Slasht

Privacy notice

1. Controller and scope

The controller for the processing described below is:

Christian Grandek, Im Vechtel 46, 33428 Harsewinkel, Germany

Email: slasht.support@gmail.com

This notice applies to the Slasht app, the website slasht.app and public Slasht shares.

Without an account, your saved links are stored only on your device. Requests for link information and images (section 4) also take place without an account.

An account is optional. To set it up and use it, we process your email address, account ID, the selected app language, and sign-in and session data. When you sign in with a password, it is transmitted to Supabase and stored there only as a hash. Session data on your device keeps you signed in. For each sign-in on a device, Supabase also stores the most recently used IP address and the identifier of the app or browser (user agent). This information is part of the sign-in session and remains stored until the account is deleted, including after you sign out on the device. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: secure operation of sign-in). Account emails containing confirmation codes are sent via Supabase and Resend.

Before an account is created, you sign in with a password or an account email is requested, Cloudflare Turnstile checks whether the request comes from a human. For this, the app loads a check script from Cloudflare while a screen with sign-in or a password prompt is open. Cloudflare processes your IP address and information about your device, browser and connection; Slasht only receives the result of the check. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: protection against mass sending of emails to third-party addresses and against automated sign-in attempts); access to your device is strictly necessary for this (section 25(2), point 2 of Germany’s TDDDG).

If you sign in with Google, Google Ireland Limited transmits, at your request, your Google ID, your email address and its verification status, as well as your profile name and profile picture, to Supabase. Slasht does not request any other Google data and gains no access to your Google account.

With an account, the following data is synced:

For new links, Slasht also stores whether they were saved directly, imported or copied from a Slasht share, so that imported older links are not treated like newly saved ones. This information is synced with the link and deleted with it.

For your own photos in JPEG or PNG format, the app removes metadata such as location data, capture time and camera data before upload. What is visible in the image itself remains unchanged.

The legal basis is Art. 6(1)(b) GDPR (providing the requested account and sync). Without an email address and sign-in data, no account can be provided. Connections between the app, the website and the servers are encrypted (HTTPS), and Supabase stores the data encrypted. The database only lets each account access its own data. The data is not end-to-end encrypted. For service providers, see section 8.

3. Local features and usage data

Settings and app states are stored on your device. When you paste from the clipboard, import (for example a WhatsApp chat export) or share to Slasht, the text is searched for links only on your device. Only the links found are kept; the rest of the text is not saved and is not transmitted to Slasht or its cloud service providers. A selected import file may temporarily remain in the local cache.

When you open a link or its detail view, Slasht stores the time. It is synced with your account and used by Rediscover and filters so that you are shown links you have not looked at for a while.

Reminders about your collection are scheduled locally on the device by the operating system. So that a reminder arrives at a suitable time of day, on iOS and Android the app counts at each launch whether it is opened in the morning, at midday or in the evening. These three counters stay on your device and are never transmitted. Counting only takes place while reminders are switched on; switching them off resets the counters to zero.

With an account, the app also tells the server when its reminders are scheduled, as well as the time zone and the time-of-day window derived from the counters (for example “evening”). This keeps the number of notifications low across all your devices, together with price notifications (section 4).

The legal basis for the features in this section is Art. 6(1)(b) GDPR; for the time-of-day count, it is Art. 6(1)(f) GDPR, the legitimate interest being not to deliver reminders at inconvenient times. Storage on the device is strictly necessary for these features (section 25(2), point 2 of Germany’s TDDDG).

With an account, Slasht additionally analyses the data that is synced anyway in aggregate form, for example how many saved links are opened again later or how often the automatic recognition finds no type. Only totals across all accounts are produced, no results for individual accounts or links. Your device is not accessed for this. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is improving the app based on how it is actually used. You can object to this analysis at any time, under Settings → Data & Storage or as described in section 10; your account is then no longer included.

Count usage (only with your consent). Under Settings → Data & Storage, you can voluntarily turn on “Count usage”; it is off by default. When it is on, the app creates a random identifier for this installation and stores on the device on which day after the first start it reached certain steps for the first time: finishing the introduction, saving the first link (and by which route: sharing, plus, import or a shared collection), the first card fully recognised, five links saved, a saved link opened again later, the first Rediscover round started and a card decided in it, a reminder tapped, the limit of 15 links without an account reached, and an account created. Steps already reached before you turned it on are read once from the data already on the device. At most once a day, it sends to Slasht: the identifier, these steps, the days after the first start on which the app was opened during the first five weeks, the number of your links as a rough range (such as “5–14”), the app version and the operating system (without its version). Titles, addresses, content and identifiers of the account or the device are not sent. The purpose is to see where people stop using the app and to improve it there. The legal basis is your consent (section 25(1) of Germany’s TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time by turning the switch off: the data on the device is deleted immediately, and the data in the database as soon as an internet connection is available. Withdrawing consent does not affect the lawfulness of processing carried out before.

