Privacy Policy
Effective date: 26 October 2026
This policy explains what personal data Opozor collects, why, how long we keep it, and what rights you have. We collect as little as we can. We do not sell data, and we do not use advertising, analytics or tracking.
Who we are
The controller of your personal data is Šori rešitve, Daniel Arthur Hawton, s.p., Slovenska cesta 56, 1000 Ljubljana, Slovenia, registration number 7543727000, tax number 28722795. E-mail: support@opozor.app.
We are a one-person business. We have not appointed a data protection officer, because the law does not require one for a business of our size and type.
What we collect, and why
Your account
Your e-mail address (it is also your login name), your password (stored only as a bcrypt hash, which cannot be turned back into the password), whether you confirmed the address, your plan, your settings, and how many messages you sent today.
Why: to run your account, log you in, apply your plan's limits, and send you mail about your account (address confirmation, password reset). Legal basis: performance of a contract (GDPR Article 6(1)(b)).
Topics, keys and messages
Your topics and who may use them, and your keys (stored only as a hash; we show a key once, when you make it). The messages you publish: title, text, tags, links, attachments links, priority and time, and the IP address that published them. Subscribers never see that IP address.
Messages are deleted automatically when your plan's time is over (for example after 7 days on the Free plan). When you delete a topic or your account, its messages are deleted at once.
Why: to deliver your messages to your subscribers, and to find and stop abuse. Legal basis: performance of a contract (Article 6(1)(b)); for the publishing IP address, our legitimate interest in stopping abuse (Article 6(1)(f)).
What you put in a message is up to you. Do not put personal or secret data in a public topic: anyone can read it. If your messages contain other people's personal data, you are responsible for that data, and we process it for you.
Payments and invoices
If you buy a paid plan, you pay on a page of our payment provider, Stripe. Stripe gets your card details, your name, your billing address and, if you give one, your tax number. We never see your card details.
From Stripe we get and store your Stripe customer number, your plan, its status and the date it is paid until. For each payment, we make an invoice in our own accounting system, on our own servers: your name or company name, billing address, tax number if given, e-mail address, the plan, the amount and the date.
Why: to take payments and to make invoices. Legal basis: performance of a contract (Article 6(1)(b)), and our legal duty to keep invoices (Article 6(1)(c); Slovenian tax and accounting law).
Limits against abuse
To stop floods of requests, each server counts requests per IP address. These counts are kept only in the server's memory, for minutes, and are never stored. Legal basis: our legitimate interest in keeping the service running (Article 6(1)(f)).
Server logs
Our servers write technical logs: errors and important events, which can include an IP address or an account number. We do not log every request. The logs are not collected in one place; they are overwritten after a short time (normally within days), and removed when a server is replaced. Legal basis: our legitimate interest in finding faults and stopping attacks (Article 6(1)(f)).
When you contact us
If you e-mail us, we use your address and your message to answer you. Legal basis: our legitimate interest in answering you (Article 6(1)(f)), or the contract (Article 6(1)(b)) if it is about your account.
Storage on your device
We use no cookies. The web app keeps these in your browser's storage:
| What | Why | How long |
|---|---|---|
| Login key and your e-mail address | Keeps you logged in | Until you log out (the key itself ends if it is not used) |
| Messages of your topics, and muted topics | Shows your messages quickly, also offline | Until you log out or clear them |
| Theme (light or dark) | Remembers your choice | Until you clear it |
This storage is needed for the service you ask for, so we do not ask for consent.
Where we store your data
| Data | Where | Provider |
|---|---|---|
| Accounts, topics, keys, messages, payment status, invoices | Our database servers in Nuremberg and Falkenstein, Germany | Hetzner |
| Database backups (encrypted) | Cloudflare R2 storage, limited to data centers in the EU | Cloudflare |
| E-mail we send and receive | Our mail server in Germany | Hetzner |
| Card details, billing details for payments | Stripe | Stripe |
Who we share data with
We do not sell or rent personal data. We share it only with these providers, and only as far as they need it:
- Hetzner Online GmbH (Germany) runs our servers, databases and mail.
- Cloudflare, Inc. (USA) runs our domain names (DNS) and stores our encrypted backups, in the EU only. Your requests go straight to our servers, not through Cloudflare.
- Stripe Payments Europe, Limited (Ireland) handles payments. Stripe is also responsible for its own processing, for example to prevent fraud and to meet its legal duties, under the Stripe Privacy Policy.
Today, apps receive messages over a direct connection to our servers. If we start to deliver messages through Google's or Apple's push services, we update this policy before we do.
We may give data to authorities when the law requires it.
Transfers outside the EU
Cloudflare and Stripe are part of groups based in the USA, and Stripe may process data there. Such transfers are protected by the EU-U.S. Data Privacy Framework (where the company is certified) or by the European Commission's standard contractual clauses (GDPR Articles 45 and 46).
How long we keep data
| Data | How long |
|---|---|
| Account, topics and keys | Until you delete them or your account |
| Messages | As long as your plan says (for example 7 days on Free), or until you delete the topic |
| Payment status | Until you delete your account |
| Invoices | 10 years after the year of the invoice, as Slovenian law requires, also after you delete your account |
| Server logs | A short time, normally days |
| Database backups | Up to 3 years. Deleted data leaves the backups when they expire |
| E-mails with us | As long as we need them for your question, then up to 2 years |
Your rights
Under the GDPR you have the right to access your data and get a copy, to correct it, to delete it, to restrict how we use it, to get it in a machine-readable format, to object to processing that we base on our legitimate interest, and to complain to a supervisory authority.
You can see and delete most of your data yourself in the web app. For everything else, e-mail support@opozor.app from your account's address. We answer within one month. Using your rights is free.
The supervisory authority in Slovenia is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si. You can also complain to the authority in the EU country where you live or work.
We do not make decisions about you based only on automated processing that have legal or similarly important effects (GDPR Article 22).
Children
Opozor is not for children under 16. We do not knowingly collect personal data from them. If you think a child under 16 has an account, contact us and we delete it.
Security
We use encrypted connections (HTTPS), hashed passwords and keys, encrypted backups, and restricted server access. No system is perfectly secure. If a data breach is likely to put your rights at risk, we tell you and the supervisory authority as the law requires.
Changes to this policy
When we change this policy, we update the effective date at the top. If a change is important, we tell you by e-mail before it takes effect.