ScisYour work and your privacy
Scissor has no server behind your work. The engine runs inside the browser tab, and so does everything it does: drawing, editing, importing SVG, PDF, .ai and PSD files, and exporting. Your artwork is never uploaded to our servers, unless you choose to attach it to a problem report (see below).
Who is responsible
The controller for this site is , , , email . See the imprint. For privacy questions you can also write to privacy@scissor.studio.
Where your documents live
Documents are files on your own computer. Open and Save use the browser's own file picker, so you choose the folder and Scissor writes back to the file you picked. In browsers without that picker, saving and exporting arrive as ordinary downloads and opening goes through a file chooser. The native document format is .cut.
Recovery after a crash
While a document has unsaved changes, Scissor writes a copy into the browser's own storage on this machine every few seconds, and again whenever the tab is hidden or closed. If a session ends badly, the next time you open Scissor you are offered the leftover work with a Recover button. Saving a document clears its copy. In a private window, or where site storage is blocked, recovery is unavailable and nothing is written.
What our server sees
Like any website, our servers and our content delivery network receive standard request information when your browser downloads Scissor's pages and files: your IP address, the address requested, the time and your browser's user agent. This is used only to deliver and secure the site and to count visits by country, and it is not combined with other data or sold. Legal basis: our legitimate interest in delivering and securing the site (Art. 6(1)(f) GDPR).
Analytics
Visits are counted by country at the edge of the network, by Cloudflare, with nothing added to the page and no cookies. Scissor can also use Google Analytics, which sets its own cookies, to count visits and see which features are used. In the EU, the EEA, the UK, Switzerland, Brazil, Canada, Turkey, South Korea, China, India and South Africa it stays off unless you allow it: once you have drawn something or had a document open for a little while (or after a minute), a bar at the foot of the window asks, and your answer is remembered. A Yes stands until you change it; after a No, Scissor may ask once more after about six months. Elsewhere it is on by default. Anywhere, you can switch it on or off in Preferences > Privacy; turning it off reloads the page so the tracking code is gone. Either way your artwork stays on your computer. Google Analytics is run by Google Ireland Limited, and Google LLC may process the data in the USA. It runs with Google signals and ad personalisation turned off, so the data is used only to count visits and features, never for advertising. Legal basis: your consent where you are asked (Art. 6(1)(a) GDPR, §25(1) TDDDG), which you can withdraw at any time in Preferences; elsewhere our legitimate interest in knowing which features are used (Art. 6(1)(f) GDPR).
To know how many people use Scissor, the app tells our own Customer Care service on this site once per visit, after you first draw, type, or make or open a document, and once for each new document. Nothing is stored on your device for this. Each count keeps only the page's address without anything after it, the Scissor version, your country and browser language, and a visitor code. That code is made from your IP address and browser with a random key that is replaced every day and never kept, so it cannot be traced back to you or matched with any other day; no IP address, cookie or browser detail is stored. This count is the same everywhere and does not depend on the setting above. The service describes exactly what it receives and keeps at scissor.studio/_care. Legal basis: our legitimate interest in knowing how much Scissor is used (Art. 6(1)(f) GDPR).
When something goes wrong in Scissor, for example a file that will not open or a save that fails, the app tells the same service what failed: the kind of error, its message, the place in Scissor's code where it happened, which part of Scissor it was in, the Scissor version and the page's address without anything after it. It never sends your document, a file's name or anything you typed, and it sends at most twenty such reports per visit. With each report the service stores your browser, system, type of device and country, and a visitor code made the same way as for the count. Your IP address is used only for that code and to limit how often reports can be sent, and is never stored. Like the count, this does not depend on the setting above. Legal basis: our legitimate interest in finding and fixing errors (Art. 6(1)(f) GDPR).
Studios
A Studio lets people work on one file together, see each other's pointers and talk while they work. Scissor's server only introduces the people in a Studio to each other: it keeps their display names and who is in which Studio in memory while the Studio is open, and stores nothing. After that, everyone in the Studio connects to everyone else directly, so they can see each other's IP address. The shared file, every change to it and the pointers are sent directly between you, never through the server, and everyone in the Studio ends up with a copy of the file. Voice is off until you turn it on, and your browser asks before Scissor can use the microphone; your voice also goes directly to the others and is not recorded. A Studio ends ten minutes after the last person leaves. The host can lock a Studio so that newcomers wait until they are let in, and can mute people. Legal basis: providing the Studio you asked for (Art. 6(1)(b) GDPR).
