Privacy

Last updated: November 2026. The legally binding version of this policy is the German one.

1. Controller

Dennis Schott
Hauptstr. 35
98660 Themar
Germany

2. Principle: your content stays on your device

Snaez is a local app. Emails, tasks, calendars, contacts, notes and the search index are stored encrypted on your device. For your mailboxes the app connects directly to your email providers; this content does not pass through our servers. Snaez contains no advertising, no tracking, no analytics tools and no automatic crash reports. The public website uses the self-hosted web statistics described below; this does not apply to the app.

Besides optional website statistics, our servers process the data required for the website, your Snaez account, your license, the trial and – if you use it – device sync. These processing activities are described below.

3. Hosting and access data

The website and license service are hosted by: Hetzner, Deutschland. The hosting provider processes data on our behalf under a data processing agreement (Art. 28 GDPR).

When you open the website or the app makes a request, technically necessary data is processed: IP address, time, requested address, status code and the details of your browser or the app. Our application only logs the method, path, status and duration, not IP addresses. To prevent abuse (for example when signing in, registering or starting a trial) we count requests per IP address; only a hash of the address (truncated for IPv6) is stored for this and deleted after one hour at the latest. The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR).

4. Cookies

We only use technically necessary cookies (Section 25 (2) no. 2 TDDDG):

snaez_session: keeps you signed in, for at most 8 hours.
snaez_login: links the steps of a sign-in with a second factor, for at most 5 minutes.
snaez_csrf: protects forms against forged requests.
snaez_preferences: stores the language you chose for the website.

snaez_analytics remembers your optional statistics choice for at most six months so we can respect your decision.

The web statistics described below do not set statistics or marketing cookies.

4a. Web statistics with Rybbit

With your voluntary consent, our public information pages use Rybbit at rybbit.reamote.com. We host Rybbit ourselves on a Hetzner server located in Germany. Analytics data is processed on this instance; we do not use the Rybbit provider's cloud service for this.

We evaluate which pages are visited, how visitors find our website and how they use our information. We collect visited pages and page titles, visit times and duration, referring websites, URL and campaign parameters, and details about the browser, operating system, device, screen resolution and approximate location. Clicks on outbound links are also recorded. The IP address is processed for transmission and to derive location details and pseudonymous visitor identifiers. We do not store full IP addresses in plain text in the analytics system.

Rybbit does not set cookies for these web statistics. Session replay and automatic capture of form inputs, copied text and button clicks are disabled. Account, admin, sign-in, checkout and pages containing verification or reset links are excluded from the integration. Content from the Snaez app, license keys and authenticator setup keys are not transmitted to Rybbit.

The legal basis is your voluntary consent (Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG). Without consent the Rybbit script is not loaded. Analytics data is deleted after 30 days. You can withdraw consent at any time by choosing “Without statistics” under Statistics preferences. This does not affect the lawfulness of processing before withdrawal.

5. Snaez account

For an account we store your email address, a salted password hash (PBKDF2), the time you confirmed your email address and – if you set up two-step sign-in – its secret, stored encrypted. Sessions and links for confirming or resetting are only stored as hashes and expire after 8 hours, 24 hours and 60 minutes respectively.

We send confirmation and password reset emails through an email service provider acting as our processor . The legal basis is the performance of the user agreement (Art. 6 (1) (b) GDPR). We keep account data until you ask us by email to delete your account.

6. Purchases through Polar

Licenses are sold by Polar Software, Inc. (polar.sh) as merchant of record. For a purchase we transmit your email address, an internal customer number, the chosen currency and your IP address (to determine sales tax and prevent fraud) to Polar. You enter payment details directly with Polar; we do not receive them. Polar processes the data as an independent controller under its own privacy policy, including in the United States. The transfer is necessary to carry out the purchase (Art. 6 (1) (b), Art. 49 (1) (b) GDPR).

From Polar we receive the order status, amount, currency and your customer number at Polar. When a purchase is started, we record the accepted terms version, language and timestamp and transmit them to Polar with the internal checkout reference. This supports contract performance and evidence of the agreed terms (Art. 6 (1) (b) and (f) GDPR). We keep order and license data for as long as statutory retention obligations require (Art. 6 (1) (c) GDPR).

7. License activation

When you activate Snaez on a device, we store the license, a randomly generated device identifier, the device's public key, the device name, a hashed pseudonymous hardware hash (so the activation stays bound to this computer), the time of activation and of the last check, and a log of license events (such as "activated" or "released"). The app checks the license with our server regularly. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). The data is kept as long as the license exists.

8. Trial

The free trial lasts 7 days and can be used once per computer. When you start it, the app derives a pseudonymous hash from your computer's hardware identifier and sends only this hash – never the identifier itself – together with a random device identifier, the device's public key and the app version. Our server stores the hash hashed again, the device identifier, the public key, the start and end of the trial and the time of the last confirmation; it does not store the app version. During the trial the app confirms it at every start and once a day.

The legal basis is fulfilling your request for a trial (Art. 6 (1) (b) GDPR) and our legitimate interest in preventing repeated use (Art. 6 (1) (f) GDPR); reading the hardware identifier is strictly necessary for the service you requested (Section 25 (2) no. 2 TDDDG). We delete this data two years after the trial ended.

9. Device sync

If you sync between your devices, content is end-to-end encrypted on your device before it reaches our server. We cannot read it. The server stores the encrypted data and the details needed for delivery: account identifier, device identifiers, device names, platform, public keys and timestamps. The IP address is only held briefly in memory to limit the creation of new accounts. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). The data is kept until you stop syncing and ask for its deletion.

10. Push notifications

If you turn on instant notifications for new email, our push service watches your mailbox. For this the app transmits the server address, user name and credentials or sign-in token of the mailbox; they are stored encrypted and only used for this connection. The service does not store email content. The notification itself contains neither sender nor subject and is delivered through Apple's push service (APNs), which receives the device token for this. Credentials are deleted after several failed sign-ins and when you turn the feature off. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

11. Connections from the app to third parties

Email and calendar providers: the app connects directly to the servers of your accounts. If you sign in with Google or Microsoft, sign-in happens directly between the app and the provider; the sign-in token is only kept in your device's keychain.
Sender images: for sender images the app loads the logo from the website of the sender's domain. The operator of that website sees your device's IP address. Large email providers are excluded; you can turn sender images off in the settings.
Remote images in emails: are not loaded by default, and known tracking pixels are always blocked. If you load them, the sender sees the time and IP address.
Updates: the app asks our download server whether a new version is available. No identifiers are transmitted.
Local assistance: assistance features run on your device. Only if you download a language model does the app fetch it from Hugging Face.

The app creates encrypted backups in a folder of your choice. They are not transmitted to us.

12. Your rights

You have the right to

access the data stored about you (Art. 15 GDPR),
rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
object to processing based on legitimate interests (Art. 21 GDPR),
lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Write to us at support@reamote.com. We do not make automated decisions within the meaning of Art. 22 GDPR.

13. Changes

We update this policy when Snaez or the legal requirements change. The version published here applies.