Privacy Policy
Hashtagmixer

sareba Computer & Software e.U. Vorgartenstraße 441 A-2145 Hausbrunn Austria Email: it@sareba.net Hashtagmixer is operated as a project of sareba Computer & Software e.U..

This Privacy Policy applies to both the Hashtagmixer website and the Hashtagmixer mobile applications for Apple iOS and Google Android.

Hashtagmixer does not use passwords. To sign in, you enter your email address and we send you a 6-digit one-time code (magic code) that is valid for 15 minutes. The email is sent via SMTP through the mail server email.sareba.net. We process your email address, the code (stored only as a hash), the IP address and user agent of the request, and the times and number of failed attempts (abuse protection). These code records are deleted 24 hours after they were created. Your email address is stored as the identifier of your account for as long as the account exists. Legal basis: Art. 6(1)(b) GDPR (contract); for abuse protection Art. 6(1)(f) GDPR (legitimate interest in a secure service).

After you sign in, the server sets technically necessary cookies (HttpOnly, not readable by scripts in the browser): - an access token, valid for 15 minutes - a refresh token, valid for 30 days, which is only sent to the sign-in interface - a session marker without content, with the same lifetime as the refresh token The website also stores your language choice in the cookie “locale” (1 year) and your theme choice (light/dark) in your browser’s local storage. For each session we store on the server: platform (web, iOS, Android), device name, user agent, the most recently used IP address, and the times of sign-in, expiry and last use. Under “Active Sessions” you can see this information and sign out individual devices. Signed-out sessions are deleted 7 days after their expiry, all other sessions no later than 90 days after their expiry. We do not use advertising or tracking cookies. Legal basis: Art. 6(1)(b) GDPR; for securing accounts Art. 6(1)(f) GDPR.

We store your workspaces and the hashtags you save, together with the topic or text you entered, until you delete them or your account. To generate hashtags we send the topic you type, the number of hashtags requested and the target language to OpenAI, L.L.C. (USA), which processes them on our behalf using the gpt-4o-mini model. No account identifier, email address or device identifier is attached to that request, so OpenAI cannot link it to you through us. Please do not enter personal data in the topic field. This transfer goes to the United States, a third country within the meaning of the GDPR. Legal basis: Art. 6(1)(b) GDPR.

Website: For each page view the website sends the page address reduced to its route (without parameters and without IDs, e.g. /dashboard/workspaces/[id]/list), the time and the platform. From the IP address, the user agent and a salt that changes daily, the server derives a pseudonymous identifier; it cannot be linked across days and is not connected to your account. No cookies are set and nothing is stored in your browser for this. If your browser sends “Do Not Track”, no page views are recorded. Apps: When the app starts, it sends an event with a random analytics identifier of the installation (stored only as a salted hash), the app version and, if you are signed in, the identifier of your account. App events are therefore linked to your account. We evaluate these data only in aggregated form (e.g. visits per day, countries) to improve stability and the service; we do not create user profiles. Analytics events are deleted after 13 months; when you delete your account, the link to your account is removed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reach measurement and stable operation).

To determine the country of an analytics event, the server sends the IP address of the request to the service geoips.info (api.geoips.info), which returns the country. Only the two-letter country code is stored. The IP address is not stored; it is only kept in the server’s memory for up to 24 hours so that the same address is not looked up repeatedly. Legal basis: Art. 6(1)(f) GDPR.

Subscriptions are purchased, paid for and cancelled exclusively via Apple’s App Store or Google Play; we do not receive any payment details. To activate your access, we receive and store the store’s transaction data (transaction identifiers, product, purchase and expiry dates, country or currency and price) and its status notifications (e.g. renewal, cancellation, refund). These payment and subscription events are retained for the duration of the statutory retention obligations under tax law. When you delete your account, the link to your account is removed; the store’s transaction identifiers remain. Legal basis: Art. 6(1)(b) GDPR and, for retention, Art. 6(1)(c) GDPR (legal obligation). When using the Hashtagmixer mobile applications, additional data processing is carried out by Apple Inc. and Google LLC. This includes billing, diagnostics, crash reports and usage statistics processed independently by the app store providers. Apple Privacy Policy: https://www.apple.com/privacy/ Google Privacy Policy: https://policies.google.com/privacy

If you contact us via the support form in the app, we store the subject, message, the contact email you provide, platform, app version and the link to your account in order to handle your request. Completed requests are deleted 2 years after completion. When you delete your account, your details are removed from all requests. Legal basis: Art. 6(1)(b) and (f) GDPR.

For operation and security, the server logs requests with time, method, path, status code and a shortened IP address. Application logs are deleted after 14 days, error logs and the internal error overview after 30 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

You can delete your account in the app or request deletion by email to it@sareba.net. This deletes your account, sessions, workspaces, hashtags and sign-in codes, removes your details from support requests and separates analytics and payment events from your account. You have to cancel an active subscription yourself in the App Store or on Google Play. Retention periods at a glance: - Sign-in codes: 24 hours - Sessions: signed-out ones 7 days, all others 90 days after expiry - Server logs: 14 days (application), 30 days (errors) - Analytics events: 13 months - Completed support requests: 2 years - Log of administrative actions: 2 years - Account, workspaces and hashtags: until the account is deleted - Payment and subscription events: for the statutory retention period

Hashtagmixer does not use automated decision-making or profiling with legal effect.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). To exercise these rights, write to it@sareba.net. You also have the right to lodge a complaint with a data protection supervisory authority. In Austria this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, https://www.dsb.gv.at.

For any data protection inquiries: it@sareba.net