Privacy Policy

1. Controller

2. Website delivery and hosting

This static website is operated through Coolify on a server in Nuremberg, Germany, provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Coolify is operated on that server and does not receive data as a separate hosted service.

When you request a page, the server necessarily receives technical connection data. This may include your IP address, request date and time, requested URL, HTTP method and response status, referrer, browser user agent, and the amount of data transferred. The data is used to deliver the website, maintain availability, diagnose errors, and defend against misuse.

The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure, reliable, and efficient operation of this website. Server logs are retained only for the shortest period operationally necessary. They are deleted or anonymised as soon as they are no longer required, unless a specific security incident or legal obligation requires longer retention. Hetzner acts as a processor under Article 28 GDPR; the server location is within Germany.

See Hetzner's privacy policy (opens in a new tab).

3. Cookies, local storage, and analytics

This website does not set cookies, use browser local storage, run analytics or advertising trackers, embed social-media plugins, or load third-party web fonts. No consent banner is required for the website in its current form under § 25 TDDDG. If those technologies are added later, this policy and any required consent mechanism must be updated before they are enabled.

4. Purchases and license management through Polar

Checkout, payment, tax calculation, receipts, subscriptions, renewals, refunds, and the customer portal are provided by Polar Software, Inc., United States. Polar acts as merchant of record and authorised reseller for purchases. When you follow a checkout or portal link, you leave this website and Polar processes the data needed for the transaction under its own Buyer Terms and Privacy Policy. This commonly includes contact and billing details, payment and tax information, order data, and technical connection data.

Polar makes customer, order, subscription, and license information available to the Simple Notch supplier where necessary to provide the product, manage entitlements, prevent misuse, and support customers. For covered supplier data, Polar also acts as a processor under its Data Processing Addendum. The legal bases for processing by the Simple Notch controller are Article 6(1)(b) GDPR for contract performance and pre-contractual steps, Article 6(1)(c) GDPR for applicable legal obligations, and Article 6(1)(f) GDPR for license security and the establishment or defence of legal claims.

Polar and its subprocessors may process data in the United States and other countries outside the EEA. Polar's Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses for transfers without an adequacy decision (Article 46(2)(c) GDPR). Polar retains data according to its own legal and operational requirements. Data available to the Simple Notch supplier is retained only for as long as needed for product delivery, support, license administration, legal obligations, or legal claims, and is then deleted or anonymised where possible.

• Polar Buyer Terms (opens in a new tab)
• Polar Privacy Policy (opens in a new tab)
• Polar Data Processing Addendum (opens in a new tab)

5. License activation in the app

To activate, validate, or deactivate a license, the Simple Notch app communicates directly with Polar's license service. Depending on the action, it sends the license key, Polar organisation and benefit identifiers, the activation identifier, and a device label based on the Mac's local device name. Polar also necessarily receives technical connection data such as the IP address. The app validates an activated license at launch when due and periodically while it is running, normally no more than once every 24 hours.

The purposes are to provide the purchased license, enforce the activation limit of up to three Macs, prevent unauthorised key sharing, and support deactivation. The legal bases are Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. License and trial records are stored locally in the macOS Keychain and are not synchronised to another device. A previously verified license can remain usable offline for up to seven days.

License status is checked automatically, but Simple Notch does not use profiling or automated decision-making within the meaning of Article 22 GDPR. If you believe a license was rejected incorrectly, request a manual review at [email protected].

6. Downloads and update checks through GitHub

Downloads are hosted on GitHub. The app uses the Sparkle updater to request a signed update feed from GitHub once per day by default; automatic checks can be disabled in the app's settings. When you download the app, open a GitHub link, or the app checks for updates, GitHub receives technical connection and usage data such as the IP address, request time, device or browser information, and requested resource.

These requests are necessary to deliver the download and provide secure updates (Article 6(1)(b) GDPR) and serve the legitimate interest in maintaining a secure and current application (Article 6(1)(f) GDPR). GitHub may process data outside the EEA. GitHub states that it uses the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses for relevant transfers.

See the GitHub Privacy Statement (opens in a new tab).

7. Support by email

If you contact support, the sender address, recipients, date and time, subject, message content, attachments, and related technical metadata are processed to answer your request. The legal basis is Article 6(1)(b) GDPR where the message concerns a purchase, license, or pre-contractual request, and otherwise Article 6(1)(f) GDPR based on the legitimate interest in responding to enquiries and operating support. The email providers used by the sender and recipient are recipients of the data to the extent necessary to transmit and store the message.

Support correspondence is deleted when the request is completed and no contractual, statutory retention, security, or legal-claims purpose requires further storage. Messages that qualify as business or tax records are kept for the applicable statutory retention period.

8. Recipients and disclosure

Personal data is disclosed only where necessary to the processors and independent providers described above, to professional advisers bound by confidentiality, or to public authorities where disclosure is legally required. Personal data is not sold and is not used for behavioural advertising.

9. Your rights

Subject to the applicable legal requirements, you have the right to:

• access your personal data (Article 15 GDPR);
• rectify inaccurate data (Article 16 GDPR);
• erase data (Article 17 GDPR);
• restrict processing (Article 18 GDPR);
• receive data in a portable format where Article 20 GDPR applies;
• object to processing based on legitimate interests (Article 21 GDPR); and
• withdraw consent at any time for future processing, if processing is based on consent.

To exercise these rights, email [email protected]. You also have the right to lodge a complaint with a supervisory authority under Article 77 GDPR. The authority responsible for the controller's location is:

10. Changes to this policy

This policy will be updated when processing activities, service providers, or legal requirements change. The current version and update date are published on this page.