Privacy policy · InsightsKit

In short

InsightsKit is a one-person business in Berlin, Germany. Our servers are in Germany.
This website uses Google Analytics only if you agree in the banner. If you decline, it sets no cookies and loads nothing from other companies. There are no ads.
We never sell personal data. We never use it for advertising, and we never use it to train AI.
If you use an app that uses InsightsKit, the developer of that app decides about your data. We only store it for them.
Developers can export all their data and delete their account themselves, at any time.

Who is responsible
Our two roles
When you visit this website
When you have a developer account
When you use an app that uses InsightsKit
Cookies and local storage
Who else receives data
Data outside the EU
How long we keep data
How we protect data
Your rights
Other information

1. Who is responsible

The controller (the person who decides why and how personal data is used) is:

Roman Koch, sole proprietor
Martin-Opitz-Str. 14
13357 Berlin
Germany

For all privacy questions, write to privacy@insightskit.co. You find more contact details in the legal notice.

We have not appointed a data protection officer. The law does not require one for a business of our size (§ 38 BDSG).

2. Our two roles

InsightsKit has two kinds of users, and our role is different for each.

Visitors of this website and developers with an account. For their data, we are the controller. This policy describes what we do with it.
End users: people who use an app that uses InsightsKit, and send a feature request or a support message from it. For their data, the developer of that app is the controller. We are a processor (a service provider who handles data only on the controller's instructions, Art. 28 GDPR). Section 5 describes what we store for the developer.

Developers who use InsightsKit for their users' data need a data processing agreement with us (Art. 28 GDPR). Write to privacy@insightskit.co, and we conclude one with you. It names our hosting provider, Alfahosting, as a sub-processor (see section 7).

3. When you visit this website

Server logs

When you open a page, your browser sends technical data to our web server. For each request, the server writes one line in a log file:

your IP address
the date and time
the page or file you asked for, the status code, and the amount of data sent
the page you came from (the referrer), if your browser sends it
your browser and operating system (the user agent)

We use this data to deliver the pages, to find errors and to protect the server against attacks. The legal basis is our legitimate interest in a website that works and is secure (Art. 6(1)(f) GDPR). We do not combine the logs with other data, and we do not build profiles from them.

The server starts a new log file every day and deletes the oldest one when there are more than 14. So log entries are normally deleted after about two weeks.

No cookies without your consent

Without your consent, this website sets no cookies and your browser contacts no other company: the font, the styles and the scripts all come from our own server. There is no advertising, no social media button and no embedded video or map.

Google Analytics (only with your consent)

On your first visit, a banner asks whether we may use Google Analytics. Nothing from Google loads before you choose. If you press Accept, we use it to count visits and to see which pages are read and how people reach them, so we can improve the website. We never use it for advertising: Google's advertising features are turned off.

Google Analytics then sets two cookies in your browser (see section 6) and sends Google information about your visit: the pages you open, when, how long, the page you came from, your browser, device type, screen size, language, and an approximate location (country and city). Google says that it uses the IP address of visitors from the EU only to find that approximate location, on servers in the EU, and then discards it without storing it.

The legal basis is your consent (§ 25(1) TDDDG and Art. 6(1)(a) GDPR). You can withdraw it at any time with Cookie settings at the bottom of every page; we then delete the Google Analytics cookies in your browser. Withdrawing does not make the earlier use unlawful. Google processes the data for us as our processor (Art. 28 GDPR), under the Google Ads Data Processing Terms. Google Analytics keeps the data for 2 months.

Your colour theme

If you press the Theme button, your browser saves your choice (light or dark) in its local storage, under the name themeMode. This stays on your device. It is never sent to us. You can delete it in your browser settings at any time.

Current prices

The pricing section asks our platform at app.insightskit.co for the current prices. Your browser connects to that server, which is also ours and runs in the same place. It sends no cookies with this request. The server log of the platform records it in the same way as described above.

