Privacy Policy

Last updated: 2026-07-22

1. Controller

The controller responsible for data processing in connection with this website is:
lukas josef unternehmungen
Alemannensteige 6, 79117 Freiburg im Breisgau, Deutschland
Email: hello@ctxvault.com

2. Important: the app itself does not process any data

CtxVault (currently distributed as a macOS app; a Windows version has been announced but is not yet available) runs entirely locally on your device. Clipboard content, offloaded files, and your history never leave your device — there is no telemetry, no tracking, and no cloud sync. The sections below apply only to this website (visiting the landing page) and to the purchase process handled by Polar.

3. Hosting of this website

When you visit this website, our hosting provider automatically collects technical access data (server log files) transmitted by your browser, including IP address, date and time of the request, file requested, referrer URL, browser type/version, and operating system. This data is technically necessary to deliver the website and ensure operational security (legal basis: Art. 6(1)(f) GDPR, legitimate interest in reliable operation). No cookies are set and no analytics or tracking services (e.g. Google Analytics) are used.

Hosting provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Server log data may be processed on infrastructure located outside the EU; Vercel is contractually bound as a processor and relies on the EU Standard Contractual Clauses for such transfers.

4. Purchases handled by Polar (Merchant of Record)

Every purchase of a CtxVault license is processed entirely by Polar Software Inc. ("Polar"). Polar acts as Merchant of Record: Polar enters into the purchase contract with you in its own name, and processes payment data (e.g. card details, billing address) and your email address for license delivery independently, as its own controller — not as our processor. Polar's own privacy policy applies in addition to this one, see https://polar.sh/legal/privacy. Polar only shares the information we need for license administration with us (e.g. order number, license status) — never your full payment data.

Purpose of processing: performance of a contract (Art. 6(1)(b) GDPR).

5. Email communication (support and other inquiries)

If you contact us by email (e.g. at hello@ctxvault.com for support or with questions about your license), we process the content of your message and your email address to handle your request. (Note that withdrawal and refund requests are handled by Polar as Merchant of Record; if you send us such a request, we process it only to point you to Polar.) Depending on the nature of your request, the legal basis is performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), or, where no contract is concerned, our legitimate interest in responding to inquiries directed to us (Art. 6(1)(f) GDPR). We delete this correspondence once your request has been resolved, unless statutory retention obligations (six or ten years under the German Commercial Code (HGB) and Fiscal Code (AO)) require us to keep it longer.

6. License management and update check

The app communicates with Polar for license management: it requests activation of your license key when you first launch the app (transmitted: license key, device identifier), it periodically reconnects to Polar to confirm the key is still valid while the app is in use, and, if you move your license to a new device, it deactivates the key on the old device and reactivates it on the new one. Optionally, the app also checks for updates against our appcast feed at updates.ctxvault.com/appcast.xml (transmitted: app version, operating system version); this check can be disabled in Settings. The app's network communication is limited to these purposes — license management (activation, periodic revalidation, deactivation, reactivation) and, optionally, the update check. It never includes clipboard content, usage data, or any other telemetry.

The legal basis for license management is the performance of a contract (Art. 6(1)(b) GDPR). The legal basis for the optional update check is our legitimate interest in providing a secure and up-to-date application (Art. 6(1)(f) GDPR).

7. Your rights as a data subject

Depending on your jurisdiction, you may have the following rights regarding your personal data:

To exercise these rights, please contact the email address listed above. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement.

We do not use automated decision-making or profiling (Art. 22 GDPR).

8. Data retention

Server log files are processed by our hosting provider as part of delivering this website and are deleted automatically once that platform's retention period — a matter of days — has elapsed. We do not operate a log drain and do not create or keep separate copies of them. Payment and order data are subject to the statutory retention obligations of Polar as an independent controller.