Privacy Policy

The German version of this policy is the legally binding one. This English version is a translation for your convenience.

In short: Pagewerk works on your device. We never receive your documents, and we do not track you. You can use Pagewerk without an account. If you create one, we store only what the account needs: your email address, how you sign in, your devices and your purchases. Everything you sync is end-to-end encrypted on your device. Wherever data leaves your device (sign-in, purchases, sync, font downloads, emails to us, visits to this website), this policy says exactly what goes where, and why.

1. Who is responsible

Malte Schiebelmann, Salzmannweg 12, 14469 Potsdam, Germany · hello@pagewerk.app

We have not appointed a data protection officer, as the law does not require one for us.

2. What this policy covers

• the Pagewerk apps for iPhone, iPad, Mac, Windows and Android (not every app is available yet; this policy applies to each one as it launches),
• the free web tools on pagewerk.app,
• the website pagewerk.app itself,
• the optional Pagewerk account, including the account and purchase pages on app.pagewerk.app and the account server at api.pagewerk.app,
• contact with us by email.

3. Overview

4. The apps

Your documents

Every tool runs on your device. Files you open, the results you make and the pages in between are never sent to us or to anyone else. That includes text recognition (it uses Apple's on-device Vision framework on Apple devices), signatures, redaction and conversions to and from Word, Excel and PowerPoint. If you open a file from or save it to a cloud service such as iCloud Drive, Google Drive or OneDrive, that service processes it under its own terms.

What the app keeps on your device

• your recent results and history
• saved workflows and signatures
• answers you typed into forms, if you let Pagewerk remember them
• downloaded fonts

You can delete each of these in the app under Account. Deleting the app removes all of it.

No analytics, no advertising

The apps contain no analytics or advertising SDKs, set no advertising identifiers and do not track you across apps or websites.

Font downloads

When a document uses a font that Pagewerk does not include, the app downloads it from Google Fonts (fonts.googleapis.com, fonts.gstatic.com), operated by Google LLC, USA. Google receives your IP address, your device type and the name of the font, never the content of your document: Pagewerk always downloads the whole font, not just the characters in your file. Fonts are kept on your device, so each one is downloaded only once. Our legitimate interest is showing your documents correctly. Without an internet connection, Pagewerk uses its built-in fonts instead. Google is certified under the EU-US Data Privacy Framework.

Additional data for conversions

The apps for iPhone, iPad and Mac download measurement tables for Office fonts through Apple's Background Assets service. Apple delivers them like an app update and receives the usual technical data for that.

Purchases in the App Store

On iPhone, iPad and Mac you buy Pro through Apple's App Store. Apple processes your payment as the seller; we never see your payment details. The app learns from the App Store, on your device, whether you have Pro. We receive sales reports from Apple that do not identify you.

If you are signed in to a Pagewerk account, the app also sends the signed purchase record from the App Store to our server, so that your Pro also works on your other platforms. Apple then informs our server about renewals, cancellations and refunds of that purchase (App Store Server Notifications). We store the subscription status, the product, the end of the current period and Apple's transaction ID with your account.

When the apps for Windows and Android launch, purchases there may run through the Microsoft Store or Google Play. We will add those stores to this policy before that happens.

Free-use counter

Some Pro options can be used a limited number of times for free. The app counts these uses in your iCloud key-value storage (Apple), so the count is the same on your Apple devices. If you have an account, the count is also stored in your account and merged with the count on your devices (the higher number wins).

Crash reports

If you allowed it in your device settings (on Apple devices: "Share with App Developers"), the store sends us anonymous crash reports. They contain technical data such as device model, system version and where the app stopped, but no documents.

5. Web tools on pagewerk.app

The web tools load Pagewerk's engine from cdn.pagewerk.app into your browser and run there. Your files are not uploaded; you can check this in your browser's network view. Loading the engine is an ordinary website request (see section 6).

To give you one free use a day (files up to 25 MB), the page stores the date and a counter in your browser's local storage. This is technically necessary for the service you asked for (§ 25(2) no. 2 TDDDG). The counter never leaves your browser, and you can delete it by clearing the site data.

6. This website

pagewerk.app and cdn.pagewerk.app are hosted by Cloudflare, Inc., USA, which processes data on our behalf under a data processing agreement. To deliver pages and protect against attacks, Cloudflare processes your IP address, the time, the page requested, the referring page and your browser's user agent. We do not keep our own access logs. The website sets no cookies, uses no analytics and loads no third-party content; its fonts are served from our own domain. Cloudflare is certified under the EU-US Data Privacy Framework.

The account and purchase pages on app.pagewerk.app are described in sections 7 and 9.

7. Your Pagewerk account

Do you need one?

No. All apps and web tools work without an account. You need an account only to use Pro on more than one platform, to sync your data between devices (for example workflows and signatures), and to buy Pro on the web.

Signing in

You can sign in with a one-time code sent to your email address, with a password, or with Apple, Google or Microsoft. Sign-in is handled by our identity provider WorkOS, Inc., USA, which processes data on our behalf:

• Email code: WorkOS sends the code to your address.
• Password: your password goes to WorkOS and is checked there. We neither store nor log it. For this check WorkOS also receives your IP address and browser user agent.
• Apple, Google, Microsoft: you sign in on the provider's own page (Google and Microsoft via WorkOS; Sign in with Apple directly in the app or via WorkOS). The provider tells us your email address, whether it is verified, and a user ID. If you use Sign in with Apple and choose "Hide My Email", we only receive Apple's relay address.

