Privacy Policy.

Data controller: Damian Prochaska, operating RenameTo as a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland.

• Registered business name: Damian Prochaska
• NIP: [FILL IN — NIP number]
• REGON: [FILL IN — REGON number]
• Registered address: [FILL IN — registered business address]
• Contact: support@renameto.com

This policy covers renameto.com and the RenameTo macOS application. It does not cover third-party sites we link to. Some of the companies named below act as our processors (they handle data on our instructions — Cloudflare, Resend, Vercel); Polar.sh is different — for the purchase itself, Polar acts as an independent controller in its own right, not on our instructions, and publishes its own privacy policy covering that data.

RenameTo processes your files entirely on your Mac. No file, filename content, or file metadata is ever sent to us or to any third party as part of a rename, compress, or convert operation — we checked every network call the app makes, and none of them carry file content. The only data that leaves your Mac is what’s listed below.

• Starting a free trial: the email address you enter, a one-way device fingerprint (not your Mac’s serial number or any personally-identifying hardware ID — a hashed value used only to prevent one Mac from claiming multiple trials), whether you opted into marketing email, and the app version.
• Activating or validating a license: your license key and a device label you can edit (e.g. “Damian’s MacBook Pro”) — used solely to show you which of your Macs a key is activated on.
• Recovering a lost key (renameto.com/license): the email address you submit.
• Buying a license: handled entirely by Polar.sh, our payment processor — see §4.
• Visiting renameto.com: aggregated, cookieless page-view analytics — see §5.
• Checking for app updates: a standard Sparkle update check (app version, macOS version, CPU architecture) — the same data any auto-updater sends to know which build to offer you.
• Visiting renameto.com, or any request our servers handle: your IP address is visible to our hosting infrastructure (Cloudflare, Vercel) as a normal part of serving any web request — this is standard server-log behavior, not something we separately collect or store ourselves.

Automated decisions: the device fingerprint check that gates a second free trial on the same Mac runs automatically, with no human review. It has one binary effect — trial or no trial — carries no legal or similarly significant consequence, and you can always email support@renameto.com if you believe it flagged you incorrectly. We don’t otherwise use automated decision-making or profiling.

• Performance of a contract — activating your trial or license, resending a key, and delivering updates all exist to provide the product you asked for.
• Legitimate interest — the device fingerprint exists to stop trial abuse; aggregated site analytics exist to understand which pages are useful, weighed against the minimal, non-identifying nature of the data involved.
• Consent — anything beyond the transactional emails above (i.e. marketing email) is sent only if you opted in, and you can withdraw that consent at any time by unsubscribing from a single link in any such email.
• Legal obligation — Polar, as merchant of record, retains transaction records as required by tax law.

We don’t sell data, ever. A short list of processors run specific pieces of the product, each under their own agreement and each only for the purpose named:

• Polar.sh (payment processing, merchant of record) — handles your purchase, receipt, VAT/tax, license key issuance, and device-activation management. Polar acts as an independent controller for transaction data; see Polar’s Privacy Policy.
• Cloudflare (infrastructure) — hosts the trial/license API and stores trial records (email, device fingerprint, consent flag) in Cloudflare KV.
• Resend (email delivery) — sends trial-key and license-recovery emails on our behalf.
• Vercel (hosting + analytics) — hosts renameto.com and runs Vercel Web Analytics, a cookieless analytics product that does not use persistent identifiers or track you across sites.

We do not currently run a referral or affiliate program. If we launch one, this policy will be updated first, and it will only ever involve purchase/attribution data — never your files or personal correspondence.

Polar, Cloudflare, Resend, and Vercel are US-headquartered (with EU infrastructure in some cases). Where any of them transfers personal data outside the EEA, they rely on Standard Contractual Clauses as the baseline safeguard, and several additionally hold EU-US Data Privacy Framework certification — each processor’s own site lists which applies to them specifically; we rely on those published mechanisms rather than negotiating separate ones as a small business.

• Trial records (email, device fingerprint, marketing-consent flag) are kept for up to 24 months from your last trial activity, to enforce the one-trial-per-device rule, then deleted.
• Your license key and the device labels you set are kept for as long as your license is valid, since deleting them would break your ability to manage your own devices.
• Purchase and license data is retained by Polar per its own policy and applicable tax-record retention law.
• License-resend rate-limit counters are deleted automatically after one hour.
• Vercel Web Analytics aggregates page views without a persistent per-visitor identifier — see Vercel’s Web Analytics privacy notes for their retention specifics.

Under GDPR (and equivalent laws elsewhere), you can ask us to:

• tell you what data we hold about you;
• correct it if it’s wrong;
• delete it, where we’re not required to keep it (e.g. tax records held by Polar);
• restrict how we use it while a dispute about it is resolved;
• give you a portable copy of it;
• object to processing based on legitimate interest, including marketing at any time.

Email support@renameto.com for any of the above — for data Polar holds as an independent controller (payment records), you can also contact Polar directly. If you’re in the EU and unsatisfied with our response, you can lodge a complaint with the Polish data protection authority (UODO) or your local supervisory authority.

RenameTo isn’t directed at children, and we don’t knowingly collect data from anyone under 16. If you believe a child has provided us data, email us and we’ll delete it.

Data in transit to our processors is encrypted (TLS). Trial records are minimized by design — we store a fingerprint, not a hardware identifier, and never store a password because we never issue one: your license key is the credential, managed by Polar.

If we materially change what we collect or why, we’ll update the date at the top of this page and, for material changes, note it in the app’s release notes.

Questions about this policy, or about your data: support@renameto.com. See also our Terms of Service and refund policy.