Privacy Policy
Last updated 9 September 2026
This policy covers the website leafbind.app and the Leafbind desktop application. It describes what actually happens, rather than reserving rights we do not exercise.
1. Who is responsible
Software Design & Consulting GmbH, Aufkirchner Straße 25 a, 82069 Hohenschäftlarn, Germany — the controller under Art. 4(7) GDPR. Full company details are in the imprint. For anything in this policy, write to hello@leafbind.app.
No data protection officer has been appointed. Under § 38 BDSG one is required only where at least twenty people are permanently engaged in the automated processing of personal data, where a data protection impact assessment under Art. 35 GDPR is required, or where personal data is processed commercially for the purpose of transfer or for market and opinion research. None of those applies here.
2. Visiting this website
The site is static, hosted on Amazon S3 behind the Amazon CloudFront content delivery network. Serving a page necessarily involves your IP address, and the server records the usual access data: IP address, timestamp, the URL requested, HTTP status, referrer and user agent. That is used to deliver the site and to diagnose faults and abuse, on the basis of our legitimate interest in operating a working, secure website (Art. 6(1)(f) GDPR). Our compute for this site runs in the AWS eu-central-1 (Frankfurt) region; CloudFront is a global network and will serve you from an edge location near you.
3. Fonts, and what we deliberately do not load
Typefaces are served from our own domain. This site embeds no Google Fonts and no other externally hosted font, so your browser makes no request to a third-party font server and your IP address is not disclosed to one.
That is the general rule here rather than a detail about fonts: loading a page on this site makes no request to any third party at all. The only external address in the page is where the newsletter form submits to, and nothing is sent there unless you submit it.
4. Analytics
There are none. This site runs no analytics, no tracking pixels and no third-party measurement of any kind. Nothing counts you, and no record of your visit leaves our own server logs.
5. Cookies
This website sets no cookies and uses no comparable tracking storage. There is accordingly no consent banner, because there is nothing to consent to.
6. Requesting a trial licence
The trial form asks for your email address, optionally a first name, and optionally your consent to the newsletter. The address is used to generate a signed licence file and email it to you with the download link. Basis: Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract.
Your email address is not stored. What is kept is an irreversible SHA-256 hash of it, alongside a licence identifier and two dates, for 365 days — enough to ensure one person receives one trial rather than an unlimited supply, and to return you the same licence if you ask again. Your IP address is likewise kept only as a hash, for one hour, to limit automated abuse of the endpoint (Art. 6(1)(f) GDPR). A hash cannot be turned back into an address, and we hold no list of who has requested a trial.
Two honest consequences follow. We cannot contact you about your trial unless you write to us first, and we cannot look your record up from your address — but you may request the same licence again from the form at any time and it will be reissued identically. And an erasure request is largely moot here: there is nothing identifiable to erase, and the hash expires by itself.
The licence file we send you does contain your name and email address, because it is issued to you personally. It is generated when you ask for it and sent to you; we keep no copy.
Email is delivered through Amazon Simple Email Service in the eu-central-1
(Frankfurt) region, from the domain licence.leafbind.app.
7. Newsletter
If — and only if — you tick the newsletter box, or subscribe through the "Watch it get built" form, your address is passed to Loops, the service that sends our development update. Basis: your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time using the one-click unsubscribe link in every issue, with effect for the future. Wanting to try the software is never treated as agreement to be emailed about anything else.
Loops is operated by Astrodon Corporation in the United States, and its infrastructure providers process data in the United States. Subscribing therefore involves a transfer outside the EEA. Astrodon states that it complies with the EU-U.S. Data Privacy Framework and, where required, uses standard contractual clauses. A data processing agreement under Art. 28 GDPR is in force, concluded through use of the service. Astrodon's participation in the Data Privacy Framework is currently active on the official register. This applies only to newsletter subscribers: if you do not subscribe, your address is never sent there.
8. Writing to us
Mail to an @leafbind.app address is received through IONOS mail forwarding and
delivered to our own mailbox. Correspondence is kept for as long as needed to deal with the
matter and to meet statutory retention duties.
9. The Leafbind application
Leafbind runs on your computer and works offline. Your manuscripts stay on your disk, as ordinary Markdown files in folders you control; they are never uploaded to us and we cannot read them. The application contains no analytics and no telemetry.
Two things do involve the network. It checks for updates against
leafbind.app, which — like any web request — discloses your IP address and the
version you are running to the server log. And it verifies your licence file,
which happens entirely on your own machine against a public key built into the application; no
licence check is sent to us. If you send us a crash log, you do so deliberately, by attaching it
yourself.
10. Buying a licence
The store is not open yet. When it opens, payment will be handled by Lemon Squeezy acting as Merchant of Record, which means they take your payment and billing details directly and we neither receive nor store your card data. This section will be completed before anything can be bought.
11. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and the right to object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future. Write to hello@leafbind.app.
You also have the right to complain to a supervisory authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
12. Changes
This page is updated when what we do changes, and the date at the top says when. There is no other version kept elsewhere: this page is the statement.