Privacy Policy

Last updated: October 2026

1. Privacy at a glance

skramkoob is a tool for saving and organising bookmarks. Your folders and bookmarks live on your device first; you only need an account to sync them across multiple devices or to purchase Premium. We are the data controller within the meaning of the GDPR for all data that arises in doing so.

We do not use advertising networks for profiling, no analytics or tracking services and no social media plugins. The one exception is the advertising banner in the Free plan (Section 8); it disappears entirely with Premium. No automated decision-making takes place. Data is not sold to third parties.

2. Controller

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Legal bases

We process personal data on the basis of Art. 6(1)(b) GDPR (performance of the user contract, see Terms), Art. 6(1)(f) GDPR (legitimate interest in secure, trouble-free operation), Art. 6(1)(c) GDPR (statutory retention obligations for payments) and, where consent has been given, Art. 6(1)(a) GDPR. Consent given can be withdrawn at any time with effect for the future.

SSL/TLS encryption

This site and all interfaces of the service are delivered exclusively over an encrypted connection (recognisable by https:// in the address bar). Data transmitted cannot therefore be read by third parties.

3. Hosting

skramkoob runs on a server in a data centre within the European Union. All application data (accounts, profile backups and collection backups) is held on that server. No content delivery network is used; fonts, icons and scripts are also delivered from our own server and not loaded from external hosts.

4. Website access data

When a page is requested, your browser transmits technically necessary information that the server records in log files:

• the address requested, date and time of the request
• the amount of data transferred and the HTTP status code
• browser type and version, operating system
• the referring page, where transmitted
• IP address

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in secure operation and the defence against attacks. This data is not merged with other data sources. Logs are deleted after 30 days at the latest, unless they are needed to investigate a specific case of abuse.

To fend off automated attacks we store the IP address of suspicious requests in a block list for a limited time.

Contacting us

If you write to us by e-mail, we process your details in order to handle the enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) or (f) GDPR. Messages remain with us until the purpose ceases to apply and no statutory retention periods stand in the way.

5. Account and sign-in

For an account we process:

• e-mail address and, if provided, name
• the password, solely as a non-reversible hash, never in plain text
• a session identifier by which the app recognises you on each request
• the tier booked and the confirmation status of the account
• timestamps of creation and last change
• time-limited identifiers for the confirmation e-mail and for resetting the password

The legal basis is Art. 6(1)(b) GDPR. The account is valid for skramkoob only. Other applications of the provider maintain separate accounts with their own records, even for the same e-mail address; no comparison takes place between them.

6. Folders, Bookmarks and Preview Fetching

When you create folders and bookmarks, we process: a folder's name and colour; per bookmark, the address (URL), title, description, preview image and icon, favourite flag, and the timestamps of creation, change and last opened.

Preview fetching: when you save a bookmark, our server fetches, on your behalf, the title, description and icon of the given address from the respective third-party website and returns them to the app. In doing so, our server's IP address (not your own) reaches the third-party website. For the preview image, we store only its address (URL), not the image itself; and unlike the title, description and icon, the app reloads this image directly from the third-party website every time the bookmark list is displayed, for every visible bookmark. In that case it is your own device's IP address that reaches the third-party website, not our server's. The content of the third-party page itself is not stored, only the preview data described for your bookmark. Legal basis: Art. 6(1)(b) GDPR (performance of the usage contract).

From the Premium plan onwards, your collection of folders and bookmarks is additionally stored as a backup on our server so it can be restored on another device or after a reinstall. The file resides in a dedicated directory assigned to your account and is not directly accessible over the web; only the server reads it, and authorisation is checked on every access. On the Free plan, and without an account, this collection remains solely on your device. Profile data (photo, PIN as a hash, chosen language, purchased plan) is, by contrast, synced for every logged-in account, irrespective of plan.

7. E-mail

The service sends e-mail only in response to an event: confirming registration and resetting your password. Dispatch is handled by the provider's mail server. There is no advertising or newsletter mailing.

8. Purchases via the App Store

Purchases and subscriptions are processed via the Apple App Store. You enter your payment details with Apple; they do not reach our server. We only receive confirmation from Apple as to which tier is unlocked for your device or App Store account, and store this status against your account.

The legal basis is Art. 6(1)(b) GDPR (performance of contract) as well as Art. 6(1)(c) GDPR for commercial and tax retention. Apple's privacy notices additionally apply.

9. Storage on the device

The service stores data locally on your device (IndexedDB, localStorage). If you are logged in, your folders and bookmarks are additionally transmitted to the server from the Premium plan onwards (see Section 6). What stays local only: the session (account and session token) as well as your chosen language, appearance and sort order.

Legal basis: Art. 6(1)(b) GDPR; storage is required for operation. "Reset all local data" in the profile as well as deleting the app's data removes these entries on the device.

If you are signed in, the app keeps a profile backup on the server in every tier, so that your profile is the same on all your devices. It contains your profile picture, the hash of your PIN code (if set up) and the unlocked tier. The app checks the PIN code itself only on the device; it is not transmitted.

10. Advertising in the app

If the app shows advertising in the free tier, it is delivered as a banner at the bottom of the iOS app via Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google processes device data such as the device's advertising identifier, IP address and coarse location data to select advertisements and enable billing and abuse detection.

If the app offers ad videos in return for a reward (rewarded ads), you only ever start such a video yourself; these videos are also delivered by Google AdMob.

The legal basis is Art. 6(1)(f) GDPR (financing the free tier); where personalised advertising or access to the advertising identifier requires consent, it is obtained through the operating system's prompt and can be withdrawn there at any time (Settings > Privacy & Security > Tracking). The advertising identifier can also be reset or disabled in system settings.

From the Premium tier onward there is no advertising banner. A connection to AdMob is then only made if you start an ad video yourself.

11. Retention and deletion

• Account data: until you delete the account.
• Collection backup (folders, bookmarks): until you or your account is deleted. We do not delete it on our own initiative.
• Access logs: after 30 days at the latest.
• Payment records: for the statutory retention periods, as a rule six to ten years.

You delete your account yourself in the app. The account is then deactivated and the associated data on the server is removed. This cannot be reversed. Accounts with other applications of the provider are unaffected and have to be deleted there separately.

12. Your rights

You have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). Consent given can be withdrawn at any time with effect for the future.

Please contact [email protected].

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement.

13. Changes to this policy

We adapt this policy when the service or the legal situation changes. The version published here at the time applies. In the case of substantial changes we additionally inform account holders in the application or by e-mail.