Privacy Policy

Meanshot is built to keep your data on your device. No account, no telemetry, no tracking. This policy explains the limited data involved in the trial, licensing, support, and any future sale of the app under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

Controller: Bent Eisheuer, Freisinger Landstraße 47a, 85748 Garching, Germany — legetdev@gmail.com.

2. The short version

• The app runs on-device; we never receive your screenshots, recordings, or files.
• The app has no telemetry, no advertising, and no profiling.
• No account is required to use the app.
• This website uses no analytics, advertising, tracking pixels, or non-essential cookies.

3. What we process, and why

a. Earlier versions: trial verification

Current versions do not start or verify a trial. Earlier versions may still use the retained trial service. To prevent trial resets, those versions send a salted hash derived from a device identifier to our trial server (a Cloudflare Worker) when the trial starts. Until the first successful verification, the app retries at launch and then hourly; if it cannot verify within 48 hours, the trial is locked. After the first successful verification, no further trial-server checks are made. This is a pseudonymous anti-fraud identifier — no name, no account, no files, and the underlying hardware id never leaves your Mac; the server only records the trial start date for that hash. Legal basis: our legitimate interest in preventing abuse of the trial (Art. 6(1)(f) GDPR). Copies with an active paid license or permanent Pro gift do not send this trial identifier. A trial check may already have occurred before gift activation.

Free Pro launch claim

To obtain or recover a free Pro code, the app sends a salted, app-specific hash of its Mac identifier to our existing Cloudflare Worker. The raw hardware identifier, name, email address, account details and capture content are not sent. This hash is pseudonymous, not anonymous. We store the signed licence under that hash so the same Mac can recover it after reinstalling, including after new free issuance closes. Cloudflare also receives the connection IP address and ordinary technical metadata needed to deliver and secure the request. The legal basis for issuing and restoring the requested licence is Art. 6(1)(b) GDPR. Failed requests may be retried; after the code is saved, normal verification is local without recurring licence requests.

b. License validation

When you activate or validate a purchased license, including while checkout is unavailable, the app sends your license key and a device name/identifier to our licensing provider, Lemon Squeezy, to verify the license and manage activations. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Permanent Pro gift codes contain a random license identifier and the signed Pro grant, with no name or email address. New machine-bound grants also contain the Meanshot-specific hashed hardware identifier, which is pseudonymous, not anonymous. This binds the grant to the activating Mac; the raw hardware identifier stays on the Mac. The app verifies them locally and stores them in your Mac's Keychain until removed. Entering a saved gift code and subsequent offline verification send no code or device information to us or to Lemon Squeezy. Copying the backup code places it on your clipboard. Normal update checks and any uploads or streams you choose are separate from licensing and still use their configured services.

The licence service uses connection IP addresses for short-lived request-rate controls to reduce automated abuse. IP addresses are not used to bind licences to a Mac and are not added to licence recovery records. The purpose is service security (Art. 6(1)(f) GDPR); the device-bound grant and recovery support delivery of your licence (Art. 6(1)(b) GDPR).

Installer and update-feed downloads are delivered from private Cloudflare R2 storage through our Cloudflare Worker. Cloudflare processes ordinary connection information, including your IP address, to deliver files and limit abusive request bursts. The bucket has no separate public download URL. This serves delivery and service security (Art. 6(1)(b) and (f) GDPR).

c. Purchases

Paid sales are not currently enabled. Once enabled, checkout will be handled by Lemon Squeezy (Lemon Squeezy, LLC) as merchant of record. It will collect the data needed for payment, invoicing, and tax and act as controller for that transaction. We will receive the order and license information needed to provide the product and support.

d. Optional uploads

If you configure an upload destination (your own Amazon S3, Cloudflare R2, or custom endpoint), captures you choose to upload go directly to that destination under your control. We neither receive nor store them.

Editable .meanshot projects keep the original image so you can change your annotations later. This includes content beneath a redaction. Share an exported PNG, JPEG, or HEIC when you need redactions to be permanent; the app's project upload action exports the visible image before uploading.

The optional meanshot:// automation links are off by default. If you enable them in Settings, links can trigger capture and other app actions, including an upload to your configured destination. macOS permissions and the app's licence checks still apply. Leave automation disabled if you do not use it; you can turn it off again at any time.

e. Support

If you email us, we process your message and contact details to respond. Legal basis: our legitimate interest in handling your request (Art. 6(1)(f) GDPR).

f. Website hosting

This site is hosted by Vercel. Their servers may log technical request data (such as IP address, request time, requested resource, referrer, and user agent) to deliver and secure the site, as our processor. The website itself sets no cookies or other identifiers and runs no analytics or tracking. Legal basis for hosting and security logs: our legitimate interest in providing a secure, reliable website (Art. 6(1)(f) GDPR).

4. Recipients & processors

Vercel (website hosting) and Cloudflare (free-code issuance, recovery, downloads and legacy trial verification) process data on our behalf. Once paid sales are enabled, Lemon Squeezy will act as an independent controller for transaction data as merchant of record. We do not sell or share personal data for advertising.

5. International transfers

These providers may process data outside the EU/EEA, including in the United States. Where GDPR transfer restrictions apply, the transfer must use a valid mechanism such as an adequacy decision (including an applicable EU–US Data Privacy Framework certification) or Standard Contractual Clauses.

6. Retention

For support-assisted licence replacement or earlier multi-Mac rights, we retain a private record of the original grant, permitted Mac identifiers, replacement history and support case reference. This record is held in Cloudflare and on the protected support workstation for as long as needed to administer your permanent entitlement (Art. 6(1)(b) GDPR). It prevents additional seats being issued beyond the agreed allowance. Replacing an offline Mac does not remotely disable its saved licence.

Free-licence recovery records (the pseudonymous Mac hash and signed licence) have no automatic expiry while we provide permanent-licence recovery. Closing new issuance does not delete them. They are separate from expiring trial records. You may request deletion using the contact below; deleting a recovery record removes automatic recovery, so keep your local backup code.

The pseudonymous trial fingerprint and its start date are automatically deleted no later than 12 months after the first successful verification. Vercel retains infrastructure security logs under the applicable account settings; we do not run a separate website analytics or tracking log. Once sales are enabled, we keep order and license records for as long as needed to provide your license and to meet legal retention duties — in Germany, invoices and accounting vouchers are retained for 8 years (§ 147 AO, § 257 HGB, reduced from 10 by the 2025 Bürokratieentlastungsgesetz IV), and books and annual financial statements for 10 years. Support correspondence is kept only as long as needed.

7. Your rights

Under the GDPR you may have rights of access, rectification, erasure, restriction, data portability, and objection, and to withdraw consent where processing relies on consent. You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach, Germany; you may also contact the authority of your habitual residence.

8. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Children

The Software and this site are not directed to children under 16.

10. Changes

We may update this policy; the current version is always posted here with its date.