Privacy Policy

Last updated: May 18, 2026

1. Introduction and Data Controller

This Privacy Policy describes how Josh Lord, d/b/a Batchy & Friends ("we", "us", "our"), located in Washington State, USA, collects, uses, and protects your personal information when you use our website and software.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, we are the data controller. You can contact us at [email protected].

2. Data We Collect

Purchase Data

When you purchase Batchy, your name, email address, and payment information are collected and processed by Lemon Squeezy, our payment processor and Merchant of Record. We receive your name, email address, and license key. We do not receive or store your full payment details (credit card numbers, etc.).

Crash and Bug Reports

If you choose to submit a crash or bug report through the in-app reporting feature, we collect your app version, operating system version, crash logs, and any description you provide. These reports are sent voluntarily. They may contain incidental personal information such as file paths that could reveal project names, audio file names, plugin configurations, or other information about your working environment (e.g., system usernames in file paths). Reports are stored in a private GitHub repository accessible only to the development team.

Website Analytics and Ad Attribution

We use Cloudflare Analytics to understand how visitors use our website. Cloudflare Analytics is cookieless and does not collect personal identifiers. It collects aggregated data such as page views, referring sites, country, and device type.

We do not load Google Analytics, Google Ads, or Google Tag Manager until you consent to optional Google cookies. If you consent, Google may collect your IP address, browser user-agent, device identifiers, click timestamps, pages visited, session duration, scroll depth, outbound link clicks, device type, browser, operating system, screen resolution, and approximate location. We use this to measure advertising effectiveness and improve the website. This data is subject to Google's Privacy Policy. You can withdraw consent using Cookie Preferences, and we treat Global Privacy Control (GPC) browser signals as an opt-out.

Newsletter

If you choose to subscribe to our newsletter, we collect your email address. Newsletter signup is a separate opt-in and is not bundled with the purchase process.

License Validation Data

The Batchy application periodically validates your license by contacting our licensing provider (Lemon Squeezy). During validation, the following data is transmitted: your license key and activation identifier. This occurs automatically approximately every 24 hours while the application is running. If the application cannot reach the license server for 7 consecutive days, it enters read-only mode until connectivity is restored.

Machine Identification

When you activate a license, your computer name, operating system, and a unique machine identifier are sent to Lemon Squeezy to register your activation. The machine identifier and activation data are also stored locally on your computer in an encrypted file.

Auto-Update Checks

The application periodically checks for software updates using the Sparkle framework (macOS) or WinSparkle (Windows). These checks transmit your IP address, operating system version, and current application version to our update server.

Giphy Integration

The GIF node feature allows you to search for animated GIFs via the Giphy API. When you use this feature, your search queries and IP address are sent to Giphy (giphy.com). Giphy has its own privacy policy governing the use of this data. This feature is entirely optional and only activates when you explicitly search for GIFs.

Local Data Storage

The application stores licensing data locally on your computer, including: license key, associated email address, machine identifier, activation identifier, trial start date, and last validation timestamp. This data is stored in an encrypted file in your system's application support directory.

Anonymous Trial Downloads

When you download the free trial from our website, we collect the platform requested (macOS or Windows), basic request metadata needed to deliver the file and prevent abuse, and any Google click identifier only if it is present and your cookie consent allows it. Website trial downloads do not require or collect your email address.

Email-Backed Trial Activation

When you start a trial in the application and provide an email address there, we receive an activation ping containing your email address, a randomly-generated installation identifier, trial start timestamp, application version, platform, and country inferred from IP address. We use this to operate the trial service, prevent abuse, and send trial-start service email. We send reminder, offer, or product-news emails only where you have separately consented.

3. Lawful Basis for Processing (GDPR)

For users in the EU and UK, we process your data under the following legal bases:

• Consent (Art. 6(1)(a)) — newsletter signup, marketing trial reminder or offer emails, and optional Google analytics and advertising attribution.
• Legitimate interests (Art. 6(1)(f)) — download delivery, abuse prevention, expiry enforcement, crash and bug reports, and cookieless Cloudflare Analytics.
• Contract (Art. 6(1)(b)) — purchase fulfillment, license management, invoice and tax records, and trial-start service emails when you provide an email address to start a trial.

