Legal
Privacy Policy
Last updated: [DATE OF PUBLISH]
Who this covers
This policy covers lapiz.dev, the Lightbox web tool at lightbox.lapiz.dev, and the Lapiz macOS app. It does not cover third-party sites linked from here, or Polar’s own site/checkout pages (covered by Polar’s privacy policy).
The short version
Lapiz is built to need as little of your data as possible. There’s no account system — nothing to sign up for, no password to store. Lightbox runs entirely in your browser; nothing you style or export there is ever uploaded anywhere. The only personal data involved is what’s necessary to sell you a license and let you activate it.
What we collect, and why
If you buy Lapiz or Lapiz + Updates:
Checkout is handled entirely by Polar, acting as Merchant of Record. Polar collects your email address and payment details directly — we never see or store your card information. Polar issues a license key tied to your purchase; that key (not your email, not your name) is what the Lapiz app checks to confirm you’re licensed. You can view your orders, manage your subscription, and see everything Polar holds about your purchase at any time via polar.sh/lapiz/portal.
When the Lapiz app checks your license:
The app sends your license key to Polar’s servers to confirm it’s valid. This happens on launch and periodically afterward. No other data leaves your machine as part of this check.
Using Lightbox:
Nothing. Images you style in Lightbox are processed by your own browser and never leave your device — there’s no upload step, no server-side processing, nothing to collect.
Visiting lapiz.dev:
The site is hosted on Cloudflare. Like virtually any web host, Cloudflare’s infrastructure logs standard connection information (IP address, browser type, request timestamps) as part of normal operation and basic security protection (e.g. abuse/DDoS mitigation). We don’t run any separate analytics or tracking on top of this — no cookies beyond what’s strictly necessary for the site to function, no ad tracking, no session recording.
Third parties who process data on our behalf
Polar (polar.sh) — payment processing, order records, license key issuance, tax/VAT collection and remittance as Merchant of Record.
Cloudflare — hosting and content delivery for lapiz.dev and lightbox.lapiz.dev.
Neither is instructed to use your data for anything beyond providing their service to us.
How long we keep things
We don’t operate a database of our own with your personal data in it — we don’t have one. Whatever Polar retains for order/tax records follows their own retention policy (typically as long as required for accounting/tax law, commonly up to 10 years under German commercial law for transaction records, even though we ourselves never see or store that data directly).
Your rights
If you’re in the EU/EEA, you have the right under GDPR to:
Know what data is held about you (access)
Have inaccurate data corrected (rectification)
Have your data deleted where there’s no legal reason to keep it (erasure)
Restrict or object to certain processing
Receive your data in a portable format
Complain to your local data protection authority
Since payment/order data is held by Polar, requests about that data are often fastest handled directly through your Polar customer portal or Polar’s own support. For anything else — or if you’d rather go through us — contact [CONTACT EMAIL].
Changes to this policy
If this policy changes in a meaningful way, the “Last updated” date above will change and, if the change is significant, we’ll note it on this page.
Contact
Questions about this policy: [CONTACT EMAIL]. Full legal/business details: see Impressum.