Problem reports
Help > Report a Problem sends a report to our own Customer Care service on this site only when you press Send Report, and only after you agree to it in the form. The report holds what you write and the Scissor version, plus whatever you tick: your browser and system, a screenshot of the canvas, the steps you recorded, and the document, which is never sent unless you tick it. If you give your email address, it is stored encrypted and used only to reply about your report. With the report the service notes your browser, system, type of device, country and language, but not your IP address. A person reads each report to fix the problem, and reports are never shared or sold. To stop the form from being flooded, your IP address is used for a few minutes to limit how many reports can be sent, and it is not stored with the report. To have a report deleted sooner, email privacy@scissor.studio and quote the reference the form showed you.
Help > Suggest a Feature works the same way: it sends your idea, and your email address if you give one, only when you press Send Idea and agree in the form. Ideas are read by a person and never shared or sold. Legal basis for reports and ideas: your consent in the form (Art. 6(1)(a) GDPR), which you can withdraw at any time by asking us to delete what you sent.
Google Drive
File > Google Drive opens, saves and exports files in your own Google Drive, only when you choose it. Google asks you once to sign in and allow it. Scissor asks only for the files you open or create with it, never the rest of your Drive. Files go directly between your browser and Google, never through a Scissor server, and Scissor keeps no copy of them. The permission Google gives lasts only while the page is open and is never stored; you can withdraw it at any time in your Google Account under Security, Third-party connections. Google's own privacy policy covers what Google does with your files. Scissor's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Storage on your device
Your browser keeps Scissor's files so it opens quickly and works without a connection once it has loaded. Scissor also keeps your preferences, recent colours and similar settings, and the recovery copies described above, in this browser's storage on your device. None of this is sent to us. You can delete it by clearing this site's data in your browser. This storage is strictly necessary for the functions you use (§25(2) No. 2 TDDDG). Only the Google Analytics cookies described above need your consent.
Installing the app
Choose Help > Install Scissor… to install Scissor as an app. It then opens in its own window, works without a connection because the browser has kept a copy of the files, and can open .cut, SVG, PDF, .ai and PSD files directly from your desktop. There is no account and no sign-in.
Service providers
The site is delivered through Cloudflare, Inc. (content delivery and protection against attacks). Cloudflare may process your IP address in the USA. Cloudflare and Google are certified under the EU-US Data Privacy Framework, its UK extension and the Swiss-US Data Privacy Framework, which cover these transfers. The site, our Customer Care service and the Studio server run on servers of Hetzner Online GmbH in Nuremberg, Germany. If you allow Google Analytics, or use Google Drive, your browser connects to Google as described above.
How long we keep data
Visit counts and error reports: about 25 months. Screenshots and documents attached to a problem report: 30 days. The rest of a report or idea: at most two years. Spam: 30 days. Studio names and memberships: only while the Studio is open. Server and network logs: only as long as needed to deliver and secure the site. Recovery copies and preferences on your device: until you save the document or clear the site's data.
Your rights
You can ask for access to your data, and for it to be corrected, deleted, restricted or handed over in a portable format. You can withdraw consent at any time. This does not affect processing before you withdraw it.
Right to object: where we rely on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
To use these rights, or with any question about privacy, write to or privacy@scissor.studio. You can also complain to a data protection authority, in particular the one where you live or work, or the one responsible for us: the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
Children
Scissor needs no account and asks for no personal details, and it is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us a report or an idea with personal details, write to us and we will delete it.
Your country
United Kingdom: the UK GDPR and the Data Protection Act 2018 give you the rights described above. You can complain to the Information Commissioner's Office at ico.org.uk.
Switzerland: the Federal Act on Data Protection (FADP) gives you the same rights. Data may be processed in the USA by Cloudflare and Google, as described above. You can report a concern to the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.
United States: we do not sell your personal information, and we do not share it for cross-context behavioural advertising. Scissor does not respond differently to Do Not Track or Global Privacy Control signals, because it does no such selling or sharing to opt out of. If you live in a state with a privacy law, such as California, you can ask what personal information we hold about you, and ask us to correct or delete it, by writing to the address above. We will not treat you differently for using these rights.
Australia: if you have a privacy concern, write to us first and we will answer within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.