4. How We Use Your Data

We use the information we collect to:

• Fulfill purchases and deliver license keys
• Provide customer support
• Improve the software using crash and bug report data
• Send product updates via newsletter (only with your consent)
• Send trial-start service emails when you provide an email address to start a trial, and send reminder or offer emails only when you opt in to marketing
• Validate your license to prevent unauthorized use
• Check for and deliver software updates
• Understand website usage through aggregated analytics
• Measure the performance of advertising campaigns and landing pages

5. Confidentiality of Crash Reports

We treat all data in crash and bug reports as confidential. Crash reports may incidentally contain file paths, project names, audio file names, or plugin configurations from your working environment. We will not share crash report data with third parties or use it for any purpose other than improving the software.

6. Trial Downloads and Optional Email

This section provides additional detail about website trial downloads, newsletter signup, and email-backed app trial activation.

Anonymous website trial downloads

Website trial downloads can be started without providing an email address. When you click a trial download, we collect the requested platform, basic request metadata needed to deliver the file and prevent abuse, and any Google click identifier only if it is present and your cookie consent allows it.

Newsletter signup

If you subscribe to the Batchy newsletter, we collect your email address and use it to send occasional product announcements, release notes, and offers. Newsletter signup is separate from the trial download flow.

Email-backed app trial activation

If you start a trial in the application and provide an email address there, we collect your email address, a randomly-generated installation identifier, trial start timestamp, application version, platform, and country inferred from IP address. We use the email address to send trial-start service email related to the trial. Reminder, offer, or product-news emails are sent only when you separately opt in to marketing.

Lawful basis

Consent (GDPR Art. 6(1)(a)) applies to newsletter signup, marketing trial reminder or offer emails, and optional Google analytics and advertising attribution. Legitimate interests (GDPR Art. 6(1)(f)) apply to delivering trial downloads, preventing abuse, and enforcing trial expiry. Contract (GDPR Art. 6(1)(b)) applies to trial-start service email when you provide an email address to start a trial. Downloading the trial does not create any obligation to provide your email address.

Purpose and email cadence

We use newsletter signup emails for occasional product announcements, release notes, and offers. If you provide an email address during in-app trial activation, we send a welcome or trial-start service email related to that trial. If you also opt in to marketing, we may send a reminder near the end of your 30-day trial, a one-time promotional offer, and occasional product updates. You can unsubscribe from marketing emails at any time using the unsubscribe link in every marketing email.

Retention

We retain newsletter and trial email addresses until you unsubscribe or request erasure. Anonymous app trial activation records are retained for 24 months from trial start. After unsubscribing, we stop sending marketing emails but retain a suppression record (a stored indicator that you have opted out) to prevent accidental re-subscription. After an erasure request, your email address is removed from our records and replaced with a non-reversible deletion marker. Audit metadata about when the request was processed (timestamp and request type) is retained for legal compliance.

Third-party sub-processors

Email addresses and related signup or activation data may be shared with:

• Lemon Squeezy — subscriber list management
• Resend — email delivery

How to unsubscribe

Every marketing email we send includes an unsubscribe link. Click it at any time to stop receiving marketing emails immediately.

How to request erasure

Email [email protected] with your request. We will remove your email address from our records and replace it with a non-reversible deletion marker within one calendar month.

7. Third-Party Processors

We share your data with the following third-party service providers, each of which has their own privacy policy:

• Lemon Squeezy — payment processing and licensing (Merchant of Record)
• Cloudflare — website hosting, DNS, and analytics
• Google — advertising attribution and conversion measurement (Google Ads); website analytics (Google Analytics 4)
• Resend — transactional and newsletter email delivery
• GitHub — crash report storage (private repository, accessible only to the development team)
• Giphy — GIF search within the application (optional feature, user-initiated)

We do not sell personal information for money, and we do not share personal information with third parties for their independent marketing. If you consent to Google advertising or analytics cookies, Google may process identifiers and site activity for advertising measurement and reporting. Depending on the law that applies to you and Google's processing settings, this may be considered "sharing" for cross-context behavioral advertising. You can opt out by declining optional cookies, using Cookie Preferences, or enabling Global Privacy Control (GPC).

