Privacy notice

This notice explains which personal data editr processes, why, and for how long. It applies to the website, the web editor and the iPad app.

Who is responsible

The controller within the meaning of the GDPR is:

Which data we process and why

• Account: your email address, your password (stored only as a hash by our sign-in service) and, if you switch two-factor sign-in on, its secret. Purpose: sign-in and account recovery. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR).
• Content: the photos you upload, their thumbnails, project names, edit settings and presets. Purpose: providing the editor. Legal basis: Art. 6 (1) (b) GDPR. On upload we remove embedded metadata such as location and camera data from the stored copy.
• Support: the email address and message you send through the support form. Purpose: answering you. Legal basis: Art. 6 (1) (b) or (f) GDPR.
• Technical logs: time, requested address, IP address and a pseudonymous account id for security-relevant actions (sign-in, creating, changing and deleting data). Purpose: operating and securing the service. Legal basis: legitimate interest (Art. 6 (1) (f) GDPR).
• Cookies: only strictly necessary ones — your sign-in session, a form security token and your language choice. No consent is required for these.

How long we keep data

• Account and content: until you delete them or your account.
• Uploads that were not completed: 24 hours.
• Support requests that were not confirmed: 24 hours. Confirmed requests are forwarded to our mailbox and kept there as long as needed to handle them.
• Technical logs: up to 12 months. Rate-limit counters (stored only as a hash): up to 2 hours.

Who receives data

We use Amazon Web Services EMEA SARL as processor: storage and computing in the EU (Frankfurt), delivery through the CloudFront network, protection by AWS WAF, sign-in through Amazon Cognito and email through Amazon SES. We do not share data with anyone else.

Security monitoring

To protect our systems against attacks and misuse, we analyse server, firewall and application logs (including IP address, time, requested address, browser identifier and error messages) in a security monitoring system. It runs on servers of Hetzner Online GmbH in Germany. The legal basis is our legitimate interest in IT security (Art. 6(1)(f) GDPR, Recital 49). The data is deleted after 90 days unless it is needed to investigate a security incident.

Tracking

editr does not track you. There are no analytics, no advertising identifiers, no third-party scripts or fonts, and no data is shared with data brokers.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a data protection authority.

• Erasure: in the editor open Profile → Delete profile. This deletes your account, all photos, projects and presets immediately.
• Access and export: in the editor open Profile → Export my data.
• For everything else, or if you cannot sign in, use the support form.

Provider details are in the Imprint.

Last updated: 2026-10-15