Privacy Policy

This page covers the website at formbar.app, the download host at dl.formbar.app, and the mail we send you. Those three are its whole subject, and the Formbar app itself runs on your own Mac. Everything below comes from you, from your browser, or from the act of reaching our servers, and those three are the whole list of where it comes from.

When you read the site

Reaching our servers means your browser tells them who to answer. Cloudflare sits in front of the site and answers first, then passes the request on to the server we rent from Hetzner. Both record the request: your IP address, the date and time, the page you asked for, the response we sent, and your browser's own user agent string.

We use those records to serve the page, keep the site up, and see an attack when one arrives. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in running a site that answers and stays standing. We keep them only as long as running and securing the site needs, and they stay request records, each tied to its own request.

Both Cloudflare and Hetzner act only on our instructions, under a processing contract.

When you download Formbar

The download is served from dl.formbar.app, a Cloudflare-hosted address. Asking for that file tells Cloudflare your IP address, the file you asked for, and the time, the same way any file delivery works. The legal basis is Article 6(1)(b) GDPR, because you asked us for the file, and Article 6(1)(f) GDPR for keeping delivery secure.

When you sign up for the newsletter

You leave your email address, and the address is the whole of what you give us. We store the address, the state of your sign-up, the times it changed state, and tokens unique to you behind the confirm, unsubscribe, and export links your confirmation email carries.

The form starts the sign-up, and your press on the confirmation link is what joins the address to the list. We send one email carrying that link. This is German law's double opt-in requirement, and it is also what keeps a stranger from putting your address on our list.

The legal basis for the list itself is your consent, Article 6(1)(a) GDPR. The legal basis for keeping the record of that consent is Article 6(1)(c) GDPR, because we have to be able to show that you asked.

We keep a confirmed address until you unsubscribe. One press in any message we send ends it. An unsubscribed address rejoins on a fresh sign-up and a fresh confirmation press alone, so putting you back on the list always takes your own press. Ask us and we delete the row outright.

Consent arrives with your confirmation press. An address still waiting on that press is deleted automatically once its confirmation link expires. Write to us and we remove it sooner.

Your confirmation email carries a personal link that lets you download every record we hold about your newsletter subscription at any time, secured by a token unique to you that serves that one link alone.

We use your address to send you the mail you asked for, and Maileroo delivers it on our instructions. That pair is the whole list of who ever holds it.

The mail we send you

Mail we send is delivered through Maileroo, under a processing contract. Maileroo sees the address it delivers to and the message itself, and acts only on our instructions. The legal basis depends on the mail. For the newsletter it is the same consent that put you on the list. For a seat invitation it is Article 6(1)(f) GDPR. That interest is ours and the inviting organisation's, in reaching the person a seat was assigned to. For a request to accept a team deal it is Article 6(1)(b) GDPR, because your organisation asked us for the deal.

What we keep on your device

Five things, and only five, and the third is there only once you sign in.

Your privacy choice. A cookie named formbar-cookie-consent records which categories you allowed, so the banner stops asking. It lasts a year, and your choice is the whole of what it carries. It is strictly necessary under § 25 Abs. 2 TDDG, so your answer to the banner alone sets it. The legal basis for handling what it holds is Article 6(1)(c) GDPR, because we have to be able to show what you allowed. Change the choice any time through Cookie settings in the footer.

Light or dark. Your appearance choice is kept in your browser's own local storage. Which appearance you picked is the whole of what it carries. It is strictly necessary under § 25 Abs. 2 TDDG, so your choice of appearance alone sets it and it sits outside every consent category. It stays on your device, and your browser alone reads it, so it sits outside Article 6 GDPR.

Staying signed in. Signing in sets a cookie named payload-token, and it is what keeps you signed in as you move from page to page. It holds a signed session token: which account it belongs to, the address you signed in with, and which session it is. Those three are the whole of it. It lasts two hours, and signing out clears it at once. The server alone reads it, and it stays on this site. It is strictly necessary under § 25 Abs. 2 TDDG, so your sign-in alone sets it and it sits outside every consent category. The legal basis for handling what it holds is Article 6(1)(b) GDPR, because you asked us for an account.

Your referral link. Following someone's referral link to this site sets a cookie named formbar-referral-code, so a sign-up you make afterwards still credits the link you followed, and the code fills itself in. It holds the code the address carried, and that code is the whole of it. It lasts 30 days from the referral link you most recently followed, and typing a code yourself at sign-up always overrides it. It is strictly necessary under § 25 Abs. 2 TDDG, so following the link alone sets it and it sits outside every consent category. The legal basis for handling what it holds is Article 6(1)(f) GDPR, our interest and the referrer's in crediting the link that brought you here.

