Privacy Policy

We collect what we need to sell Kinetic and run its licenses — mainly email addresses — and nothing about your code. The website has no analytics, no advertising and no tracking cookies. The app sends no analytics or crash reports.

Kinetic UG (haftungsbeschränkt), Thundorfer Mühle 11, D-83404 Ainring, Germany, is the controller for the data described here. For anything about your data, write to privacy@kinetic.re.

Paddle.com, our reseller, sells Kinetic to you and handles payment. For what it collects at checkout — your payment details, billing address and tax information — Paddle is a controller in its own right, under its privacy notice. We never see your card details.

• When you buy: from Paddle, the buyer's email address, the subscription, its number of seats, its status and billing period, and refunds.
• For each seat: the email address of the person invited, when they were invited and sent their key, and their license key — stored only as a hash.
• When you activate a Mac: an identifier for that Mac, hashed by the app so it doesn't reveal the hardware, the Mac's name as set in macOS, and when it was first and last seen.
• When you download the app: which seat downloaded it, and when.
• When you sign in to the team page: your email address, to send a sign-in link; and a cookie that keeps you signed in.
• When you ask about the enterprise plan: what you write in the form — name, work email, company, seats and your message.
• When you use the website or the licensing: your IP address, to stop repeated attempts at guessing keys or sending mail, and in our hosting provider's logs.

Kinetic contacts us only to activate or deactivate a license, to renew it about once a day, and to check for updates. Those requests carry the license key or its signed lease, the hashed Mac identifier and the Mac's name, and the app's version.

Your repositories, commits and code never come to us. The services you connect the app to — Git hosts, Jira, AI providers, and Gravatar for author pictures if you turn it on — are contacted directly from your Mac, not through us, and their own privacy policies apply.

• To provide what you bought — licenses, keys, downloads, updates, the team page (performing our contract, Art. 6(1)(b) GDPR).
• To answer enterprise requests (steps before a contract, Art. 6(1)(b)).
• To keep the service secure — rate limits, abuse prevention, logs (our legitimate interest, Art. 6(1)(f)).
• To meet legal obligations, such as keeping business records (Art. 6(1)(c)).

We don't sell your data, use it for advertising, or make automated decisions about you.

These providers process data on our behalf, under data processing agreements:

• Vercel — hosts the website and the licensing API (in Frankfurt, Germany).
• Neon — the database the licensing data lives in.
• Resend — sends the emails with license keys, invitations and sign-in links.
• Cloudflare — stores the app's disk images and serves downloads and updates.

Some of them are based in the United States. Where data leaves the EU, the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

The team page sets one cookie, which keeps you signed in; it is needed for the page to work, so it doesn't ask for consent. Paddle's checkout sets its own cookies for payment and fraud prevention. There are no other cookies.

• Subscription, seat, activation and download records: while the subscription runs, and afterwards as long as needed for our records and the law — you can ask us to delete them once it has ended.
• Sign-in links: they work once, for 15 minutes, and are deleted within a day after.
• IP and email addresses in rate limits: deleted within two days.
• Enterprise requests: up to two years, unless they lead to a contract.

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Write to privacy@kinetic.re; we answer within a month. You can also complain to a data protection authority — where you live or work, or where we are established.

When we change this policy, we update the date at the top. For a change that affects how we use data we already hold, we'll email the people it concerns first.