Privacy Policy

The short version: the 01ST app works locally and we don't collect usage data, analytics or crash reports. We only process the data we need to sell and activate your licence. This page explains the details.

1. Who is responsible

Controller under Art. 4 (7) GDPR:
Mohammad Al Masalmeh, trading as Dotiy
Capitostraße 35, 40597 Düsseldorf, Germany
Email: support@01st.app · Phone: +49 176 70500118

2. This website (01st.app)

Hosting and server logs

The website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you visit, Cloudflare processes technical data needed to deliver and protect the site: your IP address, date and time, the requested file, referrer, browser and operating system. The legal basis is our legitimate interest in a secure and reliable website (Art. 6 (1) (f) GDPR). Cloudflare may process data in the USA; the transfer is based on the EU–US Data Privacy Framework and standard contractual clauses.

No cookies, no tracking

This website does not use cookies, analytics, advertising or tracking tools and does not load third-party scripts. Fonts and media are served from our own server. That's why there is no cookie banner.

Contacting us

If you email us, we process your message and address to answer you (Art. 6 (1) (b) or (f) GDPR) and delete it once the matter is resolved, unless legal retention duties apply.

3. Buying a licence

Clicking “Get Solo”, “Get Duo” or “Get Trio” takes you straight to Stripe's checkout page. Purchases are processed by Stripe, which acts as merchant of record. When you pay, you enter your email address, name, country and payment details directly on Stripe's checkout page. Stripe is responsible for this data and for tax and payment compliance; see stripe.com/privacy. Stripe may process data in the USA and other countries under appropriate safeguards.

After a successful payment, Stripe tells our licensing server that a purchase was completed. We receive and use only your email address, the plan you bought (Solo, Duo or Trio), the payment status and an order reference. We use them to create your licence keys and email them to you (Art. 6 (1) (b) GDPR). The order reference is kept for 30 days to prevent duplicate emails. We do not receive your payment card details.

4. Licence keys and activation

A licence key is a digitally signed text that contains your email address, a random licence ID and the time it was issued. It is signed, not encrypted, so anyone who holds the key can read the email address inside it. Keep your keys private.

When you activate a key, 01ST connects to our activation server (a Cloudflare Worker with Cloudflare KV storage) and sends the key and a device ID. The device ID is a one-way hash (SHA-256) of your Mac's hardware identifier; it can't be turned back into the identifier and doesn't contain your name. The server stores, per licence ID, which device IDs are active and when a licence was moved to another Mac. This is needed to enforce the number of Macs covered by your plan and to let you move your licence (Art. 6 (1) (b) GDPR). The data is kept while your licence is valid; you can ask us to delete it at any time. When you choose “Deactivate” in the app, the device ID is removed.

Cloudflare processes your IP address when the app connects, as described in section 2. We do not link IP addresses to licences.

5. Email delivery

We send licence emails through Resend (Resend, Inc., San Francisco, USA) as a processor under a data processing agreement. Resend receives your email address and the content of the email, including your keys, for delivery (Art. 6 (1) (b) GDPR). Transfers to the USA rely on the EU–US Data Privacy Framework and standard contractual clauses.

6. The 01ST app on your Mac

01ST has no analytics, no telemetry and no crash reporting. What you put into 01ST is stored on your Mac and is not sent to us:

• Moodboards, notes and clipboard history are saved in a folder named “FIRST” inside your Documents folder. If you use iCloud Drive with “Desktop & Documents”, macOS may sync that folder to your own iCloud account. This is a macOS setting under your control, not something 01ST does.
• Clipboard history keeps text, images and files you copy. 01ST skips items that password managers mark as confidential, and anything copied from well-known password manager apps. Even so, clipboard history can contain sensitive content: use “Clear” in the Clipboard tab to delete it.
• Calendar: if you allow access, 01ST reads and edits events through Apple's calendar system. The data is shown on your Mac only.
• Music: 01ST reads the currently playing track from macOS, and from Spotify and Apple Music if you allow automation, to show it in the app.
• Dropped links: when you drop a link, 01ST requests the page or image directly from the linked site (for Pinterest links, via Pinterest's public preview service). That site can see your IP address.
• Web apps: you can pin services such as Spotify, WhatsApp or Notion. They open the provider's website inside 01ST. The provider processes your data under its own privacy policy, and cookies for these sites are stored by the built-in browser on your Mac. We have no access to them.
• Updates: once a day, 01ST asks 01st.app for the latest version (a small file, appcast.xml). The request carries your IP address and the version of 01ST you run, as with any web request; we don't use it to identify you. Updates are downloaded from 01st.app and their signature is verified before they are installed. You can turn the automatic check off in Settings → Updates.
• Activation: the other connection to our own server is the licence activation described in section 4.

You can remove all local data by deleting the “FIRST” folder in Documents and the “FIRST” folder in Application Support.

7. Retention

We keep data only as long as needed for the purposes above. Stripe keeps payment and invoice records for the periods required by tax and commercial law. Licence activation data is kept while the licence is valid and deleted on request, unless we have a legal duty to keep it.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Contact us at support@01st.app. You also have the right to lodge a complaint with a supervisory authority. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

9. Changes

We may update this policy when the app or our services change. The current version is always available on this page, with the date at the top.