Privacy policy
Last updated: 14 July 2026
Controller and contact
Benjamin Graf · Contact: [email protected]. See the legal notice for further details.
Local app use
Download URLs, downloaded files and download history are not sent to our license server. They remain on the device. The app contains no advertising, analytics or third-party tracking SDK.
Google Play purchase and license
For an optional Pro purchase, Google Play processes payment under Google's terms. The app sends the Google-issued Purchase Token over HTTPS to our Cloudflare backend, which verifies the purchase through the Google Play Developer API.
We store a SHA-256 token hash, the AES-GCM-encrypted token, order reference, package/product identifiers, purchase status, verification/acknowledgement/revocation times and the linked license key. A random installation identifier is stored only as a hash for abuse control. We store no hardware identifier or full payment details.
Purposes and legal bases
Processing supports contract performance, purchase restoration, license verification, fraud prevention, refund/revocation handling and legal retention duties (GDPR Art. 6(1)(b), (c) and (f)).
Recipients and transfers
Google processes purchase/payment data; Cloudflare provides the website, Functions and D1; GitHub provides signed Direct/Windows release files. Where providers process data outside the EEA, their applicable transfer safeguards and privacy terms apply.
Retention
Active purchase/license mappings remain necessary for the contract, restore, refunds and abuse control. Revoked mappings remain only as long as legal duties or claims require. Original electronic Google financial records are conservatively retained unchanged for ten years. Local app data can be deleted in the app.
Your rights
Subject to the GDPR, you may request access, correction, deletion, restriction, portability or object and may complain to a supervisory authority. Mandatory commercial or tax retention can limit deletion. Send requests to the contact above.