Privacy Policy

Last updated: May 30, 2026

⚠️ Draft — review before launch. This is a starter policy. Have it reviewed by a qualified advisor and replace every [bracketed] placeholder with your real legal details before going live.

1. Who we are

TheFile.Ninja ("we", "us") is operated by [Company legal name], [registered company number], [registered address, Sweden]. For any privacy question, contact [support@thefile.ninja].

We are the data controller for the personal data described below under the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act.

2. Our principle: local-first, minimal data

The TheFile.Ninja desktop application is local-first. It does not phone home, track usage, or upload your files. AI features use your own API key and talk directly to your chosen provider — we never see those queries. This policy covers only the data handled by this website and licensing service.

3. What we collect and why

  • Email address — when you request a free license (/free) or create an account (/account). Used to deliver your license, let you sign in, and notify you about license expiry. Legal basis: performance of a contract and our legitimate interest in operating the service.
  • IP address — recorded when a free license is issued, to prevent abuse of the free offer. Legal basis: legitimate interest (fraud prevention).
  • Payment data — when you purchase, payment is processed by Stripe. We receive transaction metadata (amount, status, receipt URL) but never your full card number. Legal basis: performance of a contract.
  • License & activation data — license keys, tier, machine name and fingerprint of activated machines, so you can manage your devices. Legal basis: performance of a contract.

4. Processors we share data with

We use the following sub-processors to run the service:

  • Stripe — payment processing.
  • Supabase — authentication and database storage of accounts and licenses.
  • Resend — transactional email delivery (your license, expiry notices).
  • Vercel — website hosting and delivery.
  • Google Fonts — web fonts are loaded from Google's CDN, which receives your IP address as part of the request.

We do not sell your personal data or share it for advertising. Some processors may store data outside the EU/EEA under appropriate safeguards (e.g. Standard Contractual Clauses).

5. Cookies & local storage

We do not use advertising or analytics cookies. The account area uses your browser's localStorage to keep you signed in and to remember a pending purchase. These are strictly necessary for the service to function.

6. How long we keep it

We keep account, license, and transaction records for as long as your account exists and as required by Swedish accounting law (typically up to [7 years] for invoicing data). Free-license records are kept to enforce the one-per-person limit. You can request deletion of data not required by law at any time.

7. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you;
  • Rectify inaccurate data;
  • Erase your data ("right to be forgotten"), where not legally required to keep it;
  • Restrict or object to processing;
  • Data portability;
  • Withdraw consent at any time.

To exercise any right, email [support@thefile.ninja]. You also have the right to lodge a complaint with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY).

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "last updated" date above.