8. Data Retention

• Trial subscribers who never activate — 12 months from last interaction.
• Activated trial, never purchased — 24 months from trial start.
• Marketing consent — until withdrawal + 3 years suppression.
• Trial activations audit (email anonymized post-erasure) — 24 months.
• Anonymous app trial activations — 24 months from trial start.
• Purchasers — life of license + 7 years (tax requirement).
• Crash reports — 90 days.
• Google Ads cookies — up to 90 days (set by Google, only with your consent).

9. Your Rights (GDPR — EU/UK Users)

If you are located in the EU or UK, you have the following rights under the GDPR:

• Access your personal data
• Rectify inaccurate personal data
• Request deletion of your personal data
• Request portability of your personal data
• Withdraw consent at any time (for consent-based processing)
• Restrict processing of your personal data
• Lodge a complaint with your local supervisory authority

To exercise these rights, email [email protected]. We will respond within one calendar month. This period may be extended by two additional months for complex requests, in accordance with Art. 12(3) GDPR.

Right to erasure (Art. 17): submit a request via /privacy/delete or email [email protected]. We respond within 30 days. Your email is removed from our subscribers database; anonymized hash retained in audit records.

Right of access (Art. 15): request a copy of your data via /privacy/export or email.

Objection (Art. 21): you may object to the trial activation ping and associated installation record by emailing [email protected]; we will delete the installation record.

10. Your Rights (US Users)

We do not sell personal information for money, and we do not share personal information with third parties for their independent marketing.

If you are a California resident (CCPA/CPRA), you may request to know what personal data we hold about you and request its deletion. Contact [email protected] to exercise these rights.

Do Not Sell or Share / Advertising Choices. If you consent to optional Google advertising or analytics cookies, Google may process identifiers and site activity for advertising measurement and reporting. Depending on the law that applies to you and Google's processing settings, this may be considered "sharing" for cross-context behavioral advertising. You can opt out by declining optional cookies, using Cookie Preferences, enabling Global Privacy Control (GPC), visiting Google Ads Settings, or using the NAI opt-out tool.

11. Your Rights (All Users)

• Unsubscribe from the newsletter at any time using the unsubscribe link in each email
• Request deletion of your data by emailing [email protected]

12. Cookies

Cloudflare Analytics is cookieless and does not set any cookies on your device. We set Google analytics and advertising cookies only after you consent. The Lemon Squeezy checkout process may use its own cookies, which are governed by Lemon Squeezy's privacy policy.

If you consent to optional Google cookies, the following cookies may be set by Google Ads and/or Google Analytics 4:

You can manage cookie preferences at any time by clicking the "Cookie Preferences" link in our website footer, or by using your browser's cookie controls. Cookie Preferences also functions as our "Do Not Sell or Share" advertising opt-out for California users. You may also opt out of Google's advertising cookies at Google Ads Settings or opt out of Google Analytics via the Google Analytics Opt-out Browser Add-on.

13. Sub-processors and International Transfers

Data may be transferred to service providers in the United States. For EU/UK personal data, transfers rely on the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, or the Swiss-US Data Privacy Framework for certified recipients where applicable, and on Standard Contractual Clauses or other lawful transfer mechanisms where applicable. Current sub-processors:

• Cloudflare, Inc. (US/global) — Workers, D1 database, request routing. DPF-certified.
• Resend, Inc. (US) — transactional email delivery.
• Google LLC (US) — optional advertising attribution and website analytics. DPF-certified.
• Lemon Squeezy (US) — commerce platform for purchasers.

14. Children's Privacy

We do not knowingly collect personal information from children under the age of 13. If you believe we have inadvertently collected data from a child under 13, please contact us and we will promptly delete it.

15. Data Processing Agreements

If your organization requires a Data Processing Agreement for GDPR compliance, please contact us at [email protected].

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or a prominent notice on our website.