Privacy

Who we are

LgcY Note is published under the name LC Group by André Menhard, Waasenstraße 25, 8700 Leoben, Austria, who is responsible for the data described here. Write to support@legacynote.app about anything on this page.

The app

• The app keeps your decks, your study history and your settings in folders on your computer. It doesn’t send them to us.
• It asks legacynote.app whether a new version exists. Like any web request, that carries your IP address, and the request names the app’s version. Our web server keeps no access log of these requests.
• If you sign in from the app, it keeps a sign-in token in Windows’ own credential storage and uses it only to talk to your account.

The website

• There are no analytics, no advertising and no tracking cookies.
• Cloudflare delivers the site and the app’s requests and protects them from attacks. For that it processes your IP address and technical details of your browser for us, and it may set its own security cookies.
• On the sign-in and support forms, Cloudflare Turnstile checks that you’re a person. Cloudflare also uses some of that data on its own account, to improve its bot detection: https://www.cloudflare.com/turnstile-privacy-policy/
• Our own cookies are only the ones signing in needs: short-lived security cookies while you sign in, and a session cookie that keeps you signed in.

Your account, if you make one

• We store your email address. If you sign in with Google, we also keep the name and email Google sends and the identifier that links your Google account. We don’t keep your Google profile picture or the tokens Google issues, and we have no access to your Gmail or contacts.
• For each place you’re signed in, we keep a session with the IP address and the browser it was started from, so you can recognise your sessions and end them.
• A session ends after 30 days without use, or when you sign out or end it.
• A sign-in code is valid for 10 minutes and works once. We keep it as a one-way hash to check it, and encrypted in our outgoing mail queue until our email provider accepts the message or the code expires.
• To limit abuse, attempts are counted briefly; those counts can include your IP address and expire after 24 hours.
• You can delete your account at any time on your account page. That removes your account, your sessions and your connection to Google.

Messages to support

• We keep what you send through the form for up to 180 days after we receive it: your email, your optional name, the topic, the subject, the message and the language. Deleting your account doesn’t delete them; ask support to erase them sooner.
• With a message we keep a keyed hash of your IP address, not the address itself, used only to limit abuse.
• We use all of it only to answer you.
• Mail you write to support@legacynote.app arrives in our support inbox at Google (Gmail). That copy is separate: deleting your account doesn’t remove it, but support can.

Email we send

Sign-in codes and support replies are sent by Resend on our behalf. We keep our own record of each message we hand over for 32 days.

Backups

• Every six hours our server makes an encrypted backup of the account and support data. Each is normally deleted after 14 days; the three newest are always kept, so after an interruption one can be older.
• Every six hours, the newest checked backup is also copied, still encrypted, to storage at Cloudflare in the EU, so the service can be restored if the server fails. The copies there are deleted on the same schedule.

Where data goes

• Our server is hosted by OVHcloud in Warsaw, Poland.
• Cloudflare processes data for us under its data processing addendum, which uses the EU’s standard contractual clauses where data leaves the EU: https://www.cloudflare.com/cloudflare-customer-dpa/
• Resend sends our email, processing it mainly in the United States, under its data processing addendum with the EU’s standard contractual clauses: https://resend.com/legal/dpa
• Google provides sign-in, if you choose it, and the mailbox our support mail arrives in, under its own terms and privacy policy. It transfers data under the EU–US Data Privacy Framework and standard contractual clauses: https://policies.google.com/privacy/frameworks

Legal basis

Your account and your messages: to provide what you asked for (GDPR Art. 6(1)(b)). Security and abuse limits: our legitimate interest in a safe service (Art. 6(1)(f)).

Your rights

• You can ask us for a copy of your data, and for it to be corrected or deleted.
• You can limit or object to our use of it, and take it with you.
• You can also complain to the Austrian Data Protection Authority (Datenschutzbehörde, dsb.gv.at).

Changes

When this page changes, the date below changes with it.