Privacy Policy

This English translation is provided for your convenience. Only the German version is legally binding.

1. Controller

The controller responsible for the processing of personal data on this website is:

Heiko Stuhrmann
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany

Contact form

A data protection officer has not been appointed, as the requirements of Art. 37 GDPR / Sec. 38 BDSG are not met. For any data protection questions, please contact the controller named above via the contact form.

2. What data we process

When operating PushPig, the following data is processed:

Account data: username and password hash (Argon2id) on registration.
Contact requests: when you use the contact form, we process the data you provide (name, email address, subject and message body) in order to handle and answer your request.
Newsletter sign-up: when you subscribe to our newsletter, we process your email address and an optionally provided name in order to send you a confirmation email (double opt-in) and, subsequently, the newsletter. Signing up is voluntary and can be revoked at any time.
Session data: an encrypted session cookie (pp_session) for authentication after login.
Notification content: title, text and optional payload of the events sent via the API. This is stored in the database and automatically deleted after 90 days.
Browser push subscriptions: endpoint URL and cryptographic keys (p256dh, auth) that your browser provides for Web Push. This is only stored if you enable browser notifications.
FCM token: Firebase Cloud Messaging token for the Android app, if used.
API keys: randomly generated tokens for using the REST API.
Passkeys: public keys for passwordless authentication, if registered.
Message templates: templates created by the user for recurring push messages. These can be either personal or shared with the writers of a channel.
Bulk recipient lists: when uploading a CSV file for bulk sending, usernames as well as the variables contained in the CSV (e.g. salutation, individual content) are stored. This data originates from the sending user; in this respect PushPig acts as a processor.
Webhook configuration: external URLs, secrets and event subscriptions stored by channel owners for outgoing callbacks.
Quiet hours & time zone: an optional per-channel do-not-disturb period as well as your chosen IANA time zone, so that quiet hours can be evaluated correctly.
Invitation tokens: when creating an invitation link (channel join), a random token is stored that is valid for a maximum of 7 days and can be redeemed only once.
Log data: technical server logs (IP address, timestamp, HTTP method) as well as logs of the background processes (scheduler, webhook worker, bulk sending, quiet-hours worker, email delivery). Administrative members can inspect these logs via the management interface.

3. Legal basis

Processing is carried out on the basis of Art. 6 (1)(b) GDPR (performance of a contract) for all data necessary to provide the service, as well as Art. 6 (1)(f) GDPR (legitimate interest) for the server logs to ensure operation.

4. Cookies

PushPig uses the following cookies:

pp_session – session cookie for authentication. Expires after 30 days. Necessary for operation.
pp_consent – stores your cookie consent for 365 days. Necessary within the meaning of Art. 5 (3) ePrivacy Directive.

Beyond this, no tracking, marketing or analytics cookies are currently set. For anonymous reach measurement we use “Umami” (see below). As this service is cookieless and does not store any personal data, no consent is required; no cookie is set and no recognition identifier is stored on your device.

5. Disclosure to third parties

Data is only transferred to third parties in the following cases:

