Policy preview · Revision 2026-09-27 · Updated 27 September 2026
Public account services and paid checkout are not open. This preview explains the selected customer policy; it is not a live offer or a claim that every service and safeguard is operating. Required seller details, provider arrangements and operational checks must be completed before purchases start. See current app availability separately.
Who operates Bogwitch
Fred Bergwitz-Larsen
Långbackavägen 48
182 34 Danderyd
Sweden
Public website: bogwitch.app
Bogwitch is the product name. A working public support email and telephone, and any required business registration and VAT details, have not yet been verified for publication. They must be provided before a live purchase. This preview does not supply a live support or privacy-request form.
What these pages do today
The public website is an informational site. It has no analytics or advertising trackers, and no waitlist or newsletter collection form. Public marketing pages request Inter and JetBrains Mono from Google Fonts, so Google receives the connection information needed for those requests. Account and sign-in help pages use system fonts and omit those font requests.
Hosting can involve IP addresses, browser information and routine request records. Actual provider locations, logs, backups and transfer safeguards are still being verified. We do not claim that all provider processing already meets the planned schedule below. These legal pages do not submit account, deletion or purchase-recovery requests. Interactive account previews use browser storage and session cookies for security and request recovery when you use those features.
Responsibility and purposes
Fred Bergwitz-Larsen is responsible for Bogwitch account and service processing as controller, subject to verification of the legal operator's business particulars. We use only the information needed for the purpose: supplying the service you request, protecting it, recovering accepted operations and meeting applicable legal obligations.
- Account and service: contact details, account and session identifiers, paired-device service enrollment, routing metadata, delivery status and quota counters support the requested service, on the basis of contract necessity where objectively needed.
- Payments and required messages: payment references, amounts, currencies, refunds and contract evidence support purchases and recovery. Applicable accounting and tax records are kept under legal obligations. Essential sign-in, contract and refund messages serve their stated purpose; they are not marketing permission.
- Security: limited authentication, abuse-prevention and recovery information uses documented, narrowly defined legitimate interests. Terms acceptance is not blanket consent to process personal data.
Local, cloud and personal summaries
Local works between paired devices on your network without a Bogwitch account or cloud relay. Account recovery does not recover device content keys, and account deletion does not remove Local pairing, recipient-saved files or offline device state. Platform permissions remain separate choices.
Optional Pro cloud is designed to carry encrypted clipboard, notification and file content between paired devices. The cloud implementation and its encryption claims still require verification. Encryption does not make account, endpoint or traffic metadata anonymous.
Personal summaries are off by default and require separate account and device consent. Only opted-in receiving devices contribute coarse daily activity totals; enabling summaries does not backfill earlier activity. Opting out hides them immediately and starts live deletion within 24 hours. Local records are limited to seven days and coarse server records to 400 days; offline collection permission lasts at most 24 hours, with local erasure on next execution. There is no product analytics, advertising profile or automatic marketing consent.
Selected providers and international transfers
The planned service uses Cloudflare for the public website and object storage, Fly for account services and relays, Turso for metadata, WorkOS for hosted sign-in, Resend for essential email, Stripe Managed Payments for payments, and Grafana Cloud for operational monitoring. These are selected providers, not a verified list of live processing arrangements. Payment providers may have their own controller duties; not every provider is simply our processor.
The selected infrastructure includes Frankfurt account services, Frankfurt and Amsterdam relays, and EU-jurisdiction object storage. This does not establish where every provider or subprocessor processes data. Actual recipients, processing locations, agreements and international-transfer safeguards must be verified and disclosed before public account services open. We do not promise that all data stays in the EU or that deleting an account erases a provider's legally required records.
Planned retention limits
These are the selected operating limits, not a claim that all cleanup is already implemented or that every period is legally required. Earlier purpose-specific expiry applies. Retries, copies, exports and restores do not restart a clock.
- Active profiles: keep only necessary account information while active. After accepted deletion, deny access immediately and remove ordinary live profile and contact fields within 24 hours.
- Cloud content: automatic clipboard is live-only; explicitly delayed text lasts at most 10 minutes, notification catch-up 24 hours, commands 30 seconds, files seven days, and delivery receipts 30 days after their final outcome.
- Deletion and backups: target verified live-content removal within 24 hours of accepted deletion. Metadata backups and recovery copies expire within 30 days of original creation. Unconfirmed removal remains pending.
- Authentication and recovery: keep credentials and secrets only for their original security or recovery lifetime. Remove transient secret bodies at use or expiry and obsolete secret material within 24 hours; revocation or deletion disables access immediately.
- Quotas: retain current-period counters and outstanding reservations only while needed. Remove closed counters within 24 hours after related work is final and recovery cannot reopen the charged period.
- Routine logs: seven days from the event. Exclude content, filenames, access tokens, payment details and email. Raw IP storage requires a specific documented need and follows the same limit unless a named incident hold applies.
- Support correspondence: 90 days after resolution, except minimal material needed for a specific complaint, dispute or legal hold.
Records needed to prevent access from returning
Minimal deletion, revocation and unfinished cleanup records can outlast those limits. They retain only the identifiers, original times and verified outcomes needed to finish an obligation and prevent an old session, operation or backup from restoring access. They do not contain content, filenames, email addresses, raw IP addresses or bearer credentials. Compact replay evidence has an original minimum lifetime of at least 32 days and can remain necessary longer.
These records become eligible for removal only after cleanup is verified, older recoverable copies and access capabilities have expired or been disabled, and removal cannot revive access or erase an uncertain result. Eligible details are removed within 24 hours. Unfinished work is reviewed at least weekly; specific case holds at least every 30 days. Missing a cleanup target requires investigation, not a false completion report. Restored data must respect earlier deletion and revocation decisions before access is allowed.
Financial and contract records
Necessary financial records are restricted and separate from active accounts. Where Fred must keep records as Swedish accounting information, the period ends at the end of the seventh year after the calendar year in which the financial year ended. OSS tax documentation has a ten-year period after the transaction year only where Fred actually has that duty; merchant-of-record payment handling does not automatically create it.
Keep only necessary invoice and party details, payment, refund and tax references, amounts, currencies, dates and supporting records. Personal contract evidence is retained only to support a retained financial record or an identified unresolved contract or dispute obligation, with a recorded basis and end condition. Public terms versions can be kept without an account profile. Eligible financial records are removed within 24 hours after the period or a specific hold ends. This does not justify retaining cloud content, credentials or a general activity history.
Your rights and requests
As applicable, you can request access, correction, erasure, restriction and portability of your data, object to processing, and withdraw optional consent. A request may require proportionate identity verification, never a purchase. The normal response period is one month; any lawful extension or restricted statutory retention must be explained. You may complain to Sweden's privacy authority, Integritetsskyddsmyndigheten (IMY), or another competent authority.
The operator's postal address appears above. A verified public privacy contact and full provider disclosures must be published before account services open. This preview does not claim those contact arrangements are ready. Account deletion does not cancel an accepted refund or erase records that must lawfully remain restricted.