For newly given consent, “Count usage” also covers weekly counters: saves by saving route and outcome (including duplicates, errors and account limits), saving days, the time until the card is ready in rough steps, card views and opening the original page, search and filters including results, Rediscover, account offers and sign-in, reminders and price alerts, collection suggestions and corrected link types. It also covers the months in which you use Slasht and reopen older links. Only counts are transmitted, no search terms, link addresses, titles or content. Earlier consent is not automatically extended; otherwise, the same rules on identifiers, withdrawal and deletion apply.

With this consent, the app also counts on the device when a screen crashes, data on the device cannot be read or saved, a sync with the cloud is aborted or a shared item cannot be taken over as a link. It also counts how long the first fetch of a saved page takes (in rough steps) and whether it runs into the time limit or is rejected by the page, separately for Wi-Fi and mobile data. At most once a day, it sends these error counts to Slasht without the installation identifier, together with the app version, the version of the operating system and the fact that this app version was used on that day. Error messages, content, links, addresses and identifiers of the device or the account are not sent. In the database (Supabase, Ireland region), the counts are added up per app version and day; the individual report is not kept. The purpose is to detect and fix errors and delays in a new app version. When you withdraw consent, the counts on the device are deleted; totals already sent cannot be linked to an installation and are deleted after the period in section 9.

Reason for deleting (optional). When deleting your account or all data, you can choose a reason and optionally add a short text. Only if you choose something does the app send, after the deletion, the reason, the text, the app version and the operating system to Slasht – without a session and without any link to your account. Please do not write personal details into the text. The legal basis is your consent given by providing this voluntary answer (Art. 6(1)(a) GDPR).

Age checks through the store

Slasht is for people aged 16 and over. Where a store provides age information and it is required, the app requests an age range and the status of parental approval from Apple or Google; on Android, it decides whether to ask based on the region of the device language and the time zone. An age range below 16, mandatory parental supervision or missing parental approval restrict app access. The response is evaluated only in memory and is not transmitted to Slasht; no date of birth or identity document is requested. Only the restriction, its reason and the time at which sharing was declined remain on the device, until you remove the app data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: complying with age rules and the minimum age); storage on the device is strictly necessary for this (section 25(2), point 2 of Germany’s TDDDG). Apple and Google process their store data as independent controllers.

4. Link information and external content

So that a saved card shows a title, image and further details, the app requests the destination page and, where applicable, the preview services of the respective platform (for example YouTube, TikTok or Spotify). Images and logos are loaded directly from the websites’ servers. These servers receive your IP address, the requested address and technical connection data. The example cards shown on first launch also load their images from the original sites.

If a page only provides its details via JavaScript, on iOS and Android the app loads it in an invisible browser view. This view is separate from your usual browser, keeps no cookies or data after the request and has no access to the camera, microphone, location or files. The page’s scripts may trigger further requests to embedded services.

The legal basis for requests relating to links you save or open is Art. 6(1)(b) GDPR; without them, the requested preview cannot be created. For the images of the example cards, it is Art. 6(1)(f) GDPR, the legitimate interest being to show how the app works on first launch.

Price watching (with an account). For recently saved product links, Slasht’s server checks at most once a day whether the price has changed. To do so, the server requests the product page; the shop receives the server’s address, not your IP address. The link’s address and saved price, the result of the check, confirmed price changes and whether you have seen them are processed. The app shows confirmed changes when you open it.

Product pages the server cannot read, and selected further product and property links in your collection, are checked by the app on your device, only while it is open and the device is connected to Wi-Fi. The request works as when you save a link, if necessary in the invisible browser view; the page provider receives your IP address. Prices and price history are synced as part of your link data. Comparison values and unconfirmed prices stay on the device and are removed when you delete all app data or your account on that device. A price drop found by the device itself is announced with a local notification; no data is sent to push services for this.

If a price drops, Slasht may send a notification, provided you have allowed notifications. For this, the app registers its device with the server: with a random device identifier, a push token, whether notifications are switched on, language, time zone and time-of-day window. Notifications are delivered directly via Firebase Cloud Messaging (Google, Android) or the Apple Push Notification service (iOS). These services receive the push token, delivery information and the text of the notification, including the product name and prices, as well as random identifiers of the account and the link, which the app uses to recognise which account and which link the notification belongs to. When you sign out, the app unregisters the device.

Price watching is part of the account and has no separate switch. Notifications can be switched off under Settings → Notifications; the app then continues to show price changes when you open it. The legal basis is Art. 6(1)(b) GDPR (the feature is part of the account); notifications additionally require your permission in the operating system.

When you open a link, it is shown in the browser within the app or in your usual browser, depending on your settings. You then visit the external website yourself; its cookies and privacy choices are not governed by Slasht’s privacy notice.

