Privacy notice

Who is responsible

liebhardt.io UG (haftungsbeschränkt), Nußbaumstraße 29, 66121 Saarbrücken, Germany is the controller for the personal data described here. Contact hello@toolstokeep.com for privacy questions and requests. This notice covers toolstokeep.com and our licensing service. The today-md privacy policy explains local app data and optional app connections.

Website delivery and security

Cloudflare hosts the site and provides its application runtime, database, file storage, email delivery, and security services. Requests disclose technical information such as your IP address, request time, URL, browser information, and response status. Our rate limits use IP addresses to protect forms and APIs. Operational logs can contain request information and errors.

We process this information to deliver the site and protect accounts, purchases, and our services from abuse. The legal basis is our legitimate interest in a secure, reliable service (Article 6(1)(f) GDPR). Where a Cloudflare Turnstile challenge is displayed, Cloudflare also checks browser and device signals to distinguish legitimate requests from automated abuse.

We do not add advertising pixels or visitor analytics to this website. Fonts are served with the site.

Purchases and invoices

Stripe hosts checkout and processes payments. It receives the contact, billing, tax, payment, and technical information you provide or generate during checkout. We receive your purchase email address, order and payment references, products, amounts, currency, tax amounts, payment status, and refund or dispute events. Billing details and invoices are also available through Stripe. We do not receive full payment-card numbers or bank credentials.

We use these data to conclude and fulfil your purchase, deliver licenses, handle support and refunds, and keep transaction records (Article 6(1)(b) GDPR). Tax and accounting records are processed to comply with legal obligations (Article 6(1)(c)). Preventing payment abuse and defending claims may rely on Article 6(1)(f).

Stripe also processes information for its own payment, fraud-prevention, and legal purposes. See Stripe’s privacy policy for its role, international processing, and your choices when using Stripe services such as Link.

Account access, downloads, and licensing

My tools uses your purchase email address and passwordless sign-in links. We store hashed sign-in and session tokens. Sign-in links expire after fifteen minutes and are invalidated after use. Sessions expire after thirty days or when you sign out.

We retain your customer reference, email address, orders, license keys, license limits, and revocation status to provide your purchases. Short keys beginning with ttk_ are random references to a signed license containing your purchase email address. Entering a short key sends it and a SHA-256 hash derived from your Mac’s hardware identifier to our activation service, which returns the signed license for storage in the app’s Keychain. Older signed keys contain the email address directly and remain valid. The direct-download edition repeats activation with the signed license about once a week to detect refunded or revoked licenses. The Mac App Store edition only contacts this service when you choose to enter a short key. We store the device hash with the license and activation date to enforce the device limit. The raw hardware identifier is not sent. The hash is pseudonymous, and can be associated with your license and account.

If an eligible Apple purchase is redeemed for a website license, our service verifies the signed Apple transaction supplied with your email address and records its transaction reference, product, amount, currency, and environment. Apple refund or revocation notifications can update that entitlement. This information is used to provide the license and prevent a refunded transaction from being redeemed again.

Downloads and requests to the licensing service also generate the technical request information described above. The legal basis for account access, delivery, and license activation is contract performance (Article 6(1)(b) GDPR); protecting licenses from misuse also serves our legitimate interests (Article 6(1)(f)). Providing the required purchase and activation information is necessary for those functions.

Withdrawals and refunds

When you use the online withdrawal form, we process the name, email address, contract or order reference, and declaration you submit, with its receipt time. We use these records to acknowledge your declaration, identify the purchase, assess and process the withdrawal, and document the outcome. Payment refunds also generate records with Stripe. The legal bases are contract administration (Article 6(1)(b) GDPR), compliance with consumer-law and recordkeeping obligations (Article 6(1)(c)), and establishing or defending legal claims where necessary (Article 6(1)(f)). We retain the declaration while needed for those purposes.

Essential browser storage

• ttk-cart in local storage remembers the tools in your cart. It stays in your browser until it is updated or you clear it.
• The ttk_session cookie maintains your sign-in for up to thirty days.
• The ttk_receipt cookie permits your browser to view the license receipt after checkout for up to one hour.
• The ttk_withdrawal_receipt cookie protects your browser’s access to the withdrawal acknowledgement for up to one hour.

This storage supports the cart, account, and receipt functions you request. It is used under the strictly necessary storage exception in Section 25(2)(2) TDDDG. You can clear or block storage in your browser, which can prevent these functions from working. Stripe and Cloudflare describe storage used by their own services in their notices.

Optional alerts, tool requests, and support

If you request launch alerts, we store your email address, confirmation-token hash, signup time, and confirmation or unsubscribe status. We send alerts only after you confirm the signup email. Tool requests also store your idea, optional information about what you currently pay, and confirmation and notification times. A request is stored when submitted; we email you about its release only after confirmation.

Alert and release-notification emails rely on your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time by emailing hello@toolstokeep.com; withdrawal does not affect earlier lawful processing. Assessing requested tools and preventing form abuse serves our legitimate interests (Article 6(1)(f)).

If you contact us, we process your address, message, and information you choose to provide to answer the request. This relies on Article 6(1)(b) where it concerns a purchase or pre-contract enquiry, and Article 6(1)(f) for other correspondence. Avoid sending sensitive task content or payment credentials. A public GitHub issue is visible to others and subject to GitHub’s privacy statement.

Recipients and international processing

Cloudflare, Inc. and its service providers process data to host and operate our site and email service. Stripe and its service providers process payment and invoice data. Your email provider receives messages addressed to you. We may disclose relevant records to authorities where legally required, and to professional advisers when needed for accounting or legal matters.

Cloudflare and Stripe operate internationally, including in the United States. Cloudflare’s data processing addendum provides European Commission standard contractual clauses for restricted transfers. Stripe describes its transfer safeguards in its privacy policy. You can contact us for information about the safeguards applicable to your data. See also Cloudflare’s privacy policy.

Retention

Sign-in, session, and receipt lifetimes are stated above. We retain order and license records as needed to provide the purchased license and downloads, handle claims, and meet applicable tax and accounting duties. Legal obligations can prevent immediate deletion. Activation records remain linked to the license to administer its device allowance.

We retain support correspondence while needed to resolve the request and any associated claims. Optional notification records are retained while needed for the requested notifications and to record your consent or withdrawal. Technical information is retained according to the service configuration and security needs. Contact us for the retention criteria that apply to a particular record.

Your rights

Subject to the applicable legal conditions, you can request access, correction, erasure, restriction, and portability of personal data. You may object to processing based on legitimate interests for reasons related to your situation, and object to direct marketing at any time. You can withdraw consent with effect for the future. We do not use your data to make solely automated decisions producing legal or similarly significant effects.

Contact hello@toolstokeep.com to exercise your rights. You can complain to a supervisory authority, including the Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany, or the authority where you live or work. You do not have to contact us before complaining.