Your gift link. Opening a shared gift link sets a cookie named formbar-gift-code, so a sign-up you make afterwards still lands its months on the account you create, and the code fills itself in. It holds the code the address carried, and that code is the whole of it. It lasts 30 days from the gift link you most recently opened. It is strictly necessary under § 25 Abs. 2 TDDG, so opening the link alone sets it and it sits outside every consent category. The legal basis for handling what it holds is Article 6(1)(b) GDPR, because the months it lands are ones you asked to redeem.

Those five are the whole of what this site keeps on your device, and each one of them is strictly necessary. An advertising cookie, a tracking pixel and a cross-site identifier would each be a sixth.

Error diagnostics, only if you allow them

Everything under Analytics waits for you to turn it on. Your acceptance is the one thing that starts the diagnostics code.

Allow it and the site reports a crash or a broken page to an error tracker we host ourselves, on our own servers. Our own servers are where the report stays. A report carries the error, the page it happened on, your browser and operating system version, and your IP address, which the tracker needs to receive the report at all.

Session replay is switched off in the code. Your screen, your typing and the contents of a form all stay with you.

The legal basis for reading and writing on your device is your consent, § 25 Abs. 1 TDDG. The legal basis for handling what the report contains is Article 6(1)(a) GDPR. Withdraw it through Cookie settings in the footer, and the diagnostics stop for every page you load afterwards.

When you write to us

Write to [email protected] and we hold your message, your address, and whatever else you put in it, for as long as answering you needs and as long as the law makes us keep correspondence.

The legal basis is Article 6(1)(f) GDPR, our interest in answering the people who write to us, and Article 6(1)(b) GDPR where your message is about a contract.

Your Formbar account

A Formbar account is one of those categories. Its record holds the email address you sign up with, your password as a one-way hash, whether that address is confirmed, the one-time tokens behind the confirm and password-reset links, the sessions that keep you signed in, and the dates the record was created and last changed. Every account also carries its own referral code, minted once at sign-up, and belongs to one organisation, created alongside it. Accepting a seat another organisation assigned you moves your account into that organisation, and the one you left stays. When the team admin reclaims your seat, your account moves back to the organisation you left, or to a new one of its own, and keeps its sign-in. The record then carries the moment of that reclaim, so your account page can tell you when your Mac catches up, until you take a seat again. Your organisation carries its own creation date, the plan it is on, the seats that plan holds, how many of them are assigned, and the VAT identification number you give it, if you give it one. If your organisation is a team that agrees a sales deal with us, it also carries the team name we type when we record that deal. Every account of the team reads that name, and we alone change it. Signing up with a valid referral code links the new account to the account that owns it, recorded once at creation and fixed from then on. An invalid code leaves the new account standing on its own. The record also carries the state of your subscription and the date its access ends. Both stay empty until you buy, and a message from Paddle sets them when your purchase settles. Your first charge also writes the handle Paddle issues for you as its customer, and the record keeps that handle so every later charge names the same customer there. The plan sits on your organisation, and every account in that organisation reaches the same one. Your record holds the groups we have added it to, and we read the plan and the groups together to decide which features your account reaches. The legal basis is Article 6(1)(b) GDPR, because you asked us for an account. Deleting an account removes every link it carries, on either side, along with everything else the record holds, and the organisation too, once the last of its accounts goes.

Signing up records your consent to this page, as two more fields on your account record: the date and time you consented, and which version of this page stood at that moment. The legal basis is Article 6(1)(b) GDPR, because you asked us for an account. Deleting your account removes both fields, the same moment it removes the account itself.

Your account can also carry a mark for review. A chargeback is a payment taken back from us after a purchase settled. When Paddle tells us one landed on an order you placed, we mark the account that placed it and record the date. We set the same mark when Paddle declines a refund we asked for on an order you placed, so that one of us follows the refund up by hand. The mark is two more fields on your account record: whether it stands, and the date it was set. Those two values are the whole of it. The legal basis is Article 6(1)(f) GDPR, our interest in refusing a purchase whose payment was taken back, and in paying back a refund we owe you. We alone lift the mark or uphold it, and we do it by hand, so every page on this site leaves both fields as they stand. We keep the mark for as long as your account exists. Deleting your account removes both fields, the same moment it removes the account itself.