The privacy notices of the operators of external websites apply to their own processing. Slasht itself uses no advertising, no tracking services, no newsletter and no external error reporting service; which counts Slasht collects about errors and usage is described in section 3. Because Slasht does not track you across other websites, a “Do Not Track” signal from your browser does not change how data is processed.

5. Protection against abuse

So that nobody can slow down the database for everyone through mass requests, limits apply to write operations, photos and shares per account and to requests for individual shares. For this purpose, the server stores a few counters with timestamps per account or share, but no list of requests and no IP addresses. The counters are deleted together with the account or share. The legal basis is Art. 6(1)(f) GDPR, the legitimate interest being a secure service that is available to everyone.

6. Public shares

A share makes the title, original address, description, preview image and site name of the shared links available via a share link. For collections, the collection name and number of entries are added. Notes, your own photos and account data are never published. However, titles or addresses may themselves contain personal information.

Anyone with the share link can access and forward the content. Links added later to a shared collection also become visible after sync.

The legal basis for sharing is Art. 6(1)(b) GDPR; for access by visitors, it is Art. 6(1)(f) GDPR, the legitimate interest being to deliver the page the visitor requested.

When a share is accessed, the website host Netlify (section 7) receives connection data, the share link and the browser’s language setting. The server requests the share from Supabase; the visitor’s browser loads preview images from the original sites. When a share is opened in the app, the device requests it directly from Supabase, even without signing in.

After you stop a share or delete the link or collection, it is no longer available via Slasht once your device has synced. Slasht cannot recall copies that recipients have already made.

Sender identifier and blocking: Every share contains a random identifier for the sender. It is not the account identifier and only shows that several shares come from the same account. If you choose “Block sender”, this identifier is stored only on your device so that the app hides shares from this sender. The list is not transmitted and is deleted with the local app data. If an account is blocked from sharing, Slasht stores the block and its reason until it is lifted or the account is deleted. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is protecting recipients from prohibited content.

Reports: Unlawful content can be reported via “Report content” on every share or by email. The email draft includes the share address and, where available, the random sender identifier. This allows Slasht to identify the sender after the share has ended, until the account is deleted. The information in the report, the reporting person’s email address and the correspondence are processed in order to review and answer the report (Art. 6(1)(c) GDPR in conjunction with Articles 16 and 17 of Regulation (EU) 2022/2065, otherwise Art. 6(1)(f) GDPR).

7. Website and contact

When you visit the website, connection data needed to deliver it is processed, particularly your IP address, the requested address, time and technical browser information. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is secure delivery of the website you requested.

The website and the share pages are delivered by Netlify, Inc. (USA) as a processor. Netlify uses sub-processors for this, including in the USA, and delivers the pages through a worldwide server network; a request may therefore also be processed outside the EU. Transfers to the USA are based on the EU-US Data Privacy Framework, under which Netlify states that it is certified; alternatively, the EU Standard Contractual Clauses (Module 2) in Netlify’s Data Processing Agreement apply.

If you write to Slasht, your email address, your message and any attachments you choose to send are processed to handle your request. The “Report a problem” feature in the app suggests the app version and operating system for the message; only what you send yourself via your email app is transmitted.

Contact form: The form on the support page processes your email address, your message, the language of the page and the technical connection data of the submission (including your IP address). The form is received and stored by Netlify, Inc. (USA) as a processor. Netlify checks each message for spam automatically and then forwards it by email to the support mailbox; Netlify uses sub-processors in the USA for this. The legal bases are the same as for an email (next paragraph); for the spam check it is Art. 6(1)(f) GDPR, the legitimate interest being to protect the support mailbox from bulk messages.

The legal basis for requests about your account or the app is Art. 6(1)(b) GDPR; for other requests, it is Art. 6(1)(f) GDPR (legitimate interest: answering your request); for privacy requests, it is Art. 6(1)(c) GDPR in conjunction with Articles 12 to 22 GDPR.

The support mailbox is a Gmail account. It is provided by Google Ireland Limited, which processes message and connection data under its own privacy policy (Google privacy policy). Please do not send passwords or sign-in codes.

