Privacy policy

1. Privacy at a glance

PowerTrove is an open-source tool for the Windows desktop. We process data primarily to provide and secure the Website (e.g., defending against attacks). The Website shows no ads and includes no analytics or tracking services.

General information: When you use this Website, various types of personal data are processed. This is exclusively data that is technically necessary (e.g., to deliver the Website) or that you provide to us yourself. We do not use technologies that require consent, such as advertising, marketing or tracking cookies; that is why there is no cookie banner.

Data collection on this Website: Some data is collected when you provide it to us (e.g., contacting us by email or—once enabled—signing in with an account). Other data is processed automatically by our IT systems when you visit the Website (e.g., technical connection data such as IP address, browser and time of access).

What do we use your data for? We use data to ensure the secure and error-free provision of the Website, to prevent misuse and attacks, to handle your inquiries and—once enabled—to provide optional account features.

What rights do you have? In particular, you have the right to access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent. Details can be found below under “Your rights”.

• Technically necessary processing is carried out on the basis of legitimate interests and/or to perform a contract.
• The interactive demo on the Website runs entirely in your browser. It never reads, changes or uploads your files.
• The desktop app processes your files locally on your PC and sends no usage data to us.

2. General information and mandatory disclosures

Data protection: We treat your personal data confidentially and in accordance with applicable data protection laws and this Privacy Policy.

Please note that data transmission over the Internet (e.g., communication by email) may have security vulnerabilities. Complete protection of data against access by third parties cannot be guaranteed.

Information about the controller: The controller responsible for processing personal data within the meaning of the GDPR is:

F. Jakob Grzesiak
Höppnerstr. 101, WE 35
47809 Krefeld, Germany
Email: [email protected]

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

We have not appointed a Data Protection Officer unless legally required.

3. Overview: What data we process

Depending on how you use the Website and the desktop app, we process in particular the following categories of personal data:

• Technical data (e.g., IP address, timestamps, user agent, referrer, requested URL, status codes) to deliver and secure the Website.
• Preference data stored only in your browser (chosen appearance, demo search terms).
• Contact data (e.g., email address, message content) if you write to us by email.
• Account data (e.g., GitHub account ID, username, email address) if you sign in—once enabled—and use account features.
• Connection data towards GitHub when you download the app, open GitHub links or check for updates in the desktop app.

4. Legal bases for processing

We process personal data only where a legal basis applies. Depending on the purpose, this includes in particular:

• Art. 6(1)(b) GDPR (contract/steps prior), e.g., for login/account features.
• Art. 6(1)(f) GDPR (legitimate interests), e.g., IT security, abuse prevention, stable provision of the Website.
• Art. 6(1)(a) GDPR (consent), should we introduce processing that requires consent in the future. We currently use none.

For storing/reading information on your device (cookies/similar technologies), § 25 TDDDG also applies: consent (§ 25(1)), unless strictly necessary for the service (§ 25(2)). We use only strictly necessary technologies.

Where an explicit consent to transfer data to third countries is required, processing may additionally be based on Art. 49(1)(a) GDPR (e.g., in exceptional cases).

5. Hosting (Hetzner)

We host content and systems of this Website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers located in Germany. We manage deployment ourselves with the open-source software Coolify on this infrastructure. In doing so, technical data necessary for delivery and security is processed (e.g., IP address in server logs, time of access, requested resource).

The use of Hetzner is based on Art. 6(1)(f) GDPR. We have a legitimate interest in providing a reliable and secure Website. We have concluded a data processing agreement with Hetzner.

6. Content delivery & security (Cloudflare proxy/CDN)

We use Cloudflare as a reverse proxy/CDN and security service (e.g., DDoS protection/WAF). Traffic to the Website is routed via Cloudflare. Cloudflare processes technical connection data (in particular IP address and request metadata) to deliver content and mitigate attacks.

Depending on configuration, Cloudflare security features may set strictly necessary cookies/tokens (e.g., to prevent automated access or to perform security challenges). Such technologies are used only to the extent required for security and functionality.

Depending on routing/product, processing in third countries (e.g., the U.S.) may occur. Cloudflare is certified under the EU-U.S. Data Privacy Framework and additionally relies on recognized safeguards (e.g., Standard Contractual Clauses). The legal basis is Art. 6(1)(f) GDPR.

7. Cookies and local storage

Our Website uses only strictly necessary cookies and similar technologies. Cookies are small data files and do not harm your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies).

In your browser's local storage, the Website stores only settings you choose yourself: the selected appearance (light, dark or system) under the key powertrove-theme and the interactive demo's search terms. Choosing “System” removes the stored value. This data never leaves your browser.

Once accounts are enabled and you sign in, strictly necessary HttpOnly cookies store your login session and, briefly, an identifier for the sign-in flow (PKCE flow).

