Privacy Policy
Version 2026-10-09.
The short version
We store what you put into PAPEPPE so the app can show it back to you. We do not sell anything to anyone. Nobody at PAPEPPE opens your cards unless you ask us to help or the law requires it. You can take everything with you or have it deleted.
Who is responsible
Style By Jooz S.L., Jávea, Spain. VAT ESB21753397.
Write to privacy@papeppe.com about anything on this page.
For payments, Paddle is responsible for their own part. See their privacy policy.
What we hold
Your account — email address, name if you give one, password (stored scrambled, we never see it), when you signed up, when you were last active.
What you make — boards, cards, labels, notes, photos and files you upload.
Your settings — preferences, which devices get notifications.
Messages — what you write to us and what we write back.
Technical data — which version of the app you are on, errors, rough usage numbers. We count visits ourselves: the page, where you came from, your device type and an approximate location (country, region and city) worked out from your connection. No cookies, and we never store your IP address. Nothing follows you around the internet, unless you say yes to ads cookies (see below).
Payments — handled by Paddle. We never see your card. We see whether your subscription is active and when it renews.
Why we hold it
| What for | On what basis |
|---|---|
| Running the app | To perform our contract with you |
| Payments and invoices | Contract, and legal obligation |
| Support | Contract |
| Security and abuse | Our legitimate interest in a working service |
| Marketing mail | Your consent, which you can withdraw |
| Measuring which of our ads work (Meta, Pinterest) | Your consent in the cookie banner, which you can withdraw |
| Keeping invoices | Legal obligation |
Who else sees it
Only suppliers who need it to make the service work:
- Supabase — database and file storage, Frankfurt, Germany
- Vercel — runs the website and the app, United States, with servers worldwide
- Resend — sends our mail, United States; mail leaves from Ireland
- Paddle — payments, as merchant of record, United Kingdom
- Anthropic — only when you use a button that asks AI for help: the text or photo of that card, United States. Not used to train their models.
- Google — our mailbox, when you write to hello@ or privacy@papeppe.com
- Lovable — the tool we build the app with; it can reach the database when we fix something, Sweden
- Push services — Apple, Google or Mozilla, only when you turn on notifications, to deliver them
Each of them has an agreement with us that says they may only use your data to do their job.
Several of these are in the United States. Where data leaves the EU, it is covered by the safeguards the law requires, such as the EU–US Data Privacy Framework or standard contractual clauses.
If this list changes, we update this page.
Ads cookies, only if you say yes
Meta (Ireland and United States) and Pinterest (Ireland and United States) — only if you say yes in the cookie banner: which of our pages you visit and whether you sign up or pay, so we can see which ads work. They also use this for their own purposes, under their own privacy policies. They get no email address or name from us.
Say no, or change your mind later via Cookie settings at the bottom of every page, and nothing is sent to them. The app works exactly the same. Details are in our Cookie Policy.
We never sell your data. Not to advertisers, not to data brokers, not to anyone.
How long we keep it
| What | How long |
|---|---|
| Your account and content | While your account is open |
| After you delete your account | 30 days, then gone |
| Backups | Daily backups, kept for 7 days. Our own extra copies are removed within 90 days. |
| Earlier versions of a card | 30 days, so we can restore a card if something goes wrong. They go with your account. |
| Invoices | As long as tax law requires |
| Security logs | Up to 24 months |
| Support messages | 24 months after the conversation ends |
What you can ask for
See what we hold. Correct it. Have it deleted. Get a copy in a readable file. Object to something. Withdraw consent you gave earlier.
Two of those are buttons in Settings, under your name: export my data and delete my account. The rest, write to privacy@papeppe.com.
We answer within one month. If it is complicated we will say so and take up to two months more, but we will tell you.
Not happy with how we handle it? You can complain to the Spanish data protection authority (AEPD) or to the one in your own country.
If you are in California
We do not sell your personal information. If you say yes to ads cookies, Meta and Pinterest learn that you came to us from one of their ads. Under California law that can count as sharing for advertising. Say no in the cookie banner and it does not happen.
You can ask what we hold, have it deleted, have it corrected, and take a copy. Same as above, same address. We will not treat you differently for asking.
Deleting your account
In Settings, tap your name, then Delete my account. You then have 30 days to change your mind: tap Keep my account in the same place.
After 30 days your boards, cards, photos, files and settings are gone for good. Invoices stay, because tax law says they must.
Children
PAPEPPE is for people of 18 and over. We do not knowingly collect data from children under 13. If you think a child has given us data, write to privacy@papeppe.com and we will remove it.
Security
Encrypted in transit and at rest. Access to the database is limited to people who need it. Every account's data is walled off from every other account at database level, not only in the app. An automated check runs daily for weak spots.
If something goes wrong and it is likely to put you at risk, we tell the regulator within 72 hours and you as soon as we can.
When this changes
We will tell you by mail before it takes effect. Older versions stay available so you can see what changed.