Privacy policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data (“data”) within our online offering at webdonkey.io — the shop, the customer account and the accompanying pages — as well as within our desktop application WebDonkey for macOS (“the app”). For the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

BuI Hinsche GmbH
Neumarkt 7
06712 Zeitz, Germany
Email: info@webdonkey.io
Represented by the managing directors: Matthias Hinsche, Yvonne Hinsche
Imprint

In short: WebDonkey is a local development environment

WebDonkey is deliberately built to work without us. The app contains no advertising, analytics or tracking functions. We do not record which pages you open in the app, which projects, domains, databases, files or credentials you create, or which services you start. That data stays exclusively on your machine and is never transmitted to us.

The app contacts our server only in the clearly defined cases described below: licence verification, checking for updates and loading the release notes, and — if you actively use these features — the shared theme presets.

Beyond that, the app connects directly to third-party services without our involvement and without any data reaching us; the respective provider receives your IP address, and its privacy notices apply:

When installing and updating software and when looking for new versions, the official sources of the respective manufacturers (e.g. Homebrew, npm, GitHub, Packagist, mirrors for Linux images).
For the tool logos in the overview, the websites of the respective manufacturers or their GitHub profiles.
Only if you use the feature concerned: the icon search Iconify (api.iconify.design, including your search term), the component libraries shadcn/ui, Magic UI, Kibo UI and uiverse (via GitHub), the CDNs esm.sh and jsDelivr for the live preview of React components (including the names of the packages required), and for domain monitoring the directory service rdap.org (including the monitored domain name).
For the AI features: the app downloads models from registry.ollama.ai or huggingface.co. Chats with local models stay on your machine. If you pick an Ollama cloud model under “More models”, your prompts go to Ollama (Ollama Inc., USA). The coding agents in the terminal (e.g. Qwen Code, Aider, Codex, OpenCode) are programs of their vendors which the app installs and starts at your request; if you connect them to a cloud provider, your prompts and the code the tool reads go to that provider, and its terms apply. WebDonkey starts these tools with usage statistics switched off wherever the vendor offers a switch for it.
For features in which you specify a target yourself — such as connections to your own servers, checks of your websites or pages in the built-in browser — the target you chose.

Types of data processed

Inventory data (e.g. names, addresses)
Contact data (e.g. email addresses, telephone numbers)
Contract and payment data (e.g. orders, subscriptions, terms, payment history)
Content data (e.g. text entered in forms, problem reports, submitted theme presets)
Licence and device data (e.g. licence key, device name, device id, app version, operating system version)
Usage data (e.g. websites visited, times of access)
Meta/communication data (e.g. IP addresses, browser type)

Categories of data subjects

Visitors and users of our online offering, users of the app, as well as customers, prospective customers and business partners (together “users”).

Purposes of processing

Provision of the online offering, its functions and content
Provision of the app as well as verification and administration of licences
Processing of orders, subscriptions and payments
Handling of support and problem reports and communication with users
Security measures and prevention of misuse

Relevant legal bases

In accordance with Art. 13 GDPR we inform you of the legal bases of our data processing. Where the legal basis is not stated in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing in order to perform our services and carry out contractual measures as well as to respond to enquiries is Art. 6(1)(b) GDPR; the legal basis for processing in order to fulfil our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing in order to safeguard our legitimate interests is Art. 6(1)(f) GDPR.

Cooperation with processors and third parties

If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them or otherwise grant them access to the data, this is done only on the basis of legal permission (e.g. where a transfer of data to third parties such as payment service providers is necessary to perform the contract pursuant to Art. 6(1)(b) GDPR), where you have consented, where a legal obligation provides for it, or on the basis of our legitimate interests. Where we commission third parties to process data on the basis of a data processing agreement, this is done on the basis of Art. 28 GDPR.

Transfers to third countries

Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this occurs in the course of using third-party services or disclosing or transmitting data to third parties, this only happens where it is necessary to perform our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Subject to statutory or contractual permission, we process data in a third country only where the special requirements of Art. 44 et seq. GDPR are met — for instance on the basis of special safeguards such as an officially recognised finding of a level of data protection equivalent to that of the EU (e.g. for the USA through the EU-US Data Privacy Framework) or compliance with officially recognised special contractual obligations (“standard contractual clauses”).