Your account can also be banned, when we decide by hand that it has abused the service. Banning it ends every plan your organisation holds. That is us ending the contract for good reason, so you get back the unused part of the term you paid for, as the sale terms state. The record of each plan stays as it was written, and a second record beside it notes that the ban ended it. The ban also marks the device your free month ran on, using the same one-way value the free-month section below describes, so a fresh account on that device meets the same refusal. The ban is two more fields on your account record: whether it stands, and the date it was set. Those two values are the whole of it. The device mark sits in its own record, carrying that one-way value and the date it was set, and those two are the whole of that record. The legal basis is Article 6(1)(f) GDPR, our interest in refusing service to an account that abused it. We alone set the ban or lift it, and we do it by hand. Deleting your account removes both fields on your account record, the same moment it removes the account itself. The device mark stays regardless, because it belongs to the device, and lifting the ban leaves every plan it ended where it stands.

Your account also holds a credit ledger: a running history of the months credited or debited to it. Each entry carries the number of months, the unit it counts, and the reason it was written, and it stands as written from then on, for us as much as for you. The legal basis is Article 6(1)(b) GDPR, because you asked us for the account the ledger belongs to. Deleting your account removes every entry its ledger holds, the same moment it removes the account itself.

Your organisation holds a seat assignment for every colleague you assign one of its seats to, until that person takes the seat. The record carries their email address, the organisation the seat belongs to, the date you assigned it, and when its invitation was last sent, and those four are the whole of it. The last-sent time lets you see when it went out and holds a resend for ten minutes. Claiming, accepting or reclaiming the seat removes it. The legal basis is Article 6(1)(f) GDPR, our interest and yours in filling a seat you paid for. When the last account of your organisation is deleted, every seat assignment it holds goes the same moment as the organisation itself. While other accounts remain, the organisation and its seat assignments stay for them, and the seat the deleted account held becomes free.

Accepting a seat from the account you already hold moves that account into the team that assigned it, and writes one record of the move. It carries your account, the team you joined, the organisation you left, the free month it ended if one was running, and the moment you accepted. Accepting the team deal of your own organisation writes the same record, and it then names the deal it put in force. If you left a paid plan behind, it also carries the refund we worked out at that moment: the amount, the currency, the whole days left, the days paid, and the entitlement it covers, along with the moment Paddle agreed to stop that plan renewing, or the reason it gave for refusing. Those are the whole of it. The legal basis is Article 6(1)(b) GDPR, because you asked us to move your account and to refund what your plan had left. We keep the record for as long as your account exists. Your account export carries it, and deleting your account removes it the same moment it removes the account itself.

If your business is registered for value added tax, you can give your organisation its VAT identification number. We hold that number, and the number is the whole of it: the company name and the address stay with you. You give it to us, we take it as you typed it, and the field is yours to leave empty. We hand it to Paddle with your order, because Paddle is the seller, and Paddle alone decides how your purchase is taxed and what your invoice says. The legal basis is Article 6(1)(b) GDPR, because you asked us for the subscription. We keep the number for as long as your organisation exists, and you can change it or clear it yourself at any time. On a team, its admin alone does this. Your account export carries it, and deleting your account removes it the same moment it removes the organisation itself.

When you sign in from your Mac

Signing in from Formbar on your Mac writes one more record, the Mac record. Formbar sends us an identifier for the Mac it runs on, once, the first time you sign in there. We turn it into a one-way value the moment it arrives, using a secret only our own server holds, and that value is what the record carries. The turning works one way, so the value recognises the same Mac again and stops there. Beside it the record holds the account it belongs to and the date it was written, and those two are the whole of it. You get one Mac record, and it stays the one, whichever Mac you sign in from afterwards. We hold it so a free month has a Mac to run on, and that is the only thing we ever use it for. The legal basis is Article 6(1)(b) GDPR, because you asked us to sign this Mac in. We keep it for as long as your account exists. Your account export carries it, and deleting your account removes it the same moment it removes the account itself.

Signing in with Formbar waiting also writes a hand-off record, so your Mac can pick up the sign-in you just finished in the browser. It holds the account it signs in, a one-way value standing for the one-time code your Mac receives, and the moment that code stops working. Those three are the whole of it, and the code itself stays with your Mac. It is deleted the moment your Mac uses the code, and signing in again clears whatever is left, so you hold at most one at a time and it lives for minutes. The legal basis is Article 6(1)(b) GDPR, because you asked us to sign this Mac in. Your account export carries whatever is standing when you ask, and deleting your account removes it the same moment it removes the account itself.

