Privacy Policy

1. Who is responsible

The controller is Egor Menyakin, United Kingdom (see the Imprint for the postal address). Contact for any privacy request: support@paypers.app.

2. What we process

• Account data: your email address and a hashed password (we never store the password itself); or, if you sign in with Telegram, your Telegram ID, username and first name; or, with Sign in with Apple, a stable Apple user ID, the email Apple shares (it can be a private relay address) and the name you choose to share.
• Subscription data you enter: service name, price, currency, billing period, next charge and trial end dates, status, category and notes.
• Settings: language, time zone, reminder days and quiet hours.
• Notifications: if you link Telegram, your Telegram chat ID; on iOS, the push token of your device; a log of reminders we sent.
• Premium purchases on iOS: Apple transaction IDs, product, status, expiry date and your App Store country. Payment is handled entirely by Apple — we never see your card details.
• Bank statement import: the CSV file is read in your browser or app; only date, description and amount of each line are sent to our server to detect recurring payments. These lines are not stored — only the subscriptions you confirm are saved.
• Technical data: IP address, time and type of each request in server logs, used for security, abuse prevention (rate limiting) and troubleshooting.

3. Why and on what legal basis

• To provide the service you signed up for — your registry, totals, calendar, reminders, cancellation guides and Premium (Art. 6(1)(b) GDPR — performance of a contract).
• To keep the service secure and prevent abuse (Art. 6(1)(f) — our legitimate interest in a secure service).
• To meet legal obligations, e.g. tax records for purchases (Art. 6(1)(c)).

We do not use your data for advertising, profiling or automated decisions that have legal or similarly significant effects on you.

4. Where data is stored and who receives it

All data is stored on our server in Frankfurt am Main, Germany (EU), rented from a hosting provider that acts as our processor.

• Apple — Sign in with Apple, push notifications (APNs) and App Store purchases, if you use them.
• Telegram — reminder messages, if you link your Telegram account.
• Cloudflare — provides DNS for our domain; it does not receive the content of your requests.

Apple and Telegram may process data outside the EU/UK under their own safeguards (adequacy decisions or Standard Contractual Clauses). We share data with authorities only where the law requires it.

5. Cookies and local storage

We use only strictly necessary cookies, so no consent banner is needed:

• pp_session — keeps you signed in (httpOnly, 30 days);
• paypers_lang — remembers your language (1 year).

The iOS app stores your sign-in token in the device's secure Keychain.

6. How long we keep data

Your account data is kept until you delete your account. Deleting it (Settings → Your data → Delete account, on the web or in the app) erases your data from our database immediately and signs you out everywhere; encrypted backups are overwritten within 14 days. Sessions expire after 30 days of inactivity. Server logs are rotated automatically and kept only as long as needed for security and troubleshooting. Purchase records may be kept longer where tax law requires.

7. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, and to data portability. You can download all your data as a JSON file at any time in Settings → Your data, and edit or delete it directly in the service. For anything else, write to support@paypers.app; we reply within one month.

You can also lodge a complaint with a supervisory authority — in the UK the Information Commissioner's Office (ico.org.uk), in the EU the data protection authority of your country.

8. Security

Traffic is encrypted with TLS; passwords are hashed with Argon2; sessions are random tokens in httpOnly cookies; access to the server is limited to key-based SSH; backups are encrypted.

9. Children

PAYPERS is not intended for children under 16, and we do not knowingly collect their data.

10. Changes

We'll update this page when our processing changes and note the date at the top. For material changes we'll inform you in the service.