Rights of data subjects

You have the right to obtain confirmation as to whether data concerning you is being processed, to obtain access to that data and to further information and a copy of the data in accordance with Art. 15 GDPR
In accordance with Art. 16 GDPR you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you
In accordance with Art. 17 GDPR you have the right to request that data concerning you be erased without undue delay, or alternatively, in accordance with Art. 18 GDPR, to request a restriction of processing
You have the right to receive the data concerning you that you have provided to us in accordance with Art. 20 GDPR and to request its transmission to other controllers
You also have the right under Art. 77 GDPR to lodge a complaint with the competent supervisory authority

Right of withdrawal of consent

You have the right to withdraw consent given in accordance with Art. 7(3) GDPR with effect for the future.

Right to object

You may object to the future processing of data concerning you in accordance with Art. 21 GDPR at any time. In particular, you may object to processing for direct marketing purposes.

Cookies

“Cookies” are small files stored on users' computers. A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or after their visit to an online offering. Temporary cookies, or “session cookies”, are cookies that are deleted after a user leaves an online offering and closes their browser. Cookies described as “permanent” or “persistent” remain stored after the browser has been closed.

On webdonkey.io we use exclusively technically necessary cookies: a session cookie for the shopping basket and the order process, a cookie for the login status in the customer account, and cookies to secure forms. We do not use cookies for advertising, tracking or audience measurement, and we embed no third-party advertising networks or analytics services.

In addition, two cookies let the shop remember your country and your choice of shop. wd_country contains a country code (such as “DE”), which we derive from your browser's language settings on your first visit. It determines the currency shown (euros in the European Union, US dollars otherwise), the VAT prices are shown with, and, for Germany, Austria and Switzerland, the one-time redirect from the English to the German version of the shop. wd_shop_choice is set when you pick a shop yourself using the language switcher, and prevents any automatic redirect from then on. The cookie timezone stores your browser's time zone so that times in the shop appear in your local time. Both country cookies are valid for one year, contain no identifier by which we could recognise you, and are neither analysed nor passed on to third parties. They are required to show the prices that apply to you and are therefore set without separate consent (Section 25(2) No. 2 TDDDG). Once you are signed in, currency and VAT follow your address.

Under “Technically required”, the cookie dialog also lists entries for PayPal and Google Pay payments. They come from installed payment extensions. We do not currently offer these payment methods (see “Subscriptions and payment processing”), so no data is transmitted to PayPal or Google through them.

If you do not wish cookies to be stored on your computer, you can deactivate the corresponding option in your browser settings. Stored cookies can be deleted in the browser settings. Excluding cookies may lead to functional restrictions of this online offering; in particular, login and the order process will not be usable.

Erasure of data

The data we process is erased or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated within this privacy policy, the data stored by us is erased as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent erasure. Where data is not erased because it is required for other and legally permissible purposes, its processing is restricted — that is, the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

Under statutory requirements in Germany, retention is in particular for 6 years pursuant to § 257(1) of the German Commercial Code and for 10 years pursuant to § 147(1) of the German Fiscal Code.

Hosting

The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, security services and technical maintenance services which we use for the purpose of operating this online offering.

In doing so, we and our hosting provider process inventory data, contact data, content data, contract data, usage data and meta and communication data of customers, prospective customers and visitors to this online offering on the basis of our legitimate interests in the efficient and secure provision of this online offering pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement). Our servers are located in Germany.

Collection of access data and log files

We and our hosting provider collect data about every access to the server on which this service is located (server log files) on the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR. The access data includes the name of the web page accessed, the file, the date and time of access, the volume of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider. This also applies to the requests the app makes to our interfaces (licence verification, updates, theme presets).

Log file information is stored for security reasons (e.g. to investigate misuse or fraud) for a maximum of 7 days and then deleted. Data whose further retention is necessary for evidentiary purposes is exempt from erasure until the respective incident has been finally resolved.

Licensing and device management in the app

When you redeem a Premium licence, the app registers with our licence server and checks at start, then roughly every ten minutes and on quit whether the licence is still valid and how many devices are currently using it. The purpose of this processing is to perform the contract concluded with you and to enforce the agreed number of devices that may be used simultaneously (“seats”); the legal basis is Art. 6(1)(b) GDPR as well as our legitimate interest in preventing unauthorised use pursuant to Art. 6(1)(f) GDPR.