• Strictly necessary cookies/technologies are used without consent where required for the service you explicitly requested (§ 25(2) TDDDG); processing is based on Art. 6(1)(f) or (b) GDPR.
• We do not use non-essential cookies/technologies (e.g., for personalization, marketing or tracking).
• You can delete or block cookies and local storage at any time via your browser settings. If disabled, the functionality of the Website may be limited (e.g., signing in).

8. GitHub (source code, downloads and repository data)

The source code, releases and downloads of the PowerTrove desktop app are provided on GitHub (GitHub B.V., Netherlands, and GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you open a GitHub link or start a download, your browser connects directly to GitHub. GitHub processes in particular your IP address and technical connection data. From that point on, processing by GitHub is governed by its privacy policies.

Our server retrieves public repository information (e.g., release details, file sizes, checksums and the star count) from the GitHub API and caches it briefly. These requests are made without cookies or sign-in; no data about you is sent to GitHub.

GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR).

9. Account/sign-in & database

Account features (sign-in, publisher profiles, marketplace) are not enabled yet. As long as this is the case, no account data is processed.

The planned sign-in uses authentication and a database based on Supabase. You sign in with your GitHub account (OAuth). In doing so, we process in particular your GitHub account ID, username and email address, as well as technical data required for authentication, session management, diagnostics and security.

Before accounts are enabled, we will add here whether the database is operated on our own infrastructure or with an external provider, as well as the storage location and retention period.

• Purpose: Provide account features (login, account management) and store data as part of the platform features.
• Legal basis: Art. 6(1)(b) GDPR (contract/steps prior) and Art. 6(1)(f) GDPR (security/diagnostics/abuse prevention).

10. Desktop app

The PowerTrove desktop app processes the files and selections you run an action on exclusively locally on your PC. The app sends no telemetry, usage statistics or file contents to us and needs no account. Settings are stored locally on your device.

Only when you explicitly choose “Check for updates” in Settings does the app ask GitHub for the latest available version. GitHub then receives your IP address and usual technical connection data (see section 8).

11. Contact (email/links to third-party platforms)

If you contact us by email, we process your inquiry including all personal data resulting from it (e.g., email address, message content) to handle your request.

Depending on content, processing is based on Art. 6(1)(b) GDPR (if the inquiry relates to contract performance or pre-contractual steps) or on Art. 6(1)(f) GDPR (legitimate interest in efficient handling).

If we provide links to third-party platforms (e.g., to the repository or issues on GitHub), clicking the link will redirect you. From that point on, processing by the third party is governed by their privacy policies.

12. Server logs

Whenever the Website is accessed, technical information may be processed in server log files (e.g., IP address, date/time, accessed page/file, status code, user agent).

The purpose is secure operation (e.g., troubleshooting, attack mitigation) and ensuring technical functionality.

• Legal basis: Art. 6(1)(f) GDPR.
• Retention: typically 7–14 days (or longer if required to investigate security incidents).

13. Recipients of personal data / processing on our behalf

In the course of our activities, we work with external parties (service providers). This may require transferring personal data to these parties.

We use service providers (processors) that process personal data on our behalf, in particular for hosting/infrastructure and proxy/CDN. Where required, we conclude data processing agreements with them.

We do not sell personal data and do not share it for advertising purposes.

• Hetzner (hosting/infrastructure)
• Cloudflare (proxy/CDN/security)
• GitHub (source code, downloads, update check of the desktop app – only when you go there or trigger the check)

14. Transfers to third countries

Some service providers (Cloudflare, GitHub) may process data in countries outside the EU/EEA (e.g., the U.S.). In such cases, transfers rely on appropriate safeguards (e.g., the adequacy decision for the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses), where required.

Please refer to the linked privacy notices of the respective providers for further details.

15. Retention

Unless a more specific retention period is stated in this Privacy Policy, we store personal data only as long as necessary for the purposes described or as required by law.

If you assert a legitimate request for erasure or withdraw consent, your data will be erased unless other legally permissible grounds for storage apply (e.g., statutory retention obligations).

• Server logs: typically 7–14 days.
• Email inquiries: until your request has been fully handled, unless a statutory retention obligation applies.
• Settings in your browser's local storage: until you delete them yourself.
• Account data (once accounts are enabled): until the account is deleted.

16. Your rights

Under the GDPR you have the following rights, in particular (subject to legal requirements):

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Withdrawal of consent: Some processing operations are possible only with your explicit consent. You can withdraw consent at any time. The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, you can contact us at [email protected].

17. Right to lodge a complaint with a supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement. This right exists without prejudice to other administrative or judicial remedies.

18. SSL/TLS encryption and security

This Website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognize an encrypted connection by the address bar changing from “http://” to “https://” and the lock symbol in your browser.

Please note that a completely risk-free security architecture on the Internet can never be guaranteed.

19. Changes to this Privacy Policy

We may update this Privacy Policy if our Website, the desktop app, services used, or legal requirements change. The version published on this page applies.

Contact

If you have any privacy questions, please contact PowerTrove by email at [email protected].

Last updated: Oct 2026