When you start your free month

The free month runs once per Mac, so we have to be able to tell one machine from another. Starting your month copies the one-way value the Mac record above already holds, and that copy is all it sends. The turning works one way, so the value recognises the same Mac asking again and stops there. Beside it the record holds the account that started the month and the two dates the month runs between, and those three are the whole of it. Accepting a seat on a team ends a running month at that moment, and the record then holds that moment as its end. We hold it so that a second free month on the same Mac is refused, and that is the only thing we ever use it for. The legal basis is Article 6(1)(b) GDPR, because you asked us for the free month, and Article 6(1)(f) GDPR for refusing a second one, our interest in giving every Mac exactly one free month. We keep the record for as long as your account exists, and it outlives the month itself, because refusing the second one is what it is there for. Your account export carries it, and deleting your account removes it the same moment it removes the account itself.

When you buy a subscription

Buying a subscription writes three more records. The order holds the price of what you bought, what you were actually charged, the currency, and the reference Paddle issued for it. When we ask Paddle to refund part of that charge, the order also holds the refund: the amount, whether it is pending, refunded or declined, the reference Paddle issued for the refund, when we asked, when Paddle answered, and the reason Paddle gave for a decline. Beside it we keep every payment message Paddle sent us about that order: what it told us, when it reached us, and when we acted on it. The third record is the entitlement itself: which plan your organisation is on, how many seats that covers, the dates it runs between, and the handle Paddle issues for the subscription behind it. The legal basis for all three is Article 6(1)(b) GDPR, because you asked us for the subscription. The price you paid and the reference stay on the order for as long as your account exists. Deleting your account removes the order and its payment messages, the same moment it removes the account itself. The entitlement belongs to your organisation, whichever account paid for it. It goes when your organisation goes with its last account. While other accounts remain, it stays in force for them, with the same plan, seats and dates, and its pointer to the order and its subscription handle both clear.

If your organisation is a team, we record which one of its accounts is the team admin who manages its seats. The record is a single pointer from the organisation to that account, and it holds only the current admin. The role grants a plan only through a seat the admin takes, like any other account of the team. The legal basis is Article 6(1)(b) GDPR, because your organisation asked us to manage its seats this way. When the role moves to another account or ends, the pointer moves with it or clears, and the earlier holder is forgotten. A team admin hands the role to another account of the team before deleting its own account, while other accounts remain.

If your organisation agrees a sales deal with us, we keep one deal record for it. The record carries the organisation it belongs to, the seat minimum it pays for each term, the seat rate for one term, the currency, the billing term with its months and its rebate, the term price, whether its status is in force or awaiting acceptance, a pointer to the grant of plan and seats it produced, and the creation date and last change date of the record. When we renegotiate the deal, the record also keeps the pending rate waiting for the next bill and the earlier figures a change ended, newest first. The new rate and the new minimum we type to record a change land only in those two figures. Those are the whole of it. The legal basis is Article 6(1)(b) GDPR, because your organisation asked us for the deal. We keep the record for as long as your organisation exists. Removing the organisation removes its deal record the same moment.

If your organisation already pays for a plan when it agrees a sales deal with us, the deal waits for you to accept it, and we email your address a request to accept it. We hold that request as a record carrying your address, your organisation, the date we recorded it, and when we last sent it, and those four are the whole of it. Your account, your organisation and your plan stay as they are until you accept it signed in. Accepting removes the request, makes your account the one that manages the seats of the team, holding one of them, puts the deal in force, stops your plan renewing and refunds its unused days. The legal basis is Article 6(1)(b) GDPR, because your organisation asked us for the deal. Deleting your account removes the request the same moment it removes your organisation and its deal.

When you apply to the affiliate programme

Applying to the affiliate programme writes one record, and your account holds at most one of them. It carries the name you are liable under, the contact person where that name is a company, the postal address and country you gave, and either your date of birth or your statement that you are of age. It carries how you stand for tax, which is a VAT identification number, or a German tax number together with the small-business status under § 19 UStG, or your statement that you apply as a private person. It carries the IBAN and the account holder a payout is sent to, the bank identifier where that account sits beyond the reach a SEPA transfer addresses by IBAN alone, and the one place you said you would refer from. Your email address stays on your account record, which this record points at. The legal basis is Article 6(1)(b) GDPR, because you asked us to consider you for the programme, and Article 6(1)(c) GDPR for the tax details the law requires us to hold. We keep the record for as long as your account exists. Your account export carries it, and deleting your account removes it the same moment it removes the account itself.