The following data is transmitted to us and stored in association with your customer account:

Your licence key and a randomly generated installation id. We store the licence key in your customer account so that you can look it up there at any time; checks use a hash value of the key
A device id (“fingerprint”). This is a non-reversible SHA-256 hash formed from your Mac's hardware id and your user name. The underlying values themselves never leave your machine and cannot be derived from the hash
The device name of your Mac, so that you can distinguish your devices in your customer account and sign them out individually. Please note: by default, Macs often carry a name containing your first name (e.g. “Anna's MacBook Pro”). You can change the device name at any time in the macOS System Settings
The version of the app and the operating system platform used (e.g. “macos-aarch64”), so that we can provide support and ensure compatibility
The time of the last check-in as well as licence events (activation at start, sign-out on quit, device change and blocking). We keep these events for 90 days so that we can answer questions about your licence, and then delete them automatically

Contents of your projects are not transmitted. If a licence is used on more devices than agreed, the app shows on the devices concerned the name and the time of last use of the other device, so that the conflict can be resolved. If you share a licence with other people, they can therefore see the device name. You can sign a device out at any time in your customer account or in the app; it then no longer occupies a seat, but the entry remains visible in your customer account. We delete the device and licence entries when you delete your customer account or request their deletion, unless statutory retention obligations prevent this. If no connection to our server is possible, the Premium functions remain usable until the end of the billing period confirmed at the last successful check plus three days (§ 6 of the Terms); the Free scope remains usable without a connection as well.

Updates

At start and then every 24 hours the app asks our server whether a newer version is available; this also applies without a licence. In doing so, the installed version, the platform and the processor architecture are transmitted, and the technical access data is processed on the server side (see “Collection of access data and log files”). If you open the release notes in the app, it loads them from our server as well; only the requested language is transmitted. No association with your person or your customer account takes place. How we count these requests and how long we keep the entries is described under “Audience and download statistics”. The legal basis is our legitimate interest in the secure and up-to-date provision of the software pursuant to Art. 6(1)(f) GDPR.

Shared theme presets and their counter

In the app you can publish colour presets you have created yourself (“theme presets”) and adopt presets created by other users. You only use this feature if you actively call it up.

When publishing, we transmit the name of the preset, the icon chosen and the colour values used, as well as your licence key. We store the licence key on the preset only as a hash value in order to enforce submission limits and to allow you to withdraw your own submissions as long as they have not been approved. Approved presets stay in the gallery; we delete them on request, and if you delete your customer account we remove the hash value from your presets. The public gallery does not show who submitted a preset; for other users the submission cannot be attributed to you. As the operator, however, we are technically able to attribute it to your customer account, because the same hash value is also associated with your licence. We use this possibility exclusively to enforce submission limits, to handle your own enquiries and to remove unlawful content. Published presets are reviewed by us before release. The legal basis is Art. 6(1)(b) GDPR (performing the function you requested) as well as Art. 6(1)(f) GDPR with regard to the prevention of misuse.

For the purpose of sorting by popularity we maintain a counter per preset showing how many people have adopted it. The app transmits solely the id of the preset concerned — neither your licence key, nor a device id, nor an id of your customer account. Only an incremented total is stored on the preset itself in the database.

So that the same request is not counted more than once, when the request arrives we form a non-reversible hash value from your IP address, the user agent transmitted and the id of the preset. This hash value is held exclusively in a volatile cache, expires automatically after one week and is never written to the database or combined with the counter, your customer account or your licence. The same procedure serves to limit abusively frequent requests. No usage profile is created as a result, and no cookie is set. The legal basis for this processing is our legitimate interest in meaningful sorting and in preventing misuse pursuant to Art. 6(1)(f) GDPR.

Problem and support reports

If you report a problem to us via the app or the shop, we process your information in order to handle the matter pursuant to Art. 6(1)(b) GDPR. We store the fields you complete — category, title, description, error message, steps to reproduce and expected behaviour — as well as accompanying technical information such as the app version, operating system version, the page concerned, browser and language. If you are logged in, we associate the report with your customer account so that you can view the history in your account. Please do not include any credentials or personal data of third parties in the free-text fields.

In order to process your report we send it by email to our internal support address; that message contains your name and email address as well as the content of the report. We notify you of replies and status changes by email unless you object.

We publish some of the reported problems in a public overview of known issues. For this we always write our own neutral text; your own entries and all information about your person are not published.

If you delete your customer account, we dissolve the link between the report and your account. The text you wrote is initially retained so that the technical analysis of a reported fault remains traceable. You can request the complete erasure of your reports at any time informally.

If you write a report as a member of a company account (see “Company accounts and team members”), we additionally assign it to that company account: the company account sees the report with your name, can reply in the thread, and a bonus for the report goes to the company account.

Order processing in the online shop and customer account

We process our customers' data in the course of ordering in our online shop in order to enable them to select and order the chosen products and services as well as to pay for and receive them.

The data processed includes inventory data, communication data, contract data and payment data; the data subjects are our customers, prospective customers and other business partners. Processing takes place for the purpose of providing contractual services in the course of operating an online shop, billing and customer service. For this we use session cookies to store the contents of the shopping basket and permanent cookies to store the login status.

