Privacy

Controller

Website access and hosting

When you access the website, the web server processes connection data required for technical operation. This includes your IP address, time of access, requested address, amount of data transferred, referrer and information about your browser and operating system. We need this data to deliver the website, diagnose errors and prevent attacks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the service. Log data is retained only for as long as required for operation, security and error analysis.

The website is hosted by dogado GmbH, Antonio-Segni-Straße 11, 44263 Dortmund, Germany. dogado processes the data required for hosting on our behalf.

Technically necessary storage

Drupal and the shop may store technically necessary session information in your browser, for example for the basket, checkout, language and security functions. This storage is required to provide the functions you explicitly request (section 25(2) no. 2 TDDDG). Depending on the function, the subsequent processing is based on Article 6(1)(b) or (f) GDPR.

We currently do not use analytics, advertising or social-media trackers on this website.

Download, order and licence delivery

You can use the free download without a customer account. If you buy Pro, we process the contact and billing details entered at checkout, your order, payment status and the record of your consent to the immediate delivery of digital content. We use this information to generate and provide your licence key.

This processing is necessary to perform the contract and take steps before entering into a contract (Article 6(1)(b) GDPR). We retain order and invoice data as required by commercial and tax law. Beyond that, we keep it only for as long as required for the contract, support or the defence of legal claims.

Payments through Stripe

We use Stripe for paid orders. For users outside the Americas, the contracting entity is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes the contact, billing, payment, transaction, device and connection data required for the payment method you select. Stripe may also use data to prevent fraud and process refunds or payment disputes.

Payment credentials such as complete card or account details are processed by Stripe. They are not displayed to us in plain text and are not stored on our server. We receive the payment status, a transaction reference, the payment method and the information required for the order and its records.

Processing is necessary to perform the contract (Article 6(1)(b) GDPR). Where data is processed to prevent fraud and misuse, this is additionally based on Article 6(1)(f) GDPR. Our legitimate interest is secure payment processing and the prevention of unauthorised transactions.

Stripe operates globally and may process data outside the European Economic Area. Stripe identifies adequacy decisions, EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework as transfer mechanisms.

Stripe privacy · Stripe Data Processing Agreement

Licence activation and updates

When a Pro licence is activated and checked periodically, the app sends the licence key or licence ID, a pseudonymous hash derived from the device identifier and the app version. We record activation and update times to provide the licence, enforce the agreed number of personal Macs and prevent misuse.

The device identifier itself is not stored and cannot be reconstructed from the stored hash. File names, paths, file contents and scan results are not transmitted during licence checks.

The legal basis is Article 6(1)(b) GDPR. We also process security and rate-limit data on the basis of Article 6(1)(f) GDPR. We delete activation data when it is no longer required for the licence and no statutory or legal grounds require further retention.

When the app checks for updates, the connection data described under ‘Website access and hosting’ is also processed.

Local storage analysis

Storage Intelligence processes storage scans, file lists, hashes, comparisons and cleanup plans locally on your Mac by default. This data is not transmitted to us. Changes to the file system are performed only after your explicit confirmation.

Optional AI features

The AI advisor is switched off by default. You decide whether to use a local provider such as Ollama or LM Studio, or OpenAI or Anthropic with your own API key.

When using OpenAI or Anthropic, the app sends compact analysis facts directly to your chosen provider. These may include the names of the largest findings, sizes, categories, risk levels and proposed actions. Full file trees and file contents are not transmitted. Path hints are included only if you explicitly enable them.

We receive neither your API key nor the request sent to the provider. The app stores API keys in the macOS Keychain. The selected provider's terms and privacy notice apply to its processing.

Contact and support

If you contact us by email or phone, we process your details to handle the request. For product- or contract-related enquiries, the legal basis is Article 6(1)(b) GDPR; otherwise it is Article 6(1)(f) GDPR. We delete the data once the enquiry has been resolved unless retention or documentation obligations require otherwise.

Feedback and bug reports

When you report a bug or idea through our forms, we store the type, title and content of the report and, optionally, the app version, macOS version and your email address. Every report receives a reference and is stored in our non-public Drupal feedback inbox.

We use this information to reproduce bugs, prioritise requests and plan product development. Please do not submit personal file names, full paths, file contents or other confidential information. We only need an email address if we may contact you about your report.

For product- or contract-related reports, processing is based on Article 6(1)(b) GDPR; otherwise, it is based on Article 6(1)(f) GDPR. Our legitimate interest is quality assurance and product development. We delete contact details once no further questions are required; the substantive report may then remain in the product backlog without contact information.

The substantive report data – reference, type, title, description, usage context, expected behaviour and, optionally, app and macOS version – is transferred to Atlassian Jira Cloud as a product task through our internal automation. The optional email address remains in our Drupal inbox and is not transferred to Jira. We use Jira as our internal product backlog; information about Atlassian's processing, sub-processors and safeguards is available in Atlassian's privacy and contractual documentation.

Privacy at Atlassian · Data processing addendum · Sub-processors

Your rights

Within the limits of the law, you have the right to access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with effect for the future.

To exercise your rights, email info@progressivedigital.de. You may also lodge a complaint with a data protection supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

Security and changes

We protect data in transit using TLS and apply appropriate technical and organisational measures. We update this privacy notice when functions, service providers or the legal framework change materially. The version published here applies.