When you contact us

The contact form does not send anything to us by itself. It opens your own email app with a message to support@insightskit.co. If you send that email, it arrives in our mailbox on our own mail server. No email company receives or stores it for us.

We use your email address and your message only to answer you. If your message is about an account, a purchase or a planned purchase, the legal basis is the contract or the steps before it (Art. 6(1)(b) GDPR). Otherwise it is our legitimate interest in answering the people who write to us (Art. 6(1)(f) GDPR). We delete your email when your matter is finished, unless tax or commercial law requires us to keep it longer.

Links to other websites

Some pages link to other websites. Your browser sends nothing to them until you click the link. After that, their own privacy policy applies.

4. When you have a developer account

This section is about the platform at app.insightskit.co, where developers sign up, add their apps and answer their users.

Your account

To create an account, you give us your email address and a password. We store the password only as a hash (bcrypt), so we cannot read it. We also store when you confirmed your email address.

We need this data to provide the service you signed up for (Art. 6(1)(b) GDPR). Without an email address and either a password or a Google account, we cannot create an account.

Sign in with Google (optional)

If you choose Sign in with Google, your browser goes to Google, and Google tells us your Google account ID, your email address, your name and the address of your profile photo. Our server downloads the photo once and stores a copy, so no page of the dashboard loads anything from Google. We show your name and photo only to you, in the top bar of the dashboard. We update them each time you sign in with Google. Google learns that you use InsightsKit. For Sign in with Google, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible, and Google's privacy policy applies. The legal basis for our part is the contract (Art. 6(1)(b) GDPR): you chose this way to sign in.

Signing in and activity

When you sign in, we set a cookie that keeps you signed in for up to 30 days (see section 6). We store when you last signed in, when you were last active, and on which days you used the dashboard. We use this to run the business: to see how many developers use InsightsKit, and when. The legal basis is our legitimate interest in understanding how our service is used (Art. 6(1)(f) GDPR). Only we see this data, and we never share it.

Your apps and your work

We store the apps you add (name, settings, API keys) and everything you do in the dashboard: status changes, replies to your users, blocks and your notification settings. This is the service itself (Art. 6(1)(b) GDPR).

Emails we send you

We send you only emails about your account: to confirm your email address, to reset your password, and to tell you that your password was changed. They come from our own mail server. We do not send newsletters or advertising.

Telegram alerts (optional, Pro and Lifetime)

If you connect a Telegram chat for support alerts, we store the chat's ID, its kind and its name (the person's Telegram name and username, or the group's title). We show you the name so you can confirm that the right chat pressed Start. An alert contains only the app's name, the words "new support conversation" or "new reply", and a link to the dashboard. It never contains anything an end user wrote, nor their email address or device details. A connect link that nobody confirms stops working after 10 minutes. The legal basis is the contract (Art. 6(1)(b) GDPR). Telegram itself is run by Telegram Messenger Inc., and Telegram's privacy policy applies to the messages in your chat.

Paid plans

We sell paid plans through Stripe Managed Payments. For these sales, Stripe's company Sold through Link, LLC is the merchant of record: it takes the payment and handles sales tax, and you see "Sold through Link" at checkout. You enter your name, address and card details directly on Stripe's checkout page. Stripe also uses payment data for its own purposes, for example to prevent fraud and to meet its legal duties. For that use, Stripe is responsible itself, and the Stripe privacy policy and the Link privacy policy apply.

From Stripe, we receive and store: your Stripe customer ID, your subscription's ID, status, price, amount, currency, billing period and end date, whether it will cancel at the end of the period, and the date of a Lifetime purchase. We also keep a history of the plans your account had, and since when. We never receive or store your card details. The legal basis is the contract (Art. 6(1)(b) GDPR) and, for billing records, our duties under tax and commercial law (Art. 6(1)(c) GDPR).

Feedback you send us

From the dashboard, you can send InsightsKit itself a feature request or a support message. For this, we are the controller. We store it in the same way as section 5 describes for every app, linked to your account so we know who wrote. We use it to improve InsightsKit and to answer you (Art. 6(1)(b) and (f) GDPR).

