Last updated: October 2026. This is a translation. In case of differences, the German version applies.
Controller
Sascha Göbbels
Lorenz-Schott-Straße 5
55252 Mainz-Kastel, Germany
Email: info@sagosys.com
This website
The site is purely informational. It sets no cookies, uses no analytics or advertising services and loads no fonts or scripts from third-party servers. There is no form. If you write to me, I process your email address and the content of your message only to reply (Art. 6(1)(f) GDPR).
Donation link: A link in the page footer leads to PayPal. Only when you click it does PayPal open and process your data under its own privacy policy. Merely visiting the page sends no data to PayPal.
Hosting: The site is delivered by Netlify (Netlify, Inc., USA). When you visit, the provider processes technically necessary data such as IP address, time and requested page in server logs to deliver the site securely (Art. 6(1)(f) GDPR). Netlify decides how long it keeps these logs. A data processing agreement (Art. 28 GDPR) exists with Netlify. Transfers to the USA rely on Netlify’s certification under the EU-US Data Privacy Framework and, additionally, on standard contractual clauses.
Forwarding of info@sagosys.com: The ImprovMX service forwards incoming mail to a private mailbox. In doing so it processes the sender, recipient and content of the message, and may do so on servers outside the EU, for example in the USA. The legal basis is my legitimate interest in being reachable by email (Art. 6(1)(f) GDPR). If you prefer not to use this, write by post to the address in the legal notice.
The SAGOSYS program
What is stored
- Locally on your PC, without an account: all shortcuts, text blocks, date formats, window entries and settings. This data does not leave your PC.
- On my server, only if you create an account: your email address, a hash of your password (the server never sees the password itself), your signed-in devices (device name, time) and, if you sync, your synced entries.
- Always, even without an account: The program asks the server for updates and feature limits at start and about every 6 hours afterwards. The server sees your IP address. No usage data, text contents or identifiers are transmitted.
Good to know
- Plain text: Synced shortcuts and texts are stored unencrypted on the server, except text blocks you protect with “Encrypted”. The server only sees those in encrypted form; only your master password knows the key.
- No credentials in plain text: Write passwords only in encrypted text blocks.
- “Secret”: Text blocks with the “Secret” switch stay on the device and are never sent.
- Program launches: A program launch arriving via sync only runs after you have confirmed it on that PC.
- No advertising, no tracking, no cookies, no analytics services in the program.
How long I keep data
- Sign-in requests (email address, code hash): until they expire after 30 minutes, deleted at the latest one hour later.
- Sessions (signed-in devices): 90 days, immediately on sign-out.
- Account and synced entries: until you delete the account (in the app under Account → “Delete account”, with your password). Account, devices and all synced data are then deleted from the server. Deletion markers are removed for good after 90 days.
- Server backups: daily copy of the database, kept for 14 days, plus a copy on the operator’s private PC (60 days). A deleted account therefore also disappears from the backups after 60 days at the latest.
- Server logs: time, requested address, IP address and response. Deleted after 30 days at the latest. Purpose: security and troubleshooting.
Legal bases
Account, sign-in, sync and updates: performance of a contract (Art. 6(1)(b) GDPR). Server logs, abuse protection and backups: legitimate interest in security and operation (Art. 6(1)(f) GDPR).
Service providers
- Server: Oracle Cloud, Frankfurt region (Germany). A data processing agreement (Art. 28 GDPR) exists with Oracle. Access from Oracle locations outside the EU, for example for support or security operations, is not excluded by the agreement. Standard contractual clauses apply to this.
- Email delivery: Brevo (based in the EU). Only your email address and the content of the sign-in email go there. A data processing agreement (Art. 28 GDPR) exists with Brevo.
- Donations: The donate button in the app opens PayPal in the browser. The payment is solely between you and PayPal; PayPal’s privacy policy applies. I receive no payment data from you, other than what PayPal tells me as the recipient.
Security
Connections are encrypted (HTTPS). Updates are digitally signed and verified before installation. The server is hardened: key-only login, automatic security updates, rate limiting.
Your rights
You can request access, rectification, erasure, restriction, data portability and object at any time. Write to info@sagosys.com. You can create an export of your data yourself in the app (backup). You can also lodge a complaint with a data protection authority; for Hesse, that is the Hessian Commissioner for Data Protection and Freedom of Information.