Privacy Policy.

The short version

Paperstand exists so you can read in peace. That includes peace from us: we don't sell your data, we don't show ads, and we don't profile your reading to anyone. We store what's needed to run your stand — nothing more.

1. Controller

The controller within the meaning of Art. 4 (7) GDPR is Florian Preusner, Freester Weg 10c, 13503 Berlin, Germany. Paperstand is operated as a sole proprietorship. For any privacy matter, write to privacy@paperstand.app. We are not required to appoint a data protection officer, because the thresholds in Art. 37 GDPR and § 38 BDSG are not met.

2. Overview of processing

We process the following categories of personal data:

• Account data — your email address, display name and the hash of your password.
• Content data — the newsletters delivered to your @paperstand.email address, your subscriptions, reading position and saved issues.
• Settings — notification schedule, aliases, language and reading preferences.
• Meta and log data — short-lived server logs (IP address, timestamps) for security and abuse prevention, deleted after 7 days.
• Contract data — for Premium, the status of your subscription. We do not see payment details; they sit with Apple and Google.

The data subjects are users of the service and people who write to us. The purposes are providing the service, communicating with you, security, and meeting legal obligations.

3. Legal bases

We rely on the following legal bases:

• Art. 6 (1)(b) GDPR (performance of a contract) — your account, delivering and displaying your newsletters, settings, and the Premium subscription.
• Art. 6 (1)(f) GDPR (legitimate interests) — log data for security and abuse prevention. Our interest is running the service reliably and safely; the short retention window keeps the intrusion small.
• Art. 6 (1)(c) GDPR (legal obligation) — where law requires us to retain something.

Where consent under Art. 6 (1)(a) GDPR is required, we ask for it. You can withdraw consent at any time with effect for the future.

4. What we never do

We do not sell or rent personal data. We do not show advertising or use advertising trackers. We do not read your newsletters to build profiles. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Other than to the processors named in section 5, we do not share personal data with third parties.

5. Recipients and processors

Our infrastructure is hosted with a cloud infrastructure provider operating data centers in the European Union. Email from the contact form is sent through an email delivery provider established in the United States. Premium is handled by Apple and Google; we never see your full payment details. Error reporting runs on an instance we host ourselves — no third party is involved. Data processing agreements under Art. 28 GDPR are in place with all processors.

6. Transfers to third countries

The servers your stand lives on are located in the European Union. Individual providers we use to run the website, send email and handle Premium are established in the United States. Where personal data is transferred to a third country in the process, it happens on the basis of an adequacy decision under Art. 45 GDPR or on the basis of standard contractual clauses under Art. 46 (2)(c) GDPR.

7. Retention and deletion

On the free plan we delete newsletter issues 3 months after delivery; saved issues are excepted. Premium archives are kept for as long as your subscription runs. If you delete your account, we remove all personal data and your archive within 30 days — except where statutory retention obligations require us to keep something longer.

8. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Under Art. 21 GDPR you may object at any time to processing we base on a legitimate interest. Write to privacy@paperstand.app. You also have the right to lodge a complaint with a supervisory authority — for us that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

9. Registration and user account

You need an account to use Paperstand. We process the data you give us at registration and the data that arises through use. Your password is stored only as a hash. You must be at least 16 years old; that is the age from which Art. 8 (1) GDPR allows a person in Germany to consent on their own. The legal basis is Art. 6 (1)(b) GDPR.

10. Contact requests

When you write to us through the contact form or by email, we process what you send in order to deal with the request. The legal basis is Art. 6 (1)(b) GDPR where the request concerns a contract, and Art. 6 (1)(f) GDPR otherwise.