1. Overview
Joppa is built to run on your machine. Your projects, databases, certificates and environment files stay on your computer and are never sent to us. We only process the little data needed to sell you a licence, let you sign in and keep the service safe. We do not use analytics, advertising or tracking cookies, and we never sell your data.
2. Who is responsible
The data controller is Smoovify, SASU (simplified joint-stock company with a sole shareholder), with a share capital of €10, registered office at 173 rue de Courcelles, 75017 Paris, France, SIRET 108 870 981 00017. You can reach us at hello@getjoppa.com.
3. What we collect
When you visit the website
Like any website, our host receives technical data with each request: IP address, browser type, requested page, date and time. It is used to deliver the pages and protect them against abuse. We do not build visitor profiles.
When you sign in from the app
- Your email address, to send you a single-use sign-in link and find the licence attached to it.
- Your IP address, only to limit the number of sign-in attempts. It is stored as a one-way hash and expires after 15 minutes.
- Single-use sign-in tokens, stored as hashes and valid for 15 minutes (link) or 5 minutes (code).
When you buy Joppa Pro
Payment is handled by Polar, our reseller and merchant of record. Polar collects your name, email address, billing address, tax details and payment information under its own privacy policy ↗. We never see your card details. We receive your email address, your licence key, the orders and invoices attached to it, and the checkout identifier used to activate the app after purchase.
When you write to us
We keep your email address and the content of your messages to answer you.
4. The Joppa app
The app has no telemetry and no crash reporting. It only connects to the internet in these cases:
- Licence activation and checks (Pro only): the app sends your licence key, the name of your computer, an anonymous machine identifier (a hash of the hardware ID) and the app version to Polar and to getjoppa.com. This lets you see and manage your machines and enforces the machine limit of your licence.
- Downloads you ask for: when you install a runtime or start a project from a template, the app downloads it from its official source (for example static-php.dev, getcomposer.org, GitHub or a container registry). Those services see your IP address, as with any download.
5. Purposes and legal bases
- Selling and managing your licence, signing in
- Performance of the contract
- Invoicing and accounting
- Legal obligation
- Security, rate limiting, fraud prevention
- Legitimate interest
- Answering your messages and support
- Legitimate interest
6. Service providers
Your data is only shared with the providers we need to run Joppa, under their data processing terms:
- Cloudflare, Inc.
- Website hosting, API and temporary sign-in storage
- Polar Software, Inc.
- Checkout, payments, invoices, tax, licence keys
- Resend
- Sending sign-in emails
- Google LLC
- Serving the website fonts (Google Fonts), which sees your IP address
We may also disclose data when required by law or by a court order.
7. Transfers outside the EU
Some of these providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
8. How long we keep data
- Sign-in tokens and codes
- 15 minutes at most
- Rate-limiting counters
- 15 minutes
- Customer and licence data
- While your licence is active, then 3 years
- Invoices and accounting records
- 10 years (legal obligation)
- Support emails
- 3 years after our last exchange
- Hosting logs
- As set by Cloudflare, generally a few days
9. Security
All traffic is encrypted with HTTPS. Sign-in links and codes are single-use, short-lived and stored only as hashes. The app exchanges codes using PKCE, so an intercepted code cannot be used on another machine. Secrets and API keys are never stored in our code.
10. Cookies and local storage
The website does not set any cookies. It stores a single preference in your browser's local storage, joppa-theme, to remember the light or dark theme you chose. It never leaves your browser, and you can clear it at any time from your browser settings. Polar's checkout may use its own cookies, described in its policy.
11. Your rights
Under the GDPR and the French Data Protection Act, you have the right to access, correct and delete your data, to restrict or object to its processing, to data portability, to withdraw your consent at any time, and to give instructions about what happens to your data after your death.
To exercise them, email hello@getjoppa.com. We answer within one month. If you think your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr ↗), or the authority of your country.
Joppa is not intended for children under 15, and we do not knowingly collect their data.
12. Changes
We may update this policy, for example when we add a feature or a provider. The date at the top of this page shows the latest version. If a change is significant, we will tell customers by email.
13. Contact
For any question about your data: hello@getjoppa.com, or by post at Smoovify, 173 rue de Courcelles, 75017 Paris, France.