Privacy Policy

What we collect

When you sign in with Google or GitHub we receive your email address, display name, and avatar URL. We do not receive your password and never see it.

When you buy a licence we store the domains and licensee name you supplied, the licence keys issued to you, and a record of the transaction. Card details go directly to Paddle — we never see or store them.

We keep a request log and an audit log recording actions taken on your account, including a truncated IP address (the last part is removed) and browser user agent. This is what makes it possible to answer "what happened to my key" and to detect account abuse.

Why we are allowed to

Performing our contract with you: issuing, delivering and renewing licences, and providing support.

Legitimate interests: keeping the service secure, preventing fraud, and keeping records that let us investigate problems.

Legal obligation: tax and accounting records, which Paddle holds as merchant of record.

Consent: analytics cookies in Europe. You give or refuse it in the banner on your first visit, and can withdraw it at any time — withdrawal takes effect immediately and does not affect what was collected beforehand.

Who else sees it

Paddle.com Market Ltd — payment processing, invoicing and tax, as merchant of record.

Resend — sending transactional email (your licence keys and account notices).

Hetzner — hosting, in Germany. Data is stored in the EU.

Google Analytics (Google Ireland Limited) — aggregate traffic measurement on this website: which pages are visited, and roughly where visitors arrive from. We send it no identifiers: your email address, account and licence details never reach it.

We use no advertising networks. The packages themselves contain no telemetry — analytics run on this website only, never in the software you ship.

How long we keep it

Account and licence records: for as long as you have an account, and then for as long as needed for tax and legal records.

Audit and request logs: retained so support and security questions can be answered after the fact, then deleted.

If you delete your account we remove your personal details. Financial records and audit entries are retained where the law requires it, and the audit trail deliberately keeps a snapshot of the email address associated with past actions so the record stays coherent.

Your rights

If you are in the UK or EEA you can request access to your data, correction, deletion, restriction, portability, or object to processing. Write to us and we will respond within one month.

You can also complain to your local data protection authority.

Contact: [email protected], or write to Eliran Brami, Ibn Gabirol 5/3, Hetzelia, Israel.

Cookies

Two cookies are strictly necessary and neither is used for tracking: a session cookie that keeps you signed in, and a CSRF token that protects that session from forged requests.

Google Analytics cookies (_ga and _ga_*) count visits and recognise a returning browser. In Europe they are set only if you accept them: until you do, the tag stores nothing on your device and reports the visit without an identifier. They measure traffic in aggregate, are never used for advertising, and are not linked to your account or your licences.

You can change your mind whenever you like through the Cookie settings link at the bottom of every page. Declining costs you nothing — the site behaves identically either way.

If you are in the EEA or the UK these are not set unless you accept them. We ask with a banner on your first visit, nothing is stored on your device while you decide, and declining leaves the site working exactly as it did. Elsewhere they are set by default.

You can change your mind at any time through the “Cookie settings” link in the footer of every page — withdrawing is one click, the same as agreeing was. A browser tracking blocker or Google’s official opt-out add-on also stops them being set.