Export and deletion

On every plan, including Free, you can export all the data of your apps at any time. You can delete one app, or your whole account, yourself. When you delete your account, we delete at once all your apps and everything in them, your profile (including your name and photo from Google), your sign-in and activity records, your Telegram chats and your settings. At Stripe, we cancel every subscription and delete your Stripe customer, which removes the email, name, billing address and card stored there. Stripe keeps its invoices and payment records, because tax law requires it.

What stays after deletion names no one: an empty record that the account existed, the history of its plans, and the date of a Lifetime purchase, so that a sold Lifetime place stays sold.

5. When you use an app that uses InsightsKit

Many apps use InsightsKit to collect feature requests and support messages. If you send one, the developer of that app is responsible for your data, and their privacy policy applies. We store and process the data only for them and on their instructions. Please send requests about your data, for example to delete it, to the developer. If you write to us instead, we pass your request to the developer and help them answer it.

This is what we store for the developer:

Feature requests: the title and text you write, and your votes. Other users of the same app can see feature requests.
Support messages: the text you write, and screenshots or videos if you attach them. Only you and the developer can see them. Before we store a file, we remove its hidden metadata, for example the place where a photo was taken.
Contact details for support: your email address, if you give one, so the developer can answer you. On a support page (support.insightskit.co), you also give your name and a topic, and the email address is required.
Device details: the app's version and build, your operating system version, your device model and your language. They help the developer understand a problem.
An anonymous ID: a random number for your installation of the app. It lets you vote only once and see your own requests and conversations. It is not an advertising ID, it is different in every app, and it does not identify you as a person. The developer can also give us their own user ID for you.
IP address: a support page keeps your IP address in memory for one hour, to limit sending to 5 messages an hour. The application never writes it to its database. The server log records it as described in section 3.

We do not collect an advertising ID, your location, your contacts or anything about what you do in the app. We do not send you emails. You can delete your own support conversation yourself, in the app. A feature request you cannot delete yourself: please ask the developer.

We keep this data until you delete your support conversation, or the developer deletes it, the app or their account.

6. Cookies and local storage

Most of our cookies and storage are strictly necessary for something you asked for. For these, the law does not require your consent (§ 25(2) No. 2 TDDDG). The two Google Analytics cookies are the only exception: they are set only if you accept them in the banner (§ 25(1) TDDDG). We use no cookies for advertising.

Name	Where	What it does	How long
`themeMode` (local storage)	insightskit.co	Remembers the light or dark theme you chose	Until you delete it
`ik_consent` (local storage)	insightskit.co	Remembers whether you accepted or declined Google Analytics, so the banner does not ask again	Until you delete it
`_ga`	insightskit.co	Google Analytics, only with your consent: tells one visitor from another	Up to 2 years (some browsers keep it shorter), or until you withdraw consent
`_ga_CF133ZT6E9`	insightskit.co	Google Analytics, only with your consent: keeps the state of your visit	Up to 2 years (some browsers keep it shorter), or until you withdraw consent
`ik_session`	app.insightskit.co	Keeps you signed in	30 days, or until you sign out
`ik_google`	app.insightskit.co	Protects Sign in with Google against forged sign-ins	10 minutes, deleted after sign-in
`ik_plan`	app.insightskit.co	Remembers the plan you chose on this website while you sign up	1 hour
`ikw_…`	api.insightskit.co	In an app's web version: your anonymous ID for that app, so it can show your votes and conversations	400 days
`ikwv_…`	api.insightskit.co	In an app's web version: the app's version and build	400 days

7. Who else receives data

We keep the list short on purpose:

Alfahosting GmbH, Edmund-von-Lippmann-Straße 13-15, 06112 Halle (Saale), Germany. It runs the server for this website, the platform and our mail server, in Germany. It processes data only for us, as our processor, under Alfahosting's standard data processing agreement (Art. 28 GDPR).
Stripe, for payments, only if you buy a paid plan (see section 4).
Google, only if you choose Sign in with Google.
Telegram, only if you connect a Telegram chat for alerts.
Google Analytics, only if you accept it in the banner on this website (see section 3).

