Privacy Policy

1 · Controller and contact

The controller under the General Data Protection Regulation (GDPR) is:

Bent Eisheuer
Freisinger Landstraße 47a, 85748 Garching, Germany
Email: legetdev@gmail.com

2 · Your rights

Subject to the statutory requirements, you may request access (Art. 15 GDPR), correction (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), or object to processing based on legitimate interests (Art. 21). You may withdraw consent with future effect where processing relies on consent. Contact us at legetdev@gmail.com.

You may also complain to a data-protection authority. Our competent authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach. We may need proportionate information to identify the record involved in a request, particularly where we hold only a pseudonymous trial hash.

3 · Local file operations

Filox processes selected files on your Mac. Files, filenames, and file contents are not sent to us for those operations. The app has no user account and no usage analytics. This does not mean the app makes no network requests: the limited update and trial flows below are separate from file processing.

4 · Website delivery and security

Vercel Inc. hosts this website and acts as our processor for delivery, security, and related infrastructure. When you request a page or download, Vercel necessarily processes connection data such as IP address, request time, requested path, browser information, and security signals. The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in securely providing the website and downloads.

5 · Website measurement

We use Vercel Web Analytics and Vercel Speed Insights for aggregate page traffic and performance measurement. They operate without advertising cookies, persistent browser identifiers, or cross-site tracking. Data can include page URL, referrer, broad country, browser/device category, and Web Vitals. IP addresses are necessarily processed in transit and for coarse location/security handling, but are not used by us to build a visitor profile. The legal basis is Art. 6(1)(f) GDPR: improving the reliability and usability of this site.

6 · Cookies and device access

This site sets no cookies and the analytics described above do not write to or read from local storage, session storage, or similar browser storage. The site therefore performs no non-essential storage or access requiring consent under § 25 TDDDG. We do not show a consent banner because there is no consent-requiring technology to accept or reject. If that changes, the new technology will remain blocked until any legally required consent has been obtained.

7 · Update checks

Sparkle checks https://filox.app/appcast.xml for app updates. The request reveals standard connection data, including the IP address, to the website host. It does not contain your files, filenames, file contents, or a Filox account identifier. The legal basis is Art. 6(1)(f) GDPR: providing secure and current software.

8 · Pseudonymous trial anchor

During the 7-day DMG preview, the app derives a one-way, app-specific SHA-256 hash from the Mac hardware identifier and sends only that hash to a Cloudflare Worker. The raw hardware identifier stays on the Mac. Cloudflare stores the pseudonymous hash with the server-side trial start time in KV storage so reinstalling cannot create a new preview. The record is not anonymous under data-protection law, and we do not use it to identify, profile, or track you across products.

Cloudflare, Inc. acts as our processor for this service. The legal basis is Art. 6(1)(f) GDPR: preventing repeated preview resets while offering no-account access. The record is retained while needed to enforce the one-preview-per-device rule and is removed when the trial service is retired or the record is no longer required for that purpose. A failed network request does not send file data.

9 · Support email

If you email us, we process your address, message, attachments, and related metadata to answer the request. The legal basis is Art. 6(1)(b) GDPR for contract or pre-contract support and otherwise Art. 6(1)(f) GDPR for responding to enquiries. Google provides the Gmail mailbox and processes this data under its applicable service and data-protection terms.

10 · International transfers

Vercel, Cloudflare, Google, and, when sales are live, the Merchant of Record may process data in the United States or other countries. Where required, transfers rely on an applicable adequacy decision, including the EU–US Data Privacy Framework for certified recipients, and/or the European Commission's Standard Contractual Clauses. Information about the safeguard applicable to a specific transfer is available on request.

11 · Retention

Hosting and security logs are retained according to the shortest period available for delivery, abuse prevention, and incident investigation. Aggregate analytics and performance data are retained according to the active Vercel plan settings and deleted when no longer needed for trend analysis. Support messages are kept until the enquiry and any related legal obligations are resolved. Trial-anchor retention is described in section 8. Statutory accounting records are retained for the periods required by German law when paid sales begin.

12 · Automated decisions and changes

We do not make decisions based solely on automated processing that produce legal or similarly significant effects within Art. 22 GDPR. We update this notice before materially changing the stated purposes, recipients, or product data flows.

Contact

Privacy questions and requests: legetdev@gmail.com. See also our Imprint.