Privacy notice

Bootleg Cheeseburger apps and bootlegcheeseburger.com. Last updated October 26, 2026.

The short version

Our apps have no analytics, no tracking and no ads, and the files you work on stay on your computer. We keep only what it takes to sell you an app, keep its license working, keep it up to date and answer your email. We do not sell your personal data.

Who is responsible

Bootleg Cheeseburger, LLC (418 Broadway #5960, Albany, NY 12207, USA) is the controller of the personal data described here. For anything about privacy, write to support@bootlegcheeseburger.com.

When you buy one of our apps, Paddle.com, our reseller and Merchant of Record, is the controller of the data it collects at checkout, under Paddle's privacy notice.

What we collect, why, and on what basis

• Purchase details. When you buy, Paddle collects your name, email, billing country or address and payment details. We never see your card details. Paddle passes us your email, your Paddle customer id and the order's transaction id. We use them to create and deliver your serial, handle refunds and answer support requests. Basis: performing our contract with you.
• License and activation data. For paid apps: your serial, the email the license is registered to, and for each computer you activate a one-way hash (SHA-256) of the computer's hardware id, the computer's name, the app version, the platform (macOS®) and when it was activated and checked. Our licensing service also sees the IP address of each check. We use this to activate apps, count seats and stop serials being misused. Basis: performing our contract with you, and our legitimate interest in preventing license misuse.
• Update checks. Some apps check for new versions. The request carries the app's version and, like any web request, your IP address. Basis: our legitimate interest in keeping our apps up to date and secure.
• Community submissions. Some apps let you send information to a shared database, such as plugin names and versions, along with the app's version. What you submit may be published. We use your IP address for a few minutes to limit abuse, and store a one-way hash of it with your submission to spot repeated reports. Basis: our legitimate interest in running the database.
• Email you send us. Your address, the subject, what you write, the names of any attachments and the results of standard sender checks (SPF and DKIM), kept with our replies as a support thread, to answer you and follow up. Basis: our legitimate interest in providing support, or performing our contract with you.
• Beta and notification sign-ups. If you use a form on the site to request beta access or updates, the name, email and role you enter, to contact you about that app. Basis: your consent, which you can withdraw at any time.
• Website requests. Our hosting provider processes the IP address, browser type and pages requested when you visit, to deliver and protect the site. Basis: our legitimate interest in running a secure website.

When an app imports from a link you paste, such as a shared spreadsheet or review link, it fetches that link directly from the service that hosts it. We do not receive what it fetches.

Lumberjack

Lumberjack keeps your log on your own devices. It syncs directly between your devices over your local network, with no server in between, and it reads your calendar on the device to show your events in the log. On iPhone and iPad devices it uses the camera only to read the code another of your devices shows when you link them. None of this data reaches us, and Lumberjack has no analytics or crash reporting.

Who we share it with

We share personal data only with the service providers that run our apps and the site for us, each under its own privacy and data-protection terms:

• Paddle (Paddle.com Market Limited and its affiliates), our reseller and Merchant of Record: checkout, payment, tax, receipts and refunds.
• Keygen (Keygen LLC): license keys and activations.
• Resend: delivering emails that contain serials, and automatic replies to support email.
• Fastmail: the mailbox where we read and answer email you send us.
• Cloudflare: hosting the site and the services behind purchases and community submissions, and receiving and storing email sent to our addresses.
• GitHub: hosting downloads, update feeds and community databases. The home page asks GitHub for the latest version numbers, so your browser contacts GitHub when you visit.
• Google: storing beta and notification sign-ups.
• Anthropic: an AI model that helps us review community submissions and keep community databases up to date. It receives public vendor web pages and the plugin names, identifiers and links in a submission, never your IP address or its hash.

We may also share data with professional advisers such as accountants and lawyers, with a buyer or successor of our business, or with authorities where the law requires it.

International transfers

We are based in the United States, and our service providers process data in the United States and other countries. Where data protection law such as the GDPR or UK GDPR applies to your data, transfers out of your country rely on an adequacy decision (such as the EU-US Data Privacy Framework) or on Standard Contractual Clauses or the UK International Data Transfer Addendum.

How long we keep it

• Purchase and license records: for as long as your license exists, then up to 7 years for tax and accounting.
• Activation records for a computer: until you deactivate that computer or the license ends.
• Support threads: the messages, and your address with them, are deleted 12 months after the last message in the thread. A short record of the thread stays (its number, the app, dates and a one-line summary), without your address or the messages. If you ask us to delete your data, your threads are deleted at once. Copies in our mailbox: up to 12 months after our last exchange.
• Beta and notification sign-ups: until you ask to be removed or the beta or launch is over.
• Community submissions and their hashed IP addresses: as long as the database exists. Raw IP addresses used to limit abuse: a few minutes.
• Hosting logs: for the short period our hosting provider keeps them.

Cookies

The site sets no cookies of its own and uses no analytics. On pages where our apps are for sale, the site loads Paddle's checkout script (Paddle.js) on each visit, so your browser contacts Paddle before you buy anything, for example to show a price in your currency. The Paddle checkout may use cookies or similar storage that are needed for checkout and fraud prevention; see Paddle's privacy notice.

Security

We protect personal data with reasonable technical and organisational measures: all traffic uses HTTPS, the keys to our services are held only on our servers and never ship in our apps or on the site, access is limited to what each service needs, and our apps send a hash of your computer's hardware id rather than the id itself.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time. If you are in the EEA or UK, you may also complain to your local data protection authority. Residents of some US states, such as California, have similar rights to know, correct and delete their data; we do not sell or share personal data for targeted advertising.

To use any of these rights, write to support@bootlegcheeseburger.com. We will reply within one month. Deleting your license data ends your license: the app returns to its demo, or stops working if it has no demo. For data Paddle holds as Merchant of Record, you can also contact Paddle directly.

Children

Our apps and the site are not directed at children under 16, and we do not knowingly collect their personal data.

Changes

If we change this notice, we will post the new version here with a new date.