Privacy Policy

Last updated: 24 July 2026

Iapetus is operated by Demec ("we"), reachable at support@iapetus.dev. This policy is an honest inventory of what we collect and why. The short version: we collect what running a licensing service requires, we run our own cookieless page counter instead of third-party analytics, and we never sell or share your data for advertising.

What we collect

Account data

When you register: your name (or company name), email address, and a hashed password — we never store the password itself. When you sign in, the session records an IP address and browser user-agent string for security.

License and activation data

Licenses we issue you (plan, features, expiry) are stored with your account. When the desktop app activates a license it reports: the license ID, a random per-installation identifier, the app version, and the request's IP address, with first-seen and last-seen timestamps. This exists to spot license abuse and count active installs. License verification is offline — the app does not need to contact us to run.

Website analytics — first-party, cookieless

Our web server counts page views itself: the page path, the referring site's domain, and an anonymized visitor hash. No analytics cookies, no third-party trackers, no cross-site anything. The only cookie this site sets is the essential session cookie that keeps you signed in.

What you send us

Contact-form messages, support emails, and diagnostics bundles you choose to export from the app and share with us. Diagnostics are always user-initiated — the app sends no telemetry.

How we use it

To operate your account and issue licenses (performance of our contract with you); to prevent license abuse and keep the service secure, and to understand aggregate site traffic (our legitimate interests); and to email you the things described in the Beta Terms. We do not sell personal data, we do not share it for advertising, and we build no profiles.

Where it lives and who processes it

Our servers are hosted by Hetzner in the European Union. Transactional email (verification, license delivery) is sent through Resend. When paid subscriptions launch, payments will be handled by a merchant-of-record payment provider, and this policy will be updated to name it before any payment is taken.

Retention

Account and license data is kept while your account exists. Activation records are kept while the related license is active and for a reasonable audit period after. Page-view records are aggregate-oriented and pruned periodically. Support correspondence is kept as long as it is useful for supporting you.

Your rights

Under the GDPR you can ask for access to, correction of, deletion of, or a portable copy of your personal data, and you can object to processing based on legitimate interests. Email support@iapetus.dev and we will act on it promptly. Deleting your account deletes your personal data, subject to records we must keep by law. You also have the right to complain to your local data-protection authority.

Changes

If this policy changes materially, we will note it here and email account holders before the change takes effect.