Privacy policy
Last updated: 16 October 2026. This policy applies to cropy.io and is based on the Swiss Federal Act on Data Protection (FADP).
Controller
Contency GmbH
Bahnhofstrasse 6
9050 Appenzell
Schweiz
- hello@cropy.io
What data we process
We only process data that is necessary to operate Cropy.
- Without an account
- The images are processed only in your browser and are not transmitted to us. Your browser stores settings such as favourites and language locally.
- Account
- Email address, name and company (optional), password (only as a hash, never in plain text) and, if you log in with Google, the identifier of your Google account
- Projects
- Original images, preview images, focus points, crops, formats and texts
- Subscription
- Customer number and subscription status at Stripe. You enter your name, billing address and payment details directly with Stripe. We do not receive card data.
- Support
- For support and troubleshooting, Cropy administrators can view your account, assign a plan and temporarily sign in with your account. Every such access is logged.
- Security
- Active sessions with time and browser, as well as failed login attempts, to prevent misuse
- Server logs
- IP address, time, requested file and browser, insofar as our hosting provider stores them
Purpose and legal basis
We process the data to provide Cropy, to save your projects, to send you emails about your account (e.g. password reset) and to bill the subscriptions. Login data and server logs serve security and technical operation. Processing is based on the contract for the use of Cropy, on your consent and on our legitimate interest in secure operation. We do not use your images and texts for any other purpose.
Retention period
Your account and projects remain stored until you delete them. “Delete account” in your profile permanently removes the account, projects and images. Sessions expire after 30 days; we delete failed login attempts after 24 hours. The provider usually deletes server logs after a short period, unless a security incident requires longer retention. We keep accounting-relevant data for as long as the law requires.
Disclosure
We do not sell personal data. Data is only disclosed to service providers we need for hosting, email and payment, and only to the extent necessary, or if we are required to do so by law.
- Stripe sells Plus and Pro through its Link service as merchant of record, processes the payment and sends receipts and invoices. Stripe receives your email address for this purpose and processes the purchase data under its own responsibility.
- Google only receives data if you choose to log in with Google.
Stripe and Google may also process data outside Switzerland, for example in the EU or the USA. Their privacy policies also apply in this case.
Cookies and analytics
Cropy only sets technically necessary cookies: one for the login, one for the selected language and, while logging in with Google, a short-lived security cookie. There are no tracking cookies and no analytics tools. No user profiles are created. To plan capacity, we count how often the app is opened and how many ZIP files are created with which formats. Only daily totals are stored, without IP addresses and without reference to any person.
Hosting and external content
Cropy is hosted in Switzerland. Fonts and images are stored on our own server. No third-party content is loaded when you visit the site. Only when you start a payment or the login with Google are you redirected to Stripe or Google.
Your rights
You can request information, rectification, erasure, restriction of processing and the release of your data, insofar as the law provides for this. You can delete your account and projects yourself in your profile. Write to us at hello@cropy.io. You can also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).
Changes
We update this policy when the law, technology or our offering changes. The version published here applies.
In case of discrepancies, the German version prevails.