Processing takes place on the basis of Art. 6(1)(b) (carrying out order processes) and (c) (legally required archiving) GDPR. The information marked as required is necessary for establishing and performing the contract. We disclose data to third parties only in the course of payment processing or within the scope of statutory permissions and obligations towards legal advisers and public authorities.

Users can create a user account in which they can view in particular their orders, their licences and the associated devices. The required mandatory information is communicated during registration. User accounts are not public and cannot be indexed by search engines. If users have terminated their user account, their data relating to the user account is deleted, subject to any retention necessary for commercial or tax law reasons pursuant to Art. 6(1)(c) GDPR. It is incumbent on users to back up their data before the end of the contract once termination has taken place.

In the course of registration, renewed logins and use of our online services, we store the IP address and the time of the respective user action. Storage takes place on the basis of our legitimate interests as well as those of users in protection against misuse and other unauthorised use. This data is generally not passed on to third parties unless necessary to pursue our claims or unless there is a legal obligation to do so pursuant to Art. 6(1)(c) GDPR.

Erasure takes place after the expiry of statutory warranty and comparable obligations; the necessity of retaining the data is reviewed every three years. In the case of statutory archiving obligations, erasure takes place after their expiry (end of the commercial law (6 years) and tax law (10 years) retention obligation).

Company accounts and team members

A company account (a customer account with the account type “commercial”) can invite team members by email and let them view licence keys; the licence remains managed by the company account. For the invitation we process the email address entered and send it a message naming the email address and company name of the inviting account. The legal basis is Art. 6(1)(b) GDPR in relation to the company account and our legitimate interest in carrying out the invitation pursuant to Art. 6(1)(f) GDPR. Until consent is given, the company account learns nothing about the invited person except the address it entered itself.

Only once the invited person agrees in their own customer account, which uses exactly this email address, does the company account see their name and email address, can share licence keys with them, and are reports they write as a member assigned to the company account (see “Problem and support reports”). The legal basis is consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time by leaving under “Team” in your customer account; this does not affect the lawfulness of the processing carried out until then. Shared licence keys are renewed when you leave. Reports already written remain assigned to the company account, because it needs to be able to follow up on problems reported under its licences (Art. 6(1)(f) GDPR).

Open invitations expire after 14 days. We delete ended invitations and memberships (declined, withdrawn, expired, left, removed) 90 days after they end; until then the company account sees the invited address and the status. If the customer account of an invited person is deleted, we remove their address from the membership by the following day at the latest.

Subscriptions and payment processing

For chargeable licences and subscriptions we use the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. We currently offer credit and debit card and Apple Pay, both via Mollie. With Apple Pay, Apple is also involved; the Apple Pay privacy notice applies to that. If you choose a payment method processed via Mollie, the data required for payment (e.g. name, email address, invoice amount, payment data) is transmitted to Mollie and processed there under its own responsibility. Your full payment details (e.g. credit card or account data) are collected by Mollie and are not available to us; we receive only the information necessary for allocation and billing, such as payment status, mandate and subscription ids. The legal basis is Art. 6(1)(b) GDPR. Further information can be found in Mollie's privacy policy at https://www.mollie.com/gb/privacy.

For ongoing subscriptions we additionally process terms, renewal dates, bonuses granted and — if you take part in our partner or referral programme — the attribution of referred orders to your account, in order to settle the agreed remuneration and benefits. The legal basis is Art. 6(1)(b) GDPR.

If we offer you a bonus or an amended subscription condition and you accept that offer in your customer account, we log the time of acceptance, the text to which you agreed, the amounts concerned and the IP address from which the acceptance was made, in order to evidence your consent. The purpose is to evidence your consent to the changed payment obligation; the legal basis is our legitimate interest in the provability of contractual declarations pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 6(1)(b) GDPR. We delete these records after the expiry of the statutory retention and limitation periods.

Sign in with Google

You can optionally sign in to our shop using your Google account (“Sign in with Google”). If you use this option, you are redirected to Google; the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. After you consent there, Google transmits to us the information in the scope “openid email profile”, in particular your Google id, your verified email address and your first and last name. We use this data exclusively to identify you and to create a customer account or log you into an existing one. We store the Google id with your customer account for as long as it exists, so that you can sign in with Google again; it is deleted with the account. We reject unverified email addresses. The legal basis is Art. 6(1)(b) GDPR as well as your consent pursuant to Art. 6(1)(a) GDPR. Using this sign-in method is voluntary; you can equally register with an email address and password. Further information: https://policies.google.com/privacy.

