Privacy policy

You can complain to a data protection authority, for example the one responsible for us:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 7. OG, 20459 Hamburg, Germany, phone +49 40 428 54 4040, mailbox@datenschutz.hamburg.de, datenschutz-hamburg.de (opens in a new tab)

Our website and our server run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. They are delivered through Cloudflare, Inc., 101 Townsend Street, San Francisco, USA (content delivery, protection against attacks, DNS). Both act as our processors.

When you open a page, or when the app talks to our server, your browser or the app sends the technical data needed to answer: IP address, date and time, the address requested, the page you came from, and your browser or app version and operating system. Cloudflare checks the requests for attacks and passes them on to our server.

• Purpose: to deliver the website and the app's online services securely and reliably, and to fend off attacks.
• Legal basis: Art. 6 Abs. 1 lit. f GDPR. Our legitimate interest is a secure, available and fast service.
• Retention: our server logs are deleted after 14 days.
• If Cloudflare suspects automated traffic, it may store a short-lived security cookie (__cf_bm or cf_clearance) in your browser. This is strictly necessary to protect the service you asked for (§ 25 Abs. 2 Nr. 2 TDDDG).

To show prices with the VAT of your country, Cloudflare tells our server which country your connection comes from; it determines this from your IP address. While you just browse, we don't store it. When you buy, we store the country and the IP address of your checkout with your order as evidence for VAT (see 5.3).

• Legal basis: Art. 6 Abs. 1 lit. b GDPR (price information before a contract) and Art. 6 Abs. 1 lit. c GDPR (VAT law).

We set no cookies of our own (Stripe's are listed below). We only store the following in your browser's storage, and only when needed:

These entries are strictly necessary for what you asked for, staying logged in, remembering your choice and not charging you twice, so they need no consent (§ 25 Abs. 2 Nr. 2 TDDDG).

When you open the payment step, the payment provider's scripts load (Mollie, Stripe, Apple Pay). They may store or read data in your browser that is needed for the payment and to prevent fraud (§ 25 Abs. 2 Nr. 2 TDDDG; see 5.2). If Stripe handles your payment, Stripe's script sets these cookies as soon as the payment step opens, before you pay, and they stay after you close it:

YouTube videos load only after you click (3.6).

Our own counters, without cookies. Our server counts installer downloads and the steps of the checkout (for example "payment window opened"). For the checkout steps, your browser sends a short message to our server when you take a step. We store the kind of event, a few labels (for example the plan, the payment method, or the kind of page that referred you), the country of your connection and the time. We store no IP address, no user ID and no email address. To filter out bots and double counts, our server keeps a one-way hash of your IP address and browser version in memory for 30 minutes; it is never written to disk.

• Purpose: to know how many people download the app and where the checkout fails.
• Legal basis: Art. 6 Abs. 1 lit. f GDPR. Our legitimate interest is a working download and checkout. The stored entries do not identify you.
• Retention: 25 months.
• Switching it off: use the "Statistics" switch at the bottom of our pages or in the overview "What leaves your browser and the app" at the top of this policy. It stores ft:analytics-optout in your browser and stops your browser from sending checkout steps. Download counts on our server contain no personal data and continue.

If an error happens in your browser or on our server, we send an error report to Sentry (Functional Software, Inc., 45 Fremont Street, San Francisco, USA), our processor. Sentry stores error reports in its EU data region in Frankfurt, Germany; Sentry's account and organisation data are held in the USA.

A report contains the error message, technical details of where it happened, your browser and operating system version, the page address without parameters, and the steps just before the error (page changes and requests, with shortened addresses). We remove email addresses and access tokens before a report is sent. Sentry does not store IP addresses for us, and we do not record sessions.

• Purpose: to find and fix errors, especially in downloads and the checkout.
• Legal basis: Art. 6 Abs. 1 lit. f GDPR. Our legitimate interest is a website that works. Reading the technical data in your browser is necessary to provide the website you use without errors (§ 25 Abs. 2 Nr. 2 TDDDG).
• Retention: 30 days.