Accepting the affiliate agreement writes one record for each acceptance, and your account keeps every one of them. It carries the version you accepted, the wording of that version exactly as you read it, a one-way value standing for that wording, the moment you pressed, the address your connection reached us from, and that you accepted the self-billing consent and the advertising disclosure duty along with the agreement. We hold the wording and the value beside it because the law lets us conclude this agreement in text form under § 126b BGB, and that means being able to show years later the exact wording you agreed to. Objecting to self-billing writes a second record, and it carries your account and the moment you objected, and those two are the whole of it. The legal basis is Article 6(1)(b) GDPR, because the agreement is one you asked to enter, and Article 6(1)(c) GDPR for the credit notes the law requires us to raise correctly. We keep both for as long as your account exists. Your account export carries them, and deleting your account removes them the same moment it removes the account itself.

Every payout we raise out of your affiliate balance writes one record, and your account keeps every one of them. It carries the entries it settled, the amount, whatever tax applies to it, the total that reaches your bank, the currency, the number and kind of the document we raised, and, once the transfer has left, its reference and date. It also carries whether the email with its document has gone out, how many tries that took, and when. Your address and your bank account stay on your application record, which this one points at, and the document we send you is written from there. The legal basis is Article 6(1)(b) GDPR, because the payout is what the affiliate agreement promises you, and Article 6(1)(c) GDPR, because the law requires us to raise the document correctly. We email you every document within minutes of raising it. Its foot states the ten years § 147 AO and § 14b UStG set for keeping it. If our mail server refuses the email, we try again later, up to eight tries in all over about 32 hours. Each try writes one record of its own. It carries when the try started, how it ended, and, where it failed, the error behind it, with any email address in that error removed. Where one of us sends the email again by hand, it also carries which of us did and when. We keep the payout record, and these records beside it, for as long as your account exists, on the same legal basis. Your account export carries them, and deleting your account removes them the same moment it removes the account itself. We also keep our own copy of every document we raise, in a record of its own. It holds the document as we sent it, and the details § 14 UStG requires such a document to state. Those are its number and kind, the dates of issue and of supply, and what it settled. They also cover the amounts, the currency, and the tax rate or the exemption that applied. They also cover the name, address, tax number and VAT identification number of both parties, as the document printed them. Beside those, it holds the date its term ends, and those are the whole of it. We alone read it, and it stays exactly as we raised it. The legal basis is Article 6(1)(c) GDPR, because § 147 AO and § 14b UStG require us to keep it. The term is ten years, counted from the end of the year we raised the document. Deleting your account leaves this copy standing for that term, as Article 17(3)(b) GDPR allows. Once the term ends, we delete it automatically. The copy already with you stays yours.

When you sync a configuration

A configuration is the set of rules your bar runs by: how it behaves. A paid plan can keep a copy of one here, so you can read back what you kept. It reaches us once you turn sync on, and you turn it on for each configuration separately. Turn it off again and that configuration's last sync is the last we hear of it. A configuration covers behaviour alone, so the applications you run, the groups you made and the windows you have open all stay on your Mac. So the record describes your rules, and what you were doing with your programs stays your own. Beside the configuration itself, the record holds the account that sent it and the dates it was created and last changed. If your configuration names a picture you chose for your bar, we can hold a copy of that picture too, so a link you mint for your configuration can carry it along. The legal basis is Article 6(1)(b) GDPR, because you asked us to keep it for you. We keep what you synced, and any picture that came with it, for as long as your account exists at most. Your account export carries every configuration you have synced, and deleting your account removes them, and every picture stored beside one, the same moment it removes the account itself.

If someone assigned you a seat

Someone may assign you one of their organisation's seats, before you have a Formbar account or once you hold one. We then hold a record of that seat. It carries your email address, the organisation the seat belongs to, the date it was assigned, and when its invitation was last sent, and those four are the whole of it. The last-sent time lets the person who assigned the seat see when it went out and holds a resend for ten minutes. Claiming, accepting or reclaiming the seat removes it. Your address came from the person who assigned the seat, and that person is its only source. We hold it so that signing up with that address, or accepting the seat from the account you already hold, puts you on that seat. The legal basis is Article 6(1)(f) GDPR, our interest and theirs in filling a seat they paid for. We keep the record while the organisation holds that seat for you. Deleting the account that assigned it removes the record the same moment, and writing to [email protected] removes it sooner. Every right below is yours over this record from this moment, whatever you decide about taking the seat.

