Privacy notice

Controller and contact

Xereon ICT, trading as Ice Cold Apps, Huis De Stelt 18, 6663 BA Lent, the Netherlands, is controller for Screenshot Easy accounts, its own security and the website. Privacy contact: android@icecoldapps.com.

For content processed solely on a business customer’s instructions, that customer is controller and we are processor; contact that organisation for such content where possible, and we help route requests. This notice covers the cloud, website and relevant local app features; advertising in the free Android app is explained separately below.

Account information

We process name, email, optional country, language, preferences, hashed passwords, encrypted MFA secrets, access tokens and support messages for account administration, authentication, support and performance of the agreement. Most data comes from you or your device.

A workspace administrator may provide your email for an invitation; other users may share content containing your information. Registration is optional for local captures.

Necessary account details are required to provide a cloud account. New cloud accounts are 18+; the acceptance wording records your age declaration.

We do not collect a birth date or identity-document copy for this purpose.

Captures and metadata

Local files are uploaded only when you choose that function. Cloud files may contain images, video and audio, with titles, tags, recognised text, app names, website URLs and window activity where enabled features send them.

Processing provides your chosen storage, sync, search and sharing. Cloud storage is not end-to-end encrypted; the service needs to process files.

Purposes and legal bases

We process data for account creation, authentication, selected cloud functions and necessary support to perform the agreement. Processing is limited to what is necessary to provide that service.

For proportionate security, investigating and preventing abuse and demonstrating agreements, we rely on legitimate interests: protecting users and systems, service continuity and defending legal claims. We balance those interests against your rights and freedoms. You may object on grounds relating to your particular situation.

A specific legal duty may require processing or retention. Where optional processing requires consent, we request it separately. You may withdraw consent without affecting the lawfulness of earlier processing. Accepting the terms is not marketing consent. For content processed solely on a business customer’s instructions, that customer determines the applicable legal basis.

Account security

For security we record successful login IP addresses, estimated countries, platform, counts and first/last login times. IPs are encrypted at rest and available only to authorised administrators.

Country lookup is local. Account/IP history remains while the account record exists; daily country statistics are kept for 365 days and abuse attempts for 90 days.

Recording your agreement

Explicit acceptance records contain account ID, terms version, language, server date and time, client-reported channel and a checksum of the exact terms, privacy text and acceptance wording offered. Text is kept in a version archive.

No additional IP address, browser fingerprint or password is collected for this receipt. Historical acceptance is never inferred merely from owning an account or logging in.

Recipients and hosting

Our current cloud server is hosted by Hetzner in Nuremberg, Germany. The account database, cloud files, local server backups and our operated mail server use that infrastructure.

Authorised administrators may access information when necessary for support, security and administration. System emails are delivered through our own mail server to your chosen email provider, which receives the address and message content.

Workspace members and share-link recipients receive access according to your settings. Forwarded public links may reach more people.

Legal disclosure requests are assessed individually. DNS and certificate issuance do not store your cloud files.

International transfers

Production connections use HTTPS. Current primary cloud storage and server backups are in Germany; this does not mean every recipient is within the EEA.

Your email provider, share-link recipients and optional AI or advertising services may process outside the EEA. Transfers arranged by us require an applicable adequacy decision or other valid safeguards such as standard contractual clauses with supplementary measures where necessary.

Request information or a copy of applicable safeguards at android@icecoldapps.com. Selecting an external service does not replace our own obligations.

That provider’s terms and privacy information explain its countries, retention and transfer mechanisms.

Retention and deletion

Account and cloud data remain while needed for the account or storage you choose. Trash remains until permanent deletion.

Request account and associated data deletion through Account deletion or the contact email. After appropriate verification we delete what is no longer needed; specific legal duties or necessary dispute handling may justify limited retention.

Backup rotation retains the last 14 completed snapshots. Copies of deleted information disappear when those snapshots are replaced; elapsed time depends on successful backup runs.

Backups have restricted access for recovery, not ordinary account use. Previous deletions must be reapplied after restoration.

Separate maintenance or migration backups do not automatically follow that rotation. They may be retained only while necessary for their specific recovery purpose or a legal obligation and must then be removed; when handling a deletion request we explain applicable exceptions and periods.

Email, support and logs

Verification, password recovery and necessary service messages are functional emails, not newsletter enrolment. We process recipient, delivery status and technical errors for delivery and security.

Web logs may contain IP address, time, path and status. Account-IP history is encrypted; not all technical logs are encrypted in that same way.

Current web and application log rotation retains up to 14 rotated files plus the active file; actual duration depends on activity and size. Support tickets and audit records remain linked while needed for account support, security or a specific dispute and are reviewed on deletion requests.

Mailbox correspondence and maintenance backups have no universal automatic deletion period. We limit these to handling and a specific demonstrable retention need; ask about the period for your case.

Legally required financial records are kept separately for the applicable statutory period.

Cookies and browser storage

The website uses functional session and CSRF cookies for sign-in and security; sessions normally expire after 120 minutes of inactivity. An unlocked protected-share cookie lasts one hour.

Browser storage remembers language (se.locale), theme (se.theme) and the last workspace (se.workspace) until you or the browser clears or overwrites them. These preferences are not used for advertising profiles.

The current website has no external advertising or marketing-analytics trackers. Account, storage and server-load statistics come from our own service.

The terms checkbox does not authorise future optional trackers: separate prior consent is required where applicable. Material privacy changes are communicated and new purposes explained in advance.

Local features and optional AI

Local capture, OCR and editing do not require cloud uploads. If you enable AI, selected images, recognised text, prompts and related context may be sent from your device to your configured AI endpoint, for example OpenAI.

An enabled automatic workflow can repeat this without a fresh click for each capture. Review the workflow and do not send confidential data without authority.

Your API key authenticates with that provider; the Windows app stores it locally with protection. The provider may have its own retention, charges and international processing.

Disabling AI does not automatically delete information already sent to that provider. Screenshot Easy does not use cloud content to train its own AI models.

Advertising in the Android app

The free Android edition uses Google AdMob and privacy choices through Google User Messaging Platform; the Pro edition does not contain these ads. Depending on choices and settings, the advertising software may process IP address and approximate location, device and advertising identifiers, app and ad interactions and diagnostics for ad delivery, measurement and fraud prevention.

Prior consent is requested where required; accepting terms or opening an 18+ cloud account is not that consent. Available choices can be reopened through the app’s privacy option and the advertising ID managed in Android.

Non-personalised ads can still involve SDK data processing. Also read Google’s policy and the app notice linked below; provider choices and international processing depend on that separate service.

Automated checks and other people’s data

The service uses automatic limits and blocks against abuse, such as excessive registration or login attempts from a network. These can temporarily block a legitimate attempt.

You can request human review through the contact email. We do not use account or cloud data for automated credit, employment or comparable decisions with legal effects.

Captures may contain other people’s information: we process it as part of the chosen storage or sharing, without requiring those people to have accounts. We help assess requests concerning that data and, where needed, direct them to the responsible uploader or organisation without disclosing confidential information to unauthorised people.

Your privacy rights

Where the GDPR provides these rights, you can request access, correction, erasure, restriction and portability free of charge. You may object on grounds relating to your situation to processing based on legitimate interests; you can always object to direct marketing.

You may withdraw consent without affecting earlier lawful processing. We request only proportionate identity verification, never your password or MFA code, and normally respond within one month.

Where complexity or the number of requests permits a legal extension, we explain the reason within that month; the extension is at most two additional months. You may complain to the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or your competent local regulator and seek judicial remedy.

A refusal includes reasons and available remedies. Disconnecting or uninstalling does not end a cloud account.