Privacy policy

Last updated: September 15, 2026

Who is responsible?

Alexander Zotz, trading as PWA InstallKit, Am Hang 4, 86570 Inchenhofen, Germany, is responsible for our processing of personal data. Contact support@pwainstallkit.com for privacy questions or requests.

Data we use and why

We use account identifiers, email addresses and authentication information to provide and secure your account. Google or Apple sign-in supplies the profile information you authorize; passkey authentication uses a public credential, while the private key and any device biometric remain with your device or credential provider.

We process submitted public app URLs, names, icons, colors, generated images and project identifiers to create your guide. Do not submit private information or URLs containing credentials. We keep payment references, purchase status and consumed-slot records to deliver purchases, prevent reuse and handle refunds. Payment details are collected by the checkout provider; our application does not receive full card details.

We also process support correspondence and technical security information. Under the GDPR, our grounds are performance of a contract or requested pre-contractual steps, legal obligations where applicable, and legitimate interests in operating, securing and improving the service. Where consent is required, you may withdraw it for future processing.

Service providers

Supabase provides authentication, database and private file storage; Vercel hosts the application; Cloudflare provides DNS and support-email forwarding; Resend sends account emails. Forwarded support mail is received in our Google-hosted inbox. Stripe/Link handles checkout, payment-related fraud prevention and tax administration under the terms and privacy information shown in checkout. Google and Apple also process social sign-in under their own policies.

Sentry receives limited error diagnostics to help us fix failures. Our application excludes customer content, arbitrary error messages, account identifiers, request bodies, cookies and breadcrumbs from error events; session recording is disabled. Vercel Web Analytics measures visits and purchase-button clicks on our marketing and information pages without analytics cookies. Click events contain only an approved page path and button position. We exclude account, authentication and guide routes and remove URL query strings. We do not use advertising trackers or sell personal information for targeted advertising.

We also compile internal service totals for confirmed accounts, checkout sessions, payments and completed guides. Minimal record references prevent duplicate counting. These records remain in our database and are not sent to Vercel Analytics. We do not link marketing visits to individual purchases.

Cookies and browser storage

Authentication cookies and necessary browser storage maintain your session and protect access. Analytics collection respects the browser’s Do Not Track and Global Privacy Control signals. Social-login and checkout providers have their own browser-storage practices on their services.

Retention

Guides can be accessed for 30 days from creation. Scheduled cleanup then removes generated files and stored branding. Minimal purchase and consumed-slot records remain so that expiry cannot be used to obtain another guide without payment. Account information remains while your account is active and as necessary to meet legal obligations, resolve disputes or prevent fraud. Contact us to request account deletion; statutory financial records may need to be retained separately. Support and diagnostic records are kept only as needed for their purpose, subject to provider retention settings and legal requirements.

Transfers and your rights

Our database region is Frankfurt and our Sentry project uses an EU ingest endpoint. Providers may also process data in other countries, including the United States. Where required, transfers must rely on an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses. Contact us for information about the safeguards applicable to your data.

Depending on applicable law, you may request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent. EU/EEA residents may complain to their data-protection supervisory authority. Applicable US state privacy rights, including any available appeal and non-discrimination rights, remain available. We may need to verify your request without collecting more information than necessary.

The service is intended for people legally able to purchase it and is not directed at children. Material changes to this policy will be reflected here with an updated date and additional notice when required.