What we store

The legal basis is the contract for your account (Art. 6(1)(b) GDPR). For the security log, rate limits and session fingerprints, it is also our legitimate interest in keeping accounts safe (Art. 6(1)(f) GDPR).

Our database runs at Neon, Inc. in Frankfurt, Germany (Amazon Web Services, eu-central-1), on our behalf. The account server runs on Cloudflare, placed in the Frankfurt region. Cloudflare keeps technical logs of the account server for a limited time (errors and events, with query strings removed, and a small sample of request traces). The database provider can restore the database to any point within the last six hours, so deleted data can remain in that restore history for up to six hours.

Cookie and browser storage during sign-in

pagewerk.app sets no cookies. During sign-in, api.pagewerk.app sets one cookie that is needed to finish the sign-in in the same browser. It contains a random value, is not readable by scripts and expires after 10 minutes. This is technically necessary for the sign-in you asked for (§ 25(2) no. 2 TDDDG).

On app.pagewerk.app, your browser keeps your sign-in tokens in session storage, which is cleared when you close the tab. Local storage remembers only the method you last signed in with (for example "Apple"), so the page can suggest it next time; it contains no email address and no password. On the purchase page, session storage remembers the country you picked for prices.

8. Sync

If you are signed in, the apps can sync workflows, signatures and settings between your devices.

• Everything you sync is end-to-end encrypted on your device before it is uploaded: signatures, workflows, recipes and settings. The key is created on your devices and protected by your device key; a copy protected by your recovery passphrase is also stored. We cannot read what you sync; our server refuses anything that is not encrypted.
• What we can see: that a record exists, its type (for example "workflow"), its size, when it changed and which account it belongs to.
• Each synced item is stored in our database (Neon, Frankfurt). Larger items, such as encrypted signature images, are stored as files of up to 2 MB each at Cloudflare R2 in Cloudflare's Western Europe location. Files are private and can only be fetched by your account.
• When you delete an item, its content and file reference are removed. A small marker without content (item ID, type, version, time) remains, so that devices that have been offline for a long time also learn about the deletion. The file itself is deleted once nothing refers to it any more.
• When you delete your account, all your synced items and markers are deleted; your files are deleted in the next clean-up runs, unless another account has stored exactly the same file.

The legal basis is the contract for your account (Art. 6(1)(b) GDPR). You can download all your account data, including your synced items, as a file on the account page ("Export data").

9. Purchases on the web

On the web you buy Pro from Paddle, which acts as reseller and Merchant of Record. Paddle is the seller of your purchase: it processes your payment, payment details, billing address and invoice, and handles taxes, under its own responsibility and privacy notice. We never see your full payment details.

To unlock Pro and handle cancellations and refunds, we receive from Paddle and store with your account: the product (monthly, yearly, or one year without renewal), status, amount, currency, the type of payment method (for example "card"), the paid periods, refund status and Paddle's IDs for the transaction and subscription. We keep the notifications Paddle sends us for 90 days after processing.

To show prices in your currency, the purchase page determines your country from Cloudflare's location information (derived from your IP address), unless you choose another country.

How long: while your account exists, and after you delete it in pseudonymous form (without your email address), so that refunds, cancellations and our accounting with Paddle can still be matched. We delete them when the statutory retention periods for accounting records end, at the latest ten years after the end of the calendar year of the purchase.

The legal basis is the contract (Art. 6(1)(b) GDPR), our legal obligations (Art. 6(1)(c) GDPR) and our legitimate interest in correct billing (Art. 6(1)(f) GDPR).

10. Deleting your account

You can delete your account at any time in the apps or on the account page. Deletion takes effect immediately:

• your email address is removed, and your sign-in identities, devices, sessions, licence records and synced items are deleted;
• your account at WorkOS is deleted;
• your web subscriptions at Paddle are ended immediately;
• IP addresses, user agents and details are removed from your security log.

What remains: an account ID without personal details, the pseudonymous purchase records described in section 9, and a deletion record that keeps the provider IDs only until the clean-up at WorkOS and Paddle is complete. Paddle keeps its own transaction records as seller.

App Store subscriptions are managed by Apple. Deleting your account does not cancel them; please cancel them in your Apple account settings.

11. Email and support

Emails to hello@, hallo@ and support@pagewerk.app are forwarded by Cloudflare Email Routing to a Gmail mailbox (Google). We use your message only to answer you and delete it when your request is resolved, unless the law requires us to keep it. Please send files only if they contain nothing confidential.

12. Service providers and transfers outside the EU

Cloudflare, WorkOS, Google and Apple may process data in the USA. These transfers rely on the EU-US Data Privacy Framework where the recipient is certified and, where it does not apply, on the European Commission's standard contractual clauses.

13. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Write to hello@pagewerk.app. With an account, you can export your data and delete your account yourself (sections 8 and 10). Without an account, we hold almost no data about you, so often there will be nothing to disclose.

You can also complain to a supervisory authority, for us: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany.

14. Children

Pagewerk is not directed at children and collects no data about them knowingly.

15. Changes

When Pagewerk changes how it handles data, for example with a new platform or a new account feature, we update this policy before the change takes effect and note the date below.

Last updated: November 2026