A reasonable assumption would be that EU data is processed in the Netherlands, Russian data is processed in the Russian Federation, and that Rest-of-World data is processed in the US. This complies with all of the listed regulations, but it would be nice to have this explicitly broken down.

Author's here.

It is a standard privacy policy generated by getterms.io.

We have no data on you. You can read about our security model here (https://safeapps.io/content/security) and walk through our source code here (https://github.com/safeapps-io). TL;DR: every bit of data you create within the product is encrypted in the browser. The server only sees a blob of encrypted bits, that's all. You can sign up without an email. But if you do, we use Sparkpost for sending emails, which is a EU-based ISP. We do not have any third-party scripts or cookies across all the site at all. No Google Analytics, no Facebook Pixel, no Intercom support chat. We use German hosting and I'm personally from Russia.

So no, we do not violate GDPR (but we do violate Russian laws because we do not have any servers in Russia). And we do take privacy seriously.

How does this violate GDPR?

You can't store EU resident's data in the Russian Federation as the laws there do not provide an adequate level of data protection. Likewise you can't store it in the US in principle, although the situation is more complicated there legally. The CCPA has similar requirements regarding data residency for data belonging to US citizens as far as I know (not an expert on that though).

Also, the website does not name a data protection representative in the EU. In fact, I couldn't find any information about the country that the company is based in (I assume Russia), or if there even is a registered company to begin with, which is another no-go. If you want to operate a privacy-first service you should at least make sure the basic formalities are met, and that includes naming who exactly is processing your data for which purposes.