot promise to restore a file that is lost. Keep your own copy of any background that matters to you.
For everything else, write to contact@romankoch.online. You can also complain to a data protection authority. The authority for me is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany.
11. Changes
I update this policy when the product changes. The date at the top shows the latest version.