Privacy Policy for Shimo

Last updated: September 1, 2026

This Privacy Policy explains how Fabian Jäger, trading as "Jäger Apps" ("Jäger Apps," "we," "us"), processes personal data in connection with the Shimo VPN client for macOS ("Shimo," the "Software") and the shimovpn.com website (the "Site").

Shimo is a VPN client: it helps you configure and manage connections to VPN servers of your choosing — for example your employer's VPN, a third-party VPN provider, or your own server. Jäger Apps does not operate VPN servers and has no access to your VPN traffic, browsing activity, DNS queries, or connection destinations. This Policy covers only the data Jäger Apps itself processes: your purchase, your license, and the limited technical data described below.

1. Who is responsible (data controller)

Fabian Jäger, trading as "Jäger Apps"
Website: apps.jaeger.io
Belziger Str. 33
10823 Berlin, Germany

Email: fabian@apps.jaeger.io

Jäger Apps is a sole proprietorship (Kleingewerbe) and, given the limited scope and low risk of the processing described here, has not appointed a formal Data Protection Officer. Direct any privacy question or request to the email address above.

2. What data we process

2.1 When you purchase Shimo

Purchases are handled by Paddle (Paddle.com Market Ltd / Paddle.com, Inc.), which acts as the merchant of record and reseller of Shimo. Paddle collects your payment details, billing address, and email address directly, and processes that data as an independent controller under its own privacy policy — see paddle.com/legal/privacy.

Paddle shares the following order data with us so that we can issue your license and provide support:

Name and email address
Order date, product, and price paid
License key
Country (for tax/VAT purposes)

We do not receive or store your payment card or bank details.

Legal basis: performance of the license agreement with you (Art. 6(1)(b) GDPR).

2.2 When you activate and use Shimo (license validation)

Shimo periodically contacts our license server to verify that your license is valid. This check transmits:

Your license key
A hashed device identifier (not your name or personal profile)
App version and macOS version
Timestamp and IP address (processed transiently for the connection; not stored beyond standard server logs)

This does not include your VPN configurations, credentials, connection logs, or any data about the networks you connect to.

Legal basis: performance of the license agreement (Art. 6(1)(b) GDPR) and our legitimate interest in preventing license misuse (Art. 6(1)(f) GDPR).

2.3 Crash and error reports

If Shimo crashes or encounters an error, a crash report may be sent to our crash-reporting provider, Sentry (Functional Software, Inc., d/b/a Sentry, San Francisco, USA), to help us diagnose and fix bugs. A crash report typically contains:

Stack trace / error details
App and macOS version
An anonymous installation identifier

Crash reports do not contain your VPN credentials, connection details, or browsing activity. You can disable crash reporting at any time in Shimo's preferences.

Legal basis: our legitimate interest in maintaining a stable, secure product (Art. 6(1)(f) GDPR).

2.4 Support requests

If you email us for support at support@shimovpn.com, we process the contents of your message, any attachments you provide, and your email address to respond to you. We retain support correspondence only as long as needed to resolve the matter, plus a reasonable period afterward, unless we are legally required to keep it longer.

Legal basis: performance of the license agreement (Art. 6(1)(b) GDPR) or our legitimate interest in resolving your inquiry (Art. 6(1)(f) GDPR).

2.5 The Site (shimovpn.com)

The Site may log standard technical/server data (IP address, browser type, pages visited, timestamp) for security and operational purposes.

We also use Google Analytics 4 ("GA4"), a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and its parent Google LLC (USA), to understand how visitors use the Site (e.g. pages viewed, referral source, approximate location, device type). GA4 uses cookies and similar technologies and may transmit data to Google servers in the United States; where this occurs, it relies on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses as a transfer safeguard.

GA4 is not strictly necessary for the Site to function, so we only activate it, and only set the associated cookies, after you have given your consent via the cookie/consent banner on the Site, in accordance with Art. 6(1)(a) GDPR and § 25 TTDSG (the German rule implementing the ePrivacy Directive). You can withdraw your consent at any time via the consent management tool on the Site, or by using Google's Analytics opt-out browser add-on.

Legal basis: your consent (Art. 6(1)(a) GDPR); withdrawing consent does not affect the lawfulness of processing before withdrawal.

3. Recipients and international transfers

We share data with the following categories of recipients:

Paddle — payment processing and order fulfillment (see 2.1). Paddle may process data outside the EEA; appropriate safeguards (e.g. Standard Contractual Clauses) apply where required.
Sentry — crash and error reporting (see 2.3). Sentry may process data in the United States, safeguarded by Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework.
Google (Google Analytics 4) — Site analytics (see 2.5), processed only with your consent. Data may be processed in the United States, safeguarded as described in 2.5.
Hosting/infrastructure providers operating our license server and email, acting as our processors under Art. 28 GDPR data processing agreements.

We do not sell personal data, and we do not share it for third-party advertising purposes.

4. Retention

Purchase/license records: retained for the duration of statutory German commercial and tax retention periods (currently up to 10 years under §147 AO / §257 HGB).
License-validation logs: retained only briefly for operational/fraud-prevention purposes, then deleted or aggregated.
Crash reports: retained per Sentry's default retention period (typically 90 days), then deleted.
GA4 analytics data: retained per our configured GA4 data retention setting (Google's default is 14 months), then automatically deleted or aggregated.
Support correspondence: see 2.4.

5. Your rights

Under the GDPR, you have the right to:

Request access to the personal data we hold about you (Art. 15)
Request correction of inaccurate data (Art. 16)
Request erasure ("right to be forgotten"), subject to legal retention obligations (Art. 17)
Request restriction of processing (Art. 18)
Receive your data in a portable format (Art. 20)
Object to processing based on legitimate interest (Art. 21)
Lodge a complaint with a supervisory authority — in our case, the Berliner Beauftragte für Datenschutz und Informationsfreiheit (www.datenschutz-berlin.de), or the supervisory authority in your own EU member state.

To exercise any of these rights, contact us at fabian@apps.jaeger.io.

6. Children

Shimo is not directed at, and we do not knowingly collect data from, children under 16.

7. Security

We use appropriate technical and organizational measures (e.g. encrypted connections to our license server) to protect the data described in this Policy against unauthorized access, loss, or misuse.

8. Changes to this Policy

We may update this Privacy Policy from time to time, for example to reflect changes in our processing activities or legal requirements. The "Last updated" date at the top reflects the current version. Material changes will be highlighted on this page or communicated by email where appropriate.

9. Contact

Fabian Jäger, trading as "Jäger Apps"
Belziger Str. 33, 10823 Berlin, Germany
Privacy inquiries: fabian@apps.jaeger.io
Support: support@shimovpn.com