Privacy policy

Last updated: October 21, 2026. This is a translation; the German Datenschutzerklärung is the binding version.

Controller

Paul Kasten
Kollwitzstraße 76
10435 Berlin
Germany

In short

This website sets no cookies, uses no analytics or tracking tools and loads nothing from third-party servers. Fonts, images and videos are served from our own server.

Hosting and server logs

The website is hosted by Railway Corporation, 548 Market St, PMB 68956, San Francisco, CA 94104, USA. For every request the server processes technically necessary data: IP address, date and time, requested address, amount of data transferred, referrer and your browser's identifier. This serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). The logs are used only for troubleshooting and security, are not combined with other data and are deleted when Railway's retention period ends. A data processing agreement (Data Processing Addendum) with Railway is in place. Transfers to the USA are based on the EU-US Data Privacy Framework, under which Railway is certified, and on the European Commission's Standard Contractual Clauses.

DNS

Name resolution for shadowcursor.com is provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare processes the queries of DNS resolvers to return our server's address (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.

Contact by email

If you write to us, we process your address and your message to answer you (Art. 6(1)(b) and (f) GDPR). We delete the data once your request is settled and no statutory retention period applies.

Purchase and license

Payments run through Stripe Checkout. Payment is handled on our behalf by Link, a Stripe service (Sold through Link, LLC), as merchant of record: Link collects the subscription payments, calculates and remits VAT or sales tax, sends receipts and invoices and helps with questions about charges and refunds. Your contract for ShadowCursor is with us. In Europe, payments are processed by Stripe Technology Europe, Limited, Dublin, Ireland. The payment page is hosted by Stripe; there you enter your email address, payment details, name and billing address, the address to calculate VAT or sales tax. Stripe and Link process this data as independent controllers to handle payment, subscription and tax and to prevent fraud; the Stripe privacy policy and the Link privacy policy apply. From Stripe we receive your email address, a customer and subscription identifier and the payment status, never card or bank details (Art. 6(1)(b) GDPR).

For the trial and the license the app contacts our server. We process a device identifier (a SHA-256 hash of your computer's hardware identifier, which cannot be turned back into it), operating system, app version, trial start, your license key and the devices it is activated on. This is necessary for the trial, the license check and the limit of three devices (Art. 6(1)(b) GDPR). The data is stored on our server at Railway (see hosting) and deleted when it is no longer needed for this and no statutory retention period applies.

Emails about purchase and cancellation

After a purchase we email you your license key with the contract confirmation and the withdrawal notice, and after a cancellation the confirmation of its receipt, each to the email address you gave (Art. 6(1)(b) and (c) GDPR). We send these emails through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as our processor; they are sent from servers in the EU (Ireland). Resend processes your email address and the content of the email for this. A data processing agreement with Resend is in place. Transfers to the USA are based on the EU-US Data Privacy Framework, under which Resend is certified, and on the European Commission's Standard Contractual Clauses.

Cancellation on our website

When you cancel through "Cancel your subscription", we process the details you enter (email address, optionally your license key, type, time and reason of the cancellation), the time of receipt and what we did in response. To find your contract and carry out the cancellation, we look up the subscriptions belonging to your email address at Stripe. We keep the receipt as proof of your cancellation (Art. 6(1)(b), (c) and (f) GDPR) and delete it when it is no longer needed for this, at the latest when the regular limitation period of three years has expired. To prevent abuse we count requests per IP address; this happens in memory only and is forgotten after one hour.

Claude or ChatGPT in the browser

When you turn on the connection for Claude or ChatGPT in the browser in the app, the app keeps a connection to our server, and your AI calls ShadowCursor through https://shadowcursor.com/mcp. We pass your AI's calls and their results (such as screenshots of app windows, controls and typed text) between your AI and your computer in memory only; we neither store nor log their content. We store a hash of your app's device secret, the name of the connected AI, when it was connected and last used, and hashed access tokens. This is necessary to set up and secure the connection you asked for (Art. 6(1)(b) GDPR). When you disconnect a connection in the app, its access tokens are deleted at once. What your AI does with the results is governed by its provider's terms (Anthropic or OpenAI).

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Write to [email protected]. You can also lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.

The app

This policy covers the website. The ShadowCursor app gets its own policy before the download opens.