This is an English translation for your information. Only the German version is binding; where the two differ, the German version applies.

Privacy policy

Last updated: 16 October 2026

This website works without cookies, without tracking and without analytics tools. Fonts and images are on our own server; no data is transferred to third parties when you visit it.

Controller

DIGITALPASSION Ltd.
Tassou Papadopoulou 16, House 2
8270 Tremithousa, Cyprus
support@spacebroom.app

We have not appointed a data protection officer; we are not obliged to do so.

Visiting the website

The website and the licence server run on a server of our hosting provider (Hostinger International Limited, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus) in a data centre in Frankfurt am Main. When you visit, the server processes technically necessary data such as the IP address, the time and the page requested in order to deliver the website and protect it against misuse; we do not keep an access log. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The hosting provider processes the data on our behalf.

Purchase

Payment is made through Link (Sold through Link, LLC, a company of the Stripe group), which handles the payment process for us in its own name. You enter your payment and contact details directly at Link. Link processes them as an independent controller under its privacy policy, also in the USA; for transfers to the USA, Stripe relies on the EU-US Data Privacy Framework and standard contractual clauses, and Link's privacy policy gives the details. From Link we receive the order details, that is the email address and, where applicable, name, address, country and tax number, and the identifiers of the customer, subscription, invoice, checkout and payment. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Without an email address we cannot issue you a licence.

Licence

For your licence we store on our server the email address, the type of licence, the purchase date, the term, the licence identifier, the licence keys issued (they contain the email address), the Stripe identifiers mentioned above, the date and the end of a cancellation, the date of a full refund, chargebacks of a payment with their status and a log of when the licence email was sent or why it was not. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Our server's log records every payment event from Stripe with its outcome (with the identifiers of the licence, payment and chargeback and the term) and errors, including the identifier of a licence whose retrieval failed; it is overwritten after 50 MB.

Emails from us

We send licence keys and the confirmations of our forms through the email delivery service Resend (Resend, Inc., USA) from its Ireland region. Resend processes your email address and the content of the email on our behalf and is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis is the performance of the contract or, for cancellation and withdrawal, our legal obligation to confirm receipt (Art. 6(1)(b) and (c) GDPR).

Forms without logging in

Through "Cancel contracts here", "Withdraw from contract" and "Find your license" we process the details you enter (email address and, where applicable, name, reason, the contract selected and a note), together with the time of receipt, in order to carry out the declaration and to be able to prove its receipt (Art. 6(1)(b) and (c) GDPR). To prevent misuse, we count the requests per IP address and per email address; we delete this count after 24 hours, and it remains in the backups for up to 32 days (Art. 6(1)(f) GDPR).

Backup

Once a day we back up the licence server's data in encrypted form at Backblaze (Backblaze, Inc., USA) in its EU Central region (Amsterdam); we can read the backup only with a key that is not stored on the server, and Backblaze cannot read it. Each backup is locked against deletion for 30 days and is then deleted automatically, after 32 days at the latest. Backblaze is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis is our legitimate interest in being able to restore licences after an outage (Art. 6(1)(f) GDPR).

Emails to us

If you write to us, we use your message and address only to reply (Art. 6(1)(b) or (f) GDPR). Our emails are held by our email provider Fastmail (Fastmail Pty Ltd, Australia), which stores them on our behalf, also in data centres outside the EU, for example in the USA and Australia. There is no adequacy decision for Australia; the transfer is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which Fastmail offers in its data processing agreement. You can obtain a copy on request.

Storage period

We store licence data for as long as the licence can be used, so that you can find it again at any time: for a one-time purchase without a time limit, for a subscription until three years after the end of the year in which it ends (limitation period for claims under the contract). For the same reason, we keep declarations made through the forms and the emails we send about them for three years from the end of the year in which they were received. Whatever is also an accounting record we keep for as long as Cypriot tax law requires, usually six years. We delete emails to us once the matter is settled and none of these periods applies. At your request we delete earlier, unless we are obliged to retain the data; the licence can then no longer be found.

The SpaceBroom app

SpaceBroom has no account and sends no usage data. What the app finds on your Mac stays on your Mac. It connects to the internet in only three cases:

Licence: With a licence, it asks our server at every launch and otherwise at most once a day whether the licence is still valid (we revoke it after a refund or chargeback), and for a subscription also for the renewed licence key; once a subscription has ended more than 30 days ago, it no longer asks on its own. It asks immediately when you enter an expired or revoked key, open the licence window with such a key or start an action that requires a licence. In doing so, it transfers only the licence identifier and fixed details unrelated to you (program name, language "en"); our server sees your IP address. The key itself is checked on your Mac without the internet.
Updates of SpaceBroom: The app asks our website for new versions when you choose "Check for Updates" in the menu, and on its own at most once a day, only if you have agreed to automatic checking. In doing so, it transfers the program name and version number, the version of the update program Sparkle and your system's preferred languages, but no details about your Mac. It downloads a new version only when you install it, from the same website, and installs it only if its signature is valid.
Updates of your programs: For this, the app asks Apple's App Store and the update addresses that your programs specify themselves; these servers see your IP address and which program is being checked. If Homebrew is installed, the app asks it for outdated programs, and at your click Homebrew downloads the new version; what Homebrew itself transfers applies to that.

You buy and renew the edition from the Mac App Store through Apple: Apple handles payment and subscription as an independent controller under its privacy policy, and we receive no personal details about you from Apple. The app checks whether a purchase is valid with Apple through your Apple Account on this Mac, not with us; there is no licence key in that edition. This edition is updated through the App Store, so it does not ask our website for updates and does not use Homebrew. It reads the user folder that you grant it in the folder selection, the list of installed programs in the Applications folder and, in Space Lens, the folder you choose there; it does not read other programs' data in their protected folders.

For the requests to us, what is stated above about visiting the website applies: our hosting provider (Hostinger International Limited, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus) processes the IP address and the time.

Right to object

You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 6(1)(f) GDPR) (Art. 21 GDPR). To do so, write to support@spacebroom.app.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on our legitimate interest (Art. 15 to 21 GDPR). To do so, write to support@spacebroom.app. We do not make automated individual decisions. We do not ask for consent; all processing is based on contract, legal obligation or legitimate interest. You can lodge a complaint with a data protection supervisory authority, for example where you live or with the authority responsible for us: Commissioner for Personal Data Protection, Nicosia, Cyprus (dataprotection.gov.cy).