8. Recipients and transfers to third countries

Service Processing
Supabase Pte. Ltd. Sign-in, database, your own photos, shares and price watching, as a processor. The data is stored in the Ireland region (EU). Supabase uses sub-processors, including in the USA. Sub-processors.
Resend (Plus Five Five, Inc.) Recipient address, content and delivery information of account emails, as a processor. Sending via the Ireland region (EU), storage in the USA according to the provider; open and click tracking is switched off. Sub-processors.
Cloudflare, Inc. Security check before account emails and password sign-ins (section 2), as a processor; as an independent controller for improving its own bot detection. Cloudflare is certified under the EU-U.S. Data Privacy Framework. Turnstile privacy.
Google Ireland Limited Google sign-in, if you choose it (section 2), and the support mailbox (section 7), in each case as an independent controller.
Netlify, Inc. (USA) Delivery of the website and share pages as well as receiving, spam checking and forwarding of messages from the contact form (section 7), as a processor, with sub-processors including in the USA. According to Netlify, it is certified under the EU-U.S. Data Privacy Framework.
Operators of external websites Requests relating to your links, preview images and logos, and the price-watching requests from the server and from your device (section 4), in each case as independent controllers.
Google (Firebase Cloud Messaging) Delivery of notifications on Android devices (section 4), as a processor under the Firebase Data Processing and Security Terms. Google LLC is certified under the EU-U.S. Data Privacy Framework; the EU Standard Contractual Clauses in these terms also apply.
Apple (Apple Push Notification service) Delivery of notifications on iPhones (section 4) under Apple’s terms. Data may be transferred to the USA in the process; the transfer is necessary to deliver the notifications you have allowed (Art. 49(1)(b) GDPR).
Recipients of public shares Anyone who opens a share link (section 6).

Some of these providers or their sub-processors process data outside the European Economic Area. For its US processing, Resend describes EU Standard Contractual Clauses in its Data Processing Addendum. Supabase Pte. Ltd. is based in Singapore; some of its sub-processors are based in the USA. There is no EU Commission adequacy decision for Singapore. These transfers are based on the EU Standard Contractual Clauses (Module 2), which form part of Supabase’s Data Processing Addendum. For Google sign-in and the support mailbox, Google Ireland Limited is an independent controller and governs transfers to Google LLC (USA) itself; Google LLC is certified under the EU-US Data Privacy Framework. For Netlify, see section 7. You may request information and a copy of the applicable safeguards at slasht.support@gmail.com.

9. Retention

Data Retention and deletion
Account and saved links Until you delete links, collections or the account. An account is not deleted because of inactivity.
Recently Deleted Recoverable for 30 days, then permanently deleted, in the cloud after 32 days at the latest. Your own photos in these entries are removed by the next sync in the app, at the latest when the account is deleted.
Deletion records After the content has been removed, the ID and timestamps remain so that other devices do not upload a deleted entry again. They contain no content and are deleted with the account.
Your own photos Until you remove the photo or delete the account. Photos no longer in use are cleaned up by the next sync in the app.
Shares Until you stop the share, delete the link or collection, or delete the account.
Counters against abuse Until the account or share is deleted.
Price watching Check status of a link until 14 days after saving; confirmed price changes until you delete the link; check attempts two days; scheduled notification times eight days; failures per shop until the next successful request, deleted after a seven-day pause in checks. Everything is deleted with the account at the latest.
Sign-in sessions IP address and identifier of the app or browser for each signed-in device until the account is deleted, including after signing out.
Device registration for notifications Until you sign out or until the app has not been opened for 30 days.
Data on your device Until you delete it in the app (“Delete all data”, deleting individual links) or remove the local app data. Signing out alone does not remove all local data.
Local settings Remain on the device after “Delete all data” or account deletion until the app data is removed or the app is uninstalled.
Support emails, contact form messages (in the mailbox and at Netlify), reports and deletion requests Until the matter has been dealt with, then no more than twelve months. Documents still needed for a specific legal dispute are retained until it ends and then deleted (Art. 6(1)(f) GDPR: establishing or defending legal claims).
Email and delivery log data at Resend 30 days; backups seven days.
Logs at Supabase Logs of requests (including IP addresses) one day.
Error counts and loading times Totals per app version and day; deleted after twelve months.
Count usage Until switched off or all app data is deleted in the app; in the database no later than 13 months after the last report.
Reason for deleting Two years.
Aggregate analyses Totals only, with no link to accounts; until no longer needed, at most two years.
Database backups Weekly backup of the database by the operator, without the files of your own photos; each backup is deleted after 30 days. Anything permanently deleted is therefore also removed from the backups no later than 37 days afterwards. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is being able to restore data after a technical failure.
Netlify logs (website) 90 days in accessible form, then archived for no longer than one year.

Details on account deletion: Delete account and data.

10. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

Right to object (Art. 21 GDPR): You may object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. The processing then ends unless compelling legitimate grounds prevail or it serves the establishment, exercise or defence of legal claims.

Please send requests to slasht.support@gmail.com. They are answered free of charge within one month at the latest. You may withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

You may lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, place of work or place of the alleged infringement. The authority responsible for Slasht is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW, Postfach 20 04 44, 40102 Düsseldorf, Germany).

No solely automated decision-making within the meaning of Art. 22 GDPR takes place. If the processing changes, this notice will be updated; the current version is available in the app and on slasht.app.

Last updated: 28 October 2026