Some pages show YouTube videos. We load them only after you click the preview; until then, nothing is sent to YouTube. When you click, the video loads from youtube-nocookie.com. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, then receives your IP address and technical data about your browser and device, may store or read data on your device, and may transfer data to Google LLC in the USA. Google is responsible for this processing itself (policies.google.com/privacy (opens in a new tab)).

• Legal basis: your consent by clicking (Art. 6 Abs. 1 lit. a GDPR, § 25 Abs. 1 TDDDG). You withdraw it for the future by leaving or reloading the page; the video is then no longer loaded.

Links to Discord, YouTube, X, TikTok and Trustpilot are plain links. Nothing is sent to these services until you click; then they receive your IP address and the address of our website. We host our fonts ourselves, so your browser does not contact font services.

When you buy, we process: the plan, the price, the VAT rate and country, your email address (if you buy as a guest) or your account, your agreement to the Terms, your request that your access starts right away and your agreement to what the one-click run changes in Windows Security (each with the time and the wording you agreed to), the payment method, the IP address and country of your connection at checkout, and a label of the page or campaign that led you to the checkout. If you buy as a guest, we create a license key and send it to your email address.

• Purpose: to conclude and perform the contract, take the payment, charge the correct VAT and prove your consents.
• Legal basis: Art. 6 Abs. 1 lit. b GDPR (contract); Art. 6 Abs. 1 lit. c GDPR (tax law); Art. 6 Abs. 1 lit. f GDPR for keeping proof of your consents and for the label of the referring page (our legitimate interest in being able to prove the contract and in knowing which of our pages lead to purchases).

Mollie. Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, processes payments as an independent controller. If you pay by card, you type your card details into Mollie's fields; they go straight to Mollie, and we never see your full card number. We send Mollie the amount, the plan, your email address and name, our order details, and the IP address and country of your checkout. Mollie's privacy statement: mollie.com/privacy (opens in a new tab).

Stripe. Stripe Payments Europe, Limited, Dublin, Ireland, processes payments for us as our processor, and as an independent controller for fraud prevention and its own legal obligations; data may be transferred to Stripe, LLC in the USA. Stripe's script loads only when you open the payment step and collects information about your device and how you use the payment form, to detect fraud. Stripe's privacy policy: stripe.com/privacy (opens in a new tab).

PayPal, Apple Pay, Google Pay, Link and paysafecard. If you choose one of these, its provider processes your data as an independent controller under its own privacy policy: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; Apple Distribution International Ltd., Ireland; Google Ireland Limited, Ireland; Stripe (Link); paysafecard (Paysafe group).

What we get back from the provider: the status of the payment, the amount and the method; for card payments the cardholder's name, the last four digits, the card country and the card type; for subscriptions, the subscription and customer references.

• Legal basis: Art. 6 Abs. 1 lit. b GDPR (contract); Art. 6 Abs. 1 lit. c GDPR (tax records); Art. 6 Abs. 1 lit. f GDPR (our legitimate interest in preventing fraud and handling chargebacks).
• Retention: see section 10.

The law requires us to keep records of every sale (§ 147 AO, § 14b UStG) and, for sales to consumers in other EU countries, evidence of where our customers are located (§ 22 Abs. 1 Satz 4 UStG; Art. 24b and 63c of Implementing Regulation (EU) No 282/2011). For this we keep your order details, the payment reference, the IP address and country of your checkout and, if available, the card country. Our bookkeeping runs in Meridian, accounting software that we operate ourselves. Our tax advisor receives the bookkeeping data, and tax authorities receive it on request.

• Legal basis: Art. 6 Abs. 1 lit. c GDPR. Where tax law does not strictly require the IP address, Art. 6 Abs. 1 lit. f GDPR; our legitimate interest is being able to prove the correct VAT treatment in a tax audit.
• Retention: 8 years for accounting records and 10 years for the location evidence, each from the end of the year of the sale.
• We do not send invoices to consumers.

These are: the confirmation code, password reset links, a welcome email with setup help, the contract confirmation (with the Terms, the withdrawal information and, if you bought as a guest, your license key), payment notices, notices about failed renewals, confirmations of cancellations and withdrawals, a reminder before your paid access ends after a cancellation, and notices about changes to your plan or to these documents.

