Privacy

This policy covers apps.ldhmr.com, the hub at ldhmr.com, the desktop apps, and the license service.

Short version: the apps work on your computer and never upload your files. The websites set no cookies and use no analytics. To keep licenses working, the license service stores a little information about each activated computer. You can see and remove it on the license page.

Who is responsible

The controller under the GDPR is the provider named in the imprint. Contact: [email protected].

The websites

Both websites are static sites hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, under its data processing addendum. When you visit them, your browser sends technical data such as your IP address, the page requested, and your browser's user agent. Cloudflare processes this to deliver the sites and protect them from abuse (Art. 6 (1) (f) GDPR). We do not use cookies, analytics, advertising, or third-party fonts or scripts, except Paddle's checkout on the pages where you buy (see Purchases). Fonts, images, and scripts come from our own domains.

The hub at ldhmr.com remembers the language you pick (English or German) in your browser's local storage. It stays on your device, is never sent to us, and you can delete it with your browser's site data. Storing it is necessary for the service you asked for (§ 25 (2) no. 2 TDDDG). Links to Spotify, YouTube, Instagram, and other platforms only take you there when you click them; from then on, that platform's privacy policy applies.

The license service

When you activate an app, refresh its license (about once a week), or use the license page, the app or your browser contacts our license service at license.ldhmr.com, also run on Cloudflare. It processes:

your license key (stored as a cryptographic fingerprint for checking it, and encrypted so we can e-mail it to you again);
for each activated computer: an identifier derived from the computer's ID (a one-way hash, not the ID itself), the operating system and its version (for example “macOS 15.6”), processor type, app and version, and when it was activated and last seen;
your IP address, only in memory and only to limit repeated attempts; it is not stored.

This is necessary to provide the license you bought: three computers per license, moving it between computers, and stopping refunded licenses (Art. 6 (1) (b) GDPR). Records of deactivated computers are deleted after 12 months by a daily job; license records are kept as long as the license exists and as required by tax law.

Purchases

Orders are processed by our reseller Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, which is the seller of record and processes your payment, billing address, and e-mail address under its own privacy policy: paddle.com/legal/privacy. Its checkout opens on our buy pages and is loaded from Paddle's servers, so Paddle receives your IP address and browser details when you open one of those pages.

When a purchase is complete, Paddle tells our license service which products were bought, with an order number and a customer number. The license service then asks Paddle for your e-mail address, sends you the license key, and keeps no copy of the address. We can see your order in Paddle's dashboard to help with support and refunds (Art. 6 (1) (b) GDPR).

License e-mails

License keys are sent through Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France, which processes your e-mail address and the message on our behalf under a data processing agreement and keeps delivery logs for [check retention].

If you ask for your keys again on the license page, the license service looks up your purchases at Paddle by the address you enter and sends the keys to that address only. To limit how often one address gets mail, it keeps a one-way hash of the address for 24 hours.

E-mail and the contact form

When you write to [email protected] or [email protected], Cloudflare Email Routing forwards the message to our mailbox at Gmail, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process the data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. We use your address and message only to answer you (Art. 6 (1) (b) GDPR for questions about a purchase, otherwise Art. 6 (1) (f) GDPR) and delete them when the matter is settled, unless tax law requires us to keep them.

The contact form sends your name (optional), e-mail address, and message to our license service at license.ldhmr.com, which forwards them as an e-mail to the same mailbox through Cloudflare and keeps no copy. It uses your IP address only in memory to limit repeated messages; it is not stored. The legal bases and deletion are the same as for e-mail.

The apps

The apps process your media only on your computer. They contact the internet only for:

license activation and the weekly check described above;
update checks at releases.ldhmr.com (your IP address and the app version are visible to the server);
downloading tools you ask for (FFmpeg) from their publishers.

Diagnostics reports are created only when you choose to and are sent only if you send them yourself. They leave out your home folder, user name, links, and e-mail addresses; log lines can still name the media files the app worked on.

Transfers outside the EU

Cloudflare is based in the USA and certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing adequate protection (Art. 45 GDPR). Its data processing addendum also contains the European Commission's standard contractual clauses, in case the Data Privacy Framework falls away. Paddle is based in the United Kingdom, for which an adequacy decision of the European Commission exists.

Do you have to provide data?

No data is needed to visit the websites or to try the apps. To buy and use a license, the data described under Purchases and The license service is needed; without it we cannot provide the license.

Your rights

You have the right to access, correct, delete, restrict, and port your data, and to object to processing based on legitimate interests (Art. 15–21 GDPR). Write to us at the address above. You may also complain to a data protection authority, for example the one responsible for us: Sächsische Datenschutz- und Transparenzbeauftragte, Maternistraße 17, 01067 Dresden, Germany.