Who else sees any of it

Cloudflare sits in front of every request to the site and every download. Hetzner operates the servers we rent, and everything stored on them passes through their hands as the operator of the machines. Maileroo delivers the mail we send you, seeing the address and the message. Each of the three acts on our instructions, under a processing contract under Article 28 GDPR. One more company receives something, and it decides for itself what it does with it.

Paddle takes the payment when you buy a subscription. Paddle is the merchant of record, which makes it the legal seller of what you buy. We hand it the amount to charge, the currency, and the email address your account is confirmed on. Paddle keeps that address as a customer of its own, so its checkout opens on the address you already hold and every later charge names the same customer there. You give it your country and your payment details at its own checkout, and it hands us back a reference. Paddle calculates the tax, remits it, and issues your invoice, because the law puts those duties on the seller. It decides for itself how it does all of that, so it is a recipient in its own right. The legal basis is Article 6(1)(b) GDPR, because you asked us for the subscription, and Article 6(1)(c) GDPR for the tax and the invoice the law requires. Paddle, the three above, and the register named next are the whole list.

The European Commission runs the register the member states answer VAT identification numbers through. Applying to the affiliate programme as a business holding such a number sends that number to the register, together with our own, and the register answers whether the number stands, a consultation number for the enquiry, and whatever trader details the issuing member state discloses. We store that answer on your application as the evidence the enquiry happened. The legal basis is Article 6(1)(c) GDPR, because the law requires us to hold a confirmed identification number for a business we pay.

Some of that processing happens outside the European Union. Where it does, it rests on the European Commission's standard contractual clauses, or on an adequacy decision covering the recipient. Ask us and we send you the safeguard that covers a given transfer.

Automated decisions

Every decision about you is one we make by hand, which is what Article 22 GDPR asks us to tell you. What we hold about you stays with us, for good.

Giving us any of this is voluntary. Every field is yours to leave empty, by law and by contract alike, and the site keeps working either way. Leave the newsletter field empty and the one consequence is a quiet inbox.

Your rights

Every right below is yours under the GDPR. We answer at our own cost, and you keep your reasons to yourself. See what we hold (Article 15): ask, and we send you every piece of data we hold about you, along with what we do with it. Correct it (Article 16): tell us what is wrong and we fix it. Have it deleted (Article 17): ask, and we delete it, unless a law makes us keep it, and we tell you which law if one does. Freeze it (Article 18): tell us to stop using it while something is in dispute, and we keep it as it stands. Take it with you (Article 20): we hand you what you gave us in a machine-readable file, and send it straight to another provider if you want that. Withdraw your consent (Article 7(3)): anything we did on that consent before you withdrew it stays lawful, and everything after it stops.

Write to [email protected] to use any of them. We answer within a month, and we tell you inside that first month if a request is complicated enough to need longer.

Four of them you do yourself, with one visit or one press. Downloading your account records takes one signed-in visit to formbar.app/api/users/export. The file it sends opens in any spreadsheet, and it holds your account record, your organisation row, every entry in your credit ledger, every order you placed, every payment message about one, every entitlement granted to your organisation while you are its team admin, the record of any free month you started, the record of every seat you accepted, the Mac record for the Mac you signed in from, any sign-in hand-off still standing, every configuration you have synced, every picture stored beside one, the affiliate programme application you made, and every payout we raised on your affiliate balance, with every try to email its document. Your password, your tokens and your sessions stay on our own server, where the server alone reads them. Deleting your account takes one signed-in visit to your Security page, where the password you sign in with and one deliberate confirmation are all it asks for. Ending the newsletter takes one press in any message we send you. Changing what you allow takes one press on Cookie settings in the footer.

Your right to object

Article 21 GDPR gives you the right to object, at any time, to every processing we do on the ground of a legitimate interest under Article 6(1)(f) GDPR. Object and we stop, unless we can show compelling grounds that override your interests, or the processing is there to bring or defend a legal claim.

Complain (Article 77): a supervisory authority is open to you, on its own or alongside coming to us. That includes the authority where you live or where you work.

Send an objection to [email protected]. We answer at our own cost, and an email is the whole of what it takes.

Changes to this page

We rewrite this page when what we do changes, and we say so when we do. The version marked below the heading names the edition you are reading, and your own account keeps the version you consented to.