Discord community

We operate a Discord server for discussion around WebDonkey. The provider is Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands (for users in the EEA); the parent company Discord Inc. is based in the USA.

If you link your customer account with your Discord account, to obtain the “Verified” role (no licence is needed for it), we generate a linking code that expires after seven days and, once redeemed, store your Discord user id and your Discord user name in association with your customer account. To Discord we transmit exclusively the instruction to assign or remove the relevant role for the Discord id concerned — that is, the information that a customer account with us belongs to this Discord id. We do not transmit your name, your email address, your customer number or your orders to Discord. Linking is voluntary and can be undone at any time; the stored linking data is then deleted, as it is if you delete your customer account. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

If you submit a feature request via our Discord server, we store your Discord user id, your Discord user name and the text of your request in order to process the suggestion and ask follow-up questions. Your suggestion is published in the relevant channel of the server naming your Discord account; it can therefore be attributed to you by all members of the server. These entries are not linked to your customer account and therefore remain in place even if you delete your customer account or the Discord link. You can request the deletion of an entry at any time informally. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give by submitting the request.

Discord is responsible for your use of the Discord service itself — your account, your messages and the connection data arising in the process: https://discord.com/privacy.

Provision of contractual services

We process inventory data (e.g. names and addresses as well as contact data of users) and contract data (e.g. services used, names of contact persons, payment information) for the purpose of fulfilling our contractual obligations and services pursuant to Art. 6(1)(b) GDPR. Entries marked as mandatory in online forms are required for the conclusion of the contract.

Administration, financial accounting, office organisation, contact management

We process data in the course of administrative tasks as well as the organisation of our business, financial accounting and compliance with legal obligations such as archiving. In doing so we process the same data that we process in the course of providing our contractual services. The bases for processing are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. Customers, prospective customers, business partners and website visitors are affected by the processing. The purpose and our interest in the processing lie in administration, financial accounting, office organisation and archiving of data — that is, tasks that serve to maintain our business activities, perform our duties and provide our services. Erasure of data relating to contractual services and contractual communication corresponds to the information given for those processing activities.

Audience and download statistics

We wish to know how often our pages are accessed and how often the app is downloaded and updated. For this we use no analytics service and no tracking cookies; instead we evaluate the accesses to our own server that occur in any case — partly directly at the time of access, partly by subsequently evaluating the server log files.

So that repeat accesses are not counted more than once, we form a non-reversible hash value from your IP address, the user agent and a secret key known only to us. Stored are exclusively this hash value and the date; for downloads additionally the program version and the type of download, and for update requests the app version and the platform. The IP address and user agent themselves are not stored in these statistics. The hash value cannot be reversed without our secret key; nevertheless we treat it as pseudonymous and therefore personal data. It is not combined with your customer account, your licence or your orders, and we do not pass this data on to third parties. We keep the entries for update requests for 90 days. After that, only daily totals per app version and platform remain, without the hash value.

Downloading the app requires a customer account and is limited to ten downloads per customer account and calendar day, so that the app is not pulled in bulk through one account. For this we count the downloads per day under a non-reversible hash value that we form from the internal identifier of your customer account and a secret key known only to us. Only this hash value, the date and the count are stored; we delete the count after three days at the latest. It serves this limit only and is not combined with the statistics described above. The legal basis is our legitimate interest in protecting our offering against misuse pursuant to Art. 6(1)(f) GDPR.

The legal basis is our legitimate interest in designing our offering to meet demand and in obtaining reliable information about its use pursuant to Art. 6(1)(f) GDPR. You may object to this processing under Art. 21 GDPR; please contact the address given above.

Business analyses

In order to operate our business economically, we evaluate the data available to us on business transactions, contracts and enquiries. In doing so we process inventory data, contract data and payment data on the basis of Art. 6(1)(f) GDPR. These evaluations serve us alone and are not disclosed externally unless they are anonymous analyses with aggregated values.

Contacting us

When you contact us (e.g. via a contact form, email or our community channels), the user's information is processed in order to handle the enquiry and process it pursuant to Art. 6(1)(b) GDPR. Users' information may be stored in a customer relationship management system (“CRM system”) or comparable enquiry organisation.

Sending emails

To send system and service emails (e.g. order confirmations, invoices, replies to problem reports, information about your subscription) we use the mail server of our hosting provider located in Germany. Transmission is encrypted. The legal basis is Art. 6(1)(b) GDPR. We do not use counting or tracking pixels in our emails and we measure neither open nor click rates.

Status of this privacy policy

We adapt this privacy policy as soon as changes to our online offering or to the app require it. The version published on this page applies.

Version: 30 September 2026