• Legal basis: Art. 6 Abs. 1 lit. b GDPR, and Art. 6 Abs. 1 lit. c GDPR where the law requires the email (§§ 312f, 312k, 356a BGB). These emails contain no advertising, and you can't unsubscribe from them while your contract runs.

If you tick the box when you create your account, we send you performance tips and news about Frozen Tweaks Pro: a few emails in the first weeks, then now and then. The confirmation code in our first email proves that the address is yours, and that email reminds you of your choice. We store your consent with the time, the wording you agreed to and where you gave it.

• Legal basis: your consent (Art. 6 Abs. 1 lit. a GDPR; § 7 Abs. 2 Nr. 2 UWG). You can withdraw it at any time with the unsubscribe link in every such email, or in your dashboard. This does not affect emails sent before.
• If you are under 16, you need a parent's consent (Art. 8 GDPR).
• Retention: the proof of your consent is kept for as long as we send you these emails and 3 years after that.

Every email that is not strictly about your account or your contract has a one-click unsubscribe link. We then add a one-way hash of your email address to a block list, so that you don't get such emails again.

• Legal basis: Art. 6 Abs. 1 lit. c and lit. f GDPR (respecting your objection and being able to prove it).

When you use "Cancel contracts here" or "Withdraw from contract here", we process what you enter: your name, the email address you used for the purchase, the contract, for a cancellation its type, the date it should take effect and, for termination for good cause, the reason, and the email address for our confirmation. We also record when we received it. We confirm by email. If the email address you enter differs from the one in your account, we also inform the account's address.

• Purpose: to carry out your declaration and prove its receipt.
• Legal basis: Art. 6 Abs. 1 lit. c GDPR (§§ 312k, 356a BGB) and Art. 6 Abs. 1 lit. b GDPR.
• Retention: 3 years from the end of the year (the limitation period).

If you cancel on your dashboard, you can tell us why; this is optional. If your subscription runs through Stripe, we pass the reason you picked to Stripe as cancellation feedback.

If you write to support@frozentweaks.com or use the contact form, we process your message, your contact details and anything you send us, for example screenshots or log files. Our email address is forwarded by Cloudflare (Email Routing) to our mailbox at Still to be confirmed: Support mailbox provider that receives support@ (a business mail service with a DPA), our processor.

• Legal basis: Art. 6 Abs. 1 lit. b GDPR for questions about a contract; otherwise Art. 6 Abs. 1 lit. f GDPR (our legitimate interest in answering you).
• Retention: 2 years after the last message; messages that matter for tax purposes, for example about a payment, 6 years (§ 147 AO).

If you join our Discord server, Discord processes your data as its own controller (discord.com/privacy (opens in a new tab)). We see what you post there.

We show reviews that customers published on Trustpilot: display name, country, date, star rating and the review text, sometimes shortened. Source: trustpilot.com (opens in a new tab), publicly accessible.

• Legal basis: Art. 6 Abs. 1 lit. f GDPR; our legitimate interest is showing genuine customer reviews. If you wrote one of them and don't want it shown here, tell us and we remove it.

Our server limits how many requests an IP address can send in a short time and temporarily blocks addresses that misbehave; it keeps these IP addresses in memory for at most 15 minutes. Only the owner and staff bound to confidentiality can access customer data in our admin area. To help you in support, the owner can view your account as you see it. Every admin action is logged; the log is kept for 3 years. Our database backups are encrypted and kept for 30 days. Data travel encrypted (TLS), and passwords are stored only as Argon2id hashes.

• Legal basis: Art. 6 Abs. 1 lit. f GDPR (our legitimate interest in secure services) and Art. 32 GDPR.

Some recipients are in the USA or belong to US companies. For companies certified under the EU-U.S. Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023 applies (Art. 45 GDPR). In addition, the contracts with these providers include the EU standard contractual clauses (Art. 46 Abs. 2 lit. c GDPR), so that transfers stay protected even if the adequacy decision should no longer apply. You can ask us for a copy of these safeguards.

We make no decisions based solely on automated processing that have legal effects on you or affect you in a similarly significant way (Art. 22 GDPR). Our payment providers check payments automatically for fraud as their own controllers and may decline a payment. If that happens, contact the provider or us.