Legal
Your documents never leave your Mac, because the app that opens them cannot open a network connection. If you buy a licence, we hold your email address and a licence record, and a helper process confirms about once a week that the purchase has not been refunded.
Solander runs in Apple's App Sandbox without the network client entitlement. This is enforced by macOS, not by our policy: the operating system will refuse an outbound connection regardless of what the code asks for.
codesign -d --entitlements - /Applications/Solander.app
There is no telemetry, no analytics and no crash reporting, on any surface. No account and no sign-in. No hardware identifier: nothing we hold is derived from your Mac's serial number, its MAC address, or anything else about the machine.
Documents you open stay in memory or in the location you choose to save to, with two exceptions, both inside the app's own sandbox container: page images held while you work, deleted when the session ends; and batch progress, which is encrypted and deleted when the batch finishes or you discard it.
Two helper processes, both separate from the app that opens your documents, use the network. Neither receives a document, a page image, a filename, or anything Solander detected.
Update checks request the update feed and the download itself, nothing more. They can be switched off in the app. We do not log update checks in a form tied to you.
Licence validation confirms, about once a week, that the purchase behind your licence has not been refunded or charged back. It cannot be switched off separately from the app itself — turning off update checks does not turn it off — and for a Mac that must never connect, the app offers offline activation instead, which is a code you carry by hand.
Each validation sends exactly three things:
your licence ID (the identifier on your licence file, not your name or email address); the app version; and an install ID, a random value generated once when you install Solander and kept in your Mac's Keychain. The install ID is not derived from your hardware and says nothing about your Mac — reinstalling produces a different one.
From those, we store only the install ID, against your licence ID, so that we can see when one licence is being used on far more installations than were bought. We keep each install ID for 90 days from when it was last seen, after which it deletes itself automatically. We do not store the app version, and we do not store a timestamp of when your licence was last checked, so we hold no record of when or how often you use Solander.
The legal basis for licence validation is our legitimate interest in preventing the unlicensed use of software we sell, GDPR Art. 6(1)(f), and performance of our contract with you in continuing to supply the licensed features, Art. 6(1)(b). If you object to this processing, write to us — but be aware that the licensed features depend on it, and offline activation is the alternative rather than an exemption.
Server logs. Our serverless host records standard request logs for the validation endpoint, including IP addresses, for security and abuse prevention. We do not use those logs to build any record of an individual's use of Solander, and they are not joined to your licence record. They are held under the host's own retention period rather than ours.
Purchases are handled by Paddle.com Market Ltd, who act as merchant of record: they take the payment, handle VAT and issue the invoice. Their privacy notice covers what they collect — see paddle.com/legal/privacy. We never see your card details.
From that purchase we receive and store:
your email address; the name or organisation the licence is issued to; a licence ID and the Paddle transaction ID; the date the licence was issued; whether the purchase has been refunded or charged back; and a count of how many offline activation codes have been issued for it.
We use these to issue your licence, to send it again if you ask, to answer the weekly validation check, to issue offline activation codes, and to keep a record of what was sold. The legal basis is performance of our contract with you, GDPR Art. 6(1)(b), and for the sale record, our legal obligation under tax law, Art. 6(1)(c). We keep them for as long as the licence is supported, plus the period Dutch tax law requires us to keep records of a sale. We do not use your address for marketing and there is no mailing list.
This licence record lives on a single serverless function, which is the only server Quiet Signals Lab operates for Solander. It handles fulfilment, the weekly validation check and offline activation. It never receives a document, a page image, or anything Solander detected — only the purchase details listed above and the three fields each validation sends.
Your licence is a signed file, delivered by email. Solander verifies that signature on your Mac against a key compiled into the app, and that check is what decides whether the licence is genuine. It happens entirely on your Mac and works on a machine that has never been online.
What the weekly check adds is the ability to switch a licence off after a refund. It can only take entitlement away: our server cannot grant a licence, because only a signature made with a key we hold offline can do that, and a licence ID our server has never seen is reported as unknown rather than treated as invalid.
Because we do not store a timestamp of your checks, we cannot tell when or how often you use Solander, or on which documents. What we can tell is how many separate installations a licence has been seen on in the last 90 days, which is the one thing the install ID exists for.
No cookies, no analytics, no trackers, no embedded third-party content, and no fonts loaded from elsewhere. Our host records standard server logs, including IP addresses, for security and troubleshooting. Checkout pages are served by Paddle and are subject to Paddle's own notice.
You can ask for a copy of what we hold, correct it, or have it deleted. You can also object to processing, ask for it to be restricted, or request your data in a portable form.
One consequence worth stating plainly: if we delete your licence record, we can no longer resend your licence, and the weekly check will report your licence as unknown. Solander treats unknown as no reason to lock anything, so the licensed features keep working — but we would also no longer be able to confirm your purchase if you needed us to. We are required to keep the underlying sale record for the period Dutch tax law specifies, and that part cannot be deleted on request.
Write to hello@quietsignalslab.com. Requests are handled within 30 days. You may also complain to your national data protection authority; in the Netherlands this is the Autoriteit Persoonsgegevens.
Solander is a professional tool and is not directed at children. The app collects nothing from anyone.
If the app's data handling ever changes, this policy will be updated before the change takes effect, with a new "last updated" date. The current policy always applies to the current version of the app.
Controller: Alexander Hepburn, trading as Quiet Signals Lab, a sole proprietorship (eenmanszaak) registered in the Netherlands. KvK 99556650, VAT NL005394204B58.
Box E2268, Keurenplein 41, 1069 CD Amsterdam, Netherlands · hello@quietsignalslab.com