Umami Analytics (reach measurement): For the anonymous analysis of site usage (page views, time on page, country of origin, browser used) we use „Umami" — a privacy-friendly analytics software that we host ourselves on our own infrastructure in the EU. No data is passed on to third parties. This service is cookieless and operates without individual user identifiers; your IP address is not stored, but only briefly processed to derive the country of origin and immediately discarded. No cross-site tracking and no profiling takes place. As the service is cookieless and does not store any personal data, the analytics script is loaded without separate consent. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in data-minimising reach measurement to improve our offering). You may object to this processing at any time with effect for the future pursuant to Art. 21 GDPR — for example via a script/analytics blocker in your browser or by contacting us.
Newsletter (Listmonk): To send our newsletter we use „Listmonk", a newsletter software that we host ourselves on our own infrastructure in the EU When you subscribe via the form on our website, your email address and an optionally provided name are stored. Sign-up uses a double opt-in procedure: you first receive a confirmation email and are only added to the distribution list after your confirmation. The technical delivery of the emails is handled by our email provider (see „Email delivery (Strato)"). To protect against automated sign-ups we rely exclusively on a server-side method (honeypot + timing check) without any third-party provider. The legal basis is Art. 6 (1)(a) GDPR (consent). You can unsubscribe at any time via the unsubscribe link in every newsletter email, thereby withdrawing your consent with effect for the future.
Bot protection (no third party): To defend against automated abuse (e.g. credential stuffing, spam) we use server-side protective measures — without any third-party provider and without external scripts. No data is transmitted to third parties. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in securing our systems).
Polar (payment processing): When taking out a Pro membership, your payment and billing data (name, email address, billing address, chosen payment method) is transmitted to Polar Software, Inc., 548 Market Street PMB 61301, San Francisco, CA 94104-5401, USA. Polar acts as the „Merchant of Record", i.e. it is your contractual seller and processes the payment under its own responsibility; from Polar, PushPig receives only status events (subscription active/cancelled/expired) as well as pseudonymous identifiers (subscription_id, customer_id) in order to assign the correct plan to your PushPig account. The legal basis is Art. 6 (1)(b) GDPR (performance of a contract). A transfer to the USA takes place on the basis of the EU-US Data Privacy Framework. Details: Polar Privacy Policy.
Google Firebase (FCM): When sending notifications to Android devices, the message content and FCM token are transmitted to servers of Google Ireland Ltd. or Google LLC. The legal basis is Art. 6 (1)(b) GDPR (performance of a contract — delivery of the push messages you initiate). A transfer to the USA takes place on the basis of the EU-US Data Privacy Framework as well as supplementary EU Standard Contractual Clauses. The Google Privacy Policy applies in addition.
Web Push: Browser notifications are delivered via the respective browser push service of the manufacturer (e.g. Mozilla, Google, Apple).
Webhooks (user-configured): Channel owners can store external URLs to which HTTP requests are automatically sent upon certain events (push sent, new subscriber, completed bulk job). The message content (title/body), channel metadata, the sender username as well as aggregated delivery counters are transmitted in the process. Each request is provided with an HMAC signature header.
Responsibility for the legally compliant receipt and further processing lies with the channel owner who set up the webhook. PushPig only provides the transmission.
Bulk sending to third-party systems: During bulk sending, usernames and variables from the uploaded CSV are used solely to deliver the personalised pushes to the respective subscribers. No disclosure to external third-party systems beyond the push services mentioned above takes place in this context.
Hosting: PushPig is self-hosted; the servers are located at the premises of the controller named under section 1 in Germany. No outsourcing to an external hosting provider and no transfer to a third country take place. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in secure and stable operation).
DNS management (Bunny): For managing and resolving our domain names we use BunnyWay, informacijske storitve d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia. Whenever our website is accessed, connection data technically required for name resolution (including your IP address and the requested domain name) is transmitted to and processed by Bunny's DNS servers. Processing takes place within the EU (Slovenia); no transfer to a third country takes place. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in the reliable and secure availability of our website). Details: Bunny Privacy Policy.
Email delivery (Strato): For sending system emails (e.g. verification, invitation and notification emails) we use Strato AG, Otto-Ostrowski-Str. 7, 10249 Berlin, Germany. Your email address and the respective message content are transmitted. Processing takes place on servers in Germany (no third-country transfer). The legal basis is Art. 6 (1)(b) GDPR (performance of a contract) or Art. 6 (1)(f) GDPR.
Error and operations monitoring: To ensure stable operation, we transmit technical error events (error message, affected file/code line, stack trace, timestamp) to our own monitoring system (operated in the EU). In individual cases this may contain personal data if it is part of an error message. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in technical security and troubleshooting).

No disclosure to third parties beyond this takes place.

6. Data Processing Agreement (DPA) pursuant to Art. 28 GDPR

If you use PushPig in the course of a commercial activity and thereby process personal data of third parties (e.g. recipient data during CSV bulk sending, webhook payloads to external systems or push content relating to identifiable persons), we are your processor for this data within the meaning of Art. 28 GDPR. The conclusion of a data processing agreement is legally required in this case. Our DPA takes effect automatically upon your registration with PushPig and applies for the entire duration of the contractual relationship; a separate signature is not required. On request, you can print the DPA or save it as a PDF.

7. Storage period

Notification events are automatically deleted after 90 days.
Bulk sending jobs (incl. recipient lists and CSV variables) are automatically deleted 30 days after completion.
Invitation tokens expire after 7 days or after a single redemption.
Templates, webhook configurations, quiet-hours and time-zone settings remain stored until deleted by the user (or until account deletion).
Account data remains stored until the account is deleted.
Contact requests (name, email, message) are deleted after the request has been fully handled, at the latest after 6 months, unless statutory retention obligations apply.
Newsletter sign-up data (email address, optional name) remains stored until you unsubscribe and is then removed from the distribution list. Unconfirmed sign-ups (no double opt-in) are deleted after 30 days at the latest.
Server logs and background logs are deleted after a maximum of 30 days.

8. Your rights

Under the GDPR you have the following rights:

Access to stored data (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR)

To exercise your rights, please use the contact form

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority depends on your place of residence.

9. Data security

Transmission takes place exclusively encrypted via HTTPS (TLS). Passwords are stored exclusively as an Argon2id hash and are not readable by us. Outgoing webhook calls are provided with an HMAC-SHA256 signature so that the recipient can verify their authenticity.

Access to administrative functions (statistics, server logs, account overviews) is restricted to a small group of authorised persons and is logged.

Help & API · Pricing · Contact · Imprint · Privacy