Juiceboxes

Privacy policy

Who is responsible

MZ Software LLC, 30 N Gould St # 45399, Sheridan, WY 82801, United States, runs Juiceboxes. Email: hi@martinzoeller.com

Your account

You sign in with Apple. We store the following in our database, on a server in the EU:

  • Apple's ID for your account.
  • Your name, if you share it at your first sign-in.
  • The email address Apple shares with us. This is your real one or a relay address from Apple.
  • A token from Apple, so we can revoke your sign-in with Apple when your account is deleted.

We need this data to create your account and sign you in (Art. 6(1)(b) GDPR). Without it, you can't use Juiceboxes. Only invited people can sign up: we compare the email address from Apple with our list of invitations. If it isn't on the list, we store nothing.

Cookies and browser storage

  • The cookie __Host-session keeps you signed in. Our database stores only a hash of its token. A session ends 30 days after its last use, and one year after sign-in at the latest.
  • The cookie __Host-apple-sign-in protects your sign-in with Apple. It is deleted when the sign-in finishes, or after 10 minutes at the latest.
  • If you pick light or dark mode, your browser saves that choice in its local storage. It stays on your device.

These are strictly necessary for the service you asked for, so they need no consent (§ 25(2) No. 2 TDDDG). We use no analytics, tracking, ads, third-party scripts or external fonts.

Server logs

For each request, our server logs only the method, the route, the status and how long it took, plus an error message when something fails. The logs contain no IP addresses and no query strings.

Who else gets your data

We sell no data. Besides us, only these receive it:

  • Hetzner Online GmbH, Germany, hosts our server and processes data only on our behalf.
  • Apple handles the sign-in under its own privacy policy. When your account is deleted, we ask Apple to revoke your sign-in.

International transfers

Juiceboxes is operated by a US company. Our server is hosted in the EU. Where personal data from the EEA, UK, or Switzerland is transferred outside those regions, we rely on appropriate safeguards such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep data

  • Your account data stays until your account is deleted. To delete your account, email us.
  • We back up the database every day, on the server and on our own computer, and delete each backup after 30 days. This lets us recover from data loss (Art. 6(1)(f) GDPR). Deleted data is gone from every backup within 30 days.

Your rights

You can ask for a copy of your data and have it corrected, deleted or restricted. You can get it in a machine-readable format and object to processing based on our legitimate interests, such as the backups (Art. 15 to 18, 20 and 21 GDPR). Email us to do this. You can also complain to a data protection authority (Art. 77 GDPR).