Nobody else. We use no other analytics service, no advertising network, no error tracking service, no content delivery network, no email service and no AI service. We do not sell or share personal information, also not in the sense of the California Consumer Privacy Act. We give data to authorities only when the law obliges us to.

8. Data outside the EU

We store all data on our server in Germany. Data leaves the EU only through the services in section 7, and only if you use them:

Stripe belongs to a group based in the USA. Stripe, LLC is certified under the EU-U.S. Data Privacy Framework, for which the EU Commission decided that the protection is adequate (Art. 45 GDPR). For other transfers, Stripe uses the safeguards described in its privacy policy.
Google (Sign in with Google, and Google Analytics if you accept it): Google LLC in the USA is certified under the EU-U.S. Data Privacy Framework.
Telegram: Telegram Messenger Inc. is registered in the British Virgin Islands. There is no EU adequacy decision for that country. Telegram says that it stores the data of users from the EU in data centres in the Netherlands. We send alerts to Telegram only because you ask for them (Art. 49(1)(b) GDPR).

9. How long we keep data

Data	How long
Server logs (IP address and request)	About 14 days
Google Analytics data (only with your consent)	2 months at Google; the cookies in your browser up to 2 years, or until you withdraw consent
Emails you send us	Until your matter is finished, unless the law requires us to keep them longer
Account, apps, settings, sign-in and activity records	Until you delete them or your account
Google name and photo	Replaced at each Google sign-in, deleted with your account
Telegram chat	Until you disconnect it, the chat stops or blocks the bot, or you delete your account
Billing records	Stripe IDs and subscription details: until you delete your account. Records that tax law requires us to keep, such as booking records: 8 years (§ 147 AO). Stripe keeps its own records under its own rules
End users' feature requests and votes	Until the developer deletes them, the app or the account
End users' support conversations, emails and attachments	Until the end user or the developer deletes them, or the developer deletes the app or the account. Attachments that were never sent: one day
IP address on a support page	One hour, in memory only

When data is deleted, it is deleted from our database at once. Files of a deleted app or account are removed within one hour.

10. How we protect data

All connections use encryption (TLS).
Passwords are stored only as a hash.
One developer can never see another developer's data, and one end user can never see another end user's support conversation. Our code checks this, and the database checks it a second time.
Screenshots and videos have no public links. Only the end user who sent them and the developer can open them.
Card details never reach our servers.

11. Your rights

Under the GDPR, you have the right to:

get a copy of the personal data we hold about you, and information about how we use it (Art. 15)
have wrong data corrected (Art. 16)
have your data deleted (Art. 17)
have its use restricted (Art. 18)
withdraw a consent at any time, with effect for the future (Art. 7(3)); for Google Analytics, use Cookie settings at the bottom of every page
receive your data in a common, machine-readable format, or have it sent to another provider (Art. 20)

Your right to object (Art. 21 GDPR)

Where we use your data because of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time, for reasons that come from your particular situation. We then stop, unless we can show compelling legitimate grounds that outweigh your interests, or we need the data to establish, exercise or defend legal claims.

To use any of these rights, write to privacy@insightskit.co. We answer within one month. If you are an end user of an app, please write to its developer first (see section 5).

You also have the right to complain to a data protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59-61, 10555 Berlin, Germany, datenschutz-berlin.de. You can also complain to the authority in the EU country where you live or work.

12. Other information

No automated decisions

We make no decisions about you that are based only on automated processing and that have legal or similarly significant effects (Art. 22 GDPR).

Children

InsightsKit accounts are for developers, not for children. We do not knowingly create accounts for people under 16.

Changes to this policy

We change this policy when our service changes. The date at the top shows the last change. If a change affects how we use the data of existing accounts, we tell account holders by email before it applies.