Privacy Policy

1. Controller

2. Storage Map on your Mac

The Storage Map application analyses files and storage locally on your Mac. File names, paths, scan trees, disk statistics, exclusions, and capacity history are not transmitted to us. Capacity history and preferences remain in local application storage. Full scan trees remain in memory only while required by the application.

The legal basis, where personal data is involved, is performance of the product contract and your requested use of the software (Article 6(1)(b) GDPR). We do not use application analytics, advertising identifiers, or behavioural tracking.

3. Website hosting and security

The website is hosted through ChatGPT Sites by OpenAI and its infrastructure providers, including Cloudflare. When you visit, technically necessary data such as IP address, request time, requested URL, browser information, referrer, response status, and security signals can be processed in server and security logs. Essential security cookies may be used to prevent abuse and keep the service available.

Processing is necessary to deliver the website and is based on our legitimate interest in secure and reliable operation (Article 6(1)(f) GDPR). Logs are retained only for as long as required for delivery, troubleshooting, abuse prevention, and legal security obligations, according to the providers’ applicable retention settings. The hosting platform also provides aggregate visitor and page-view counts.

Provider information: OpenAI Privacy Policy and Cloudflare Privacy Policy.

4. Optional website analytics

With your consent, we use Google Analytics 4 and Microsoft Clarity to understand how visitors find and use the website and whether product pages lead to a purchase. Both services remain blocked until you choose to enable them. You can grant or withdraw consent separately for either service at any time through the Cookie settings control.

The legal basis is your consent (Article 6(1)(a) GDPR). Consent choices are stored in your browser's local storage. Withdrawing consent stops future optional measurement and removes accessible first-party analytics cookies from this website.

Google Analytics 4. Google Ireland Limited can process page URLs, referrers, device and browser information, approximate location derived from the IP address, and events such as pricing views, checkout starts, purchases, and downloads. Advertising storage, personalised advertising signals, and Google Signals are disabled in our website configuration. Google Analytics may set cookies beginning with _ga after consent. See the Google Privacy Policy.

Microsoft Clarity. Microsoft Ireland Operations Limited can process interaction, navigation, device, browser, and diagnostic information to provide heatmaps and privacy-masked session insights. Clarity may set cookies such as _clck and _clsk after consent. See the Microsoft Privacy Statement.

We do not send file names, file paths, scan results, payment-card details, or content from the Storage Map application to either analytics service. Provider retention and deletion settings are managed in the respective analytics accounts.

5. Checkout and payment through Stripe

If you buy the Direct Edition, Stripe processes the payment and collects the details required for checkout, such as email address, payment method, billing and tax details, location, transaction amount, currency, customer identifier, payment status, and fraud-prevention signals. Payment-card details are submitted directly to Stripe and are not received or stored by us.

We receive and store the checkout-session identifier, Stripe customer and payment identifiers, email address, amount, currency, payment status, consent version, and timestamps needed to fulfil the order, provide the download, handle refunds, and meet accounting and legal obligations. The legal bases are contract performance (Article 6(1)(b) GDPR), legal obligations (Article 6(1)(c) GDPR), and fraud and legal claims management (Article 6(1)(f) GDPR).

Stripe Payments Europe, Limited participates in processing the payment. Details are available in the Stripe Privacy Policy.

6. Purchase fulfilment and downloads

Order, entitlement, refund, release, and webhook-event records are stored in the website database. The purchased installer is held in private object storage. A random, hashed download grant is created after a verified payment; the download link expires after fifteen minutes and can be used only once.

Contract and payment records are kept for the applicable statutory commercial, tax, warranty, and limitation periods—generally up to ten years where legally required. Security and delivery records are deleted or anonymised when they are no longer needed for fulfilment, fraud prevention, or legal claims.

7. Contact by email

If you contact us, we process your email address, message, and related correspondence to answer your request. The legal basis is Article 6(1)(b) GDPR for contract-related requests and Article 6(1)(f) GDPR for other legitimate support communications. Email is provided through Google. Correspondence is deleted when no longer required, subject to statutory retention and limitation periods.

8. Recipients and international transfers

Personal data is shared only as needed with hosting and security providers OpenAI and Cloudflare, analytics providers Google and Microsoft when consented, payment provider Stripe, email provider Google, professional advisers, and competent authorities where legally required. These providers can process data outside the European Economic Area. Transfers are based on an adequacy decision where available or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

9. Your rights

Subject to the GDPR’s conditions, you may request access, rectification, erasure, restriction, data portability, and object to processing based on legitimate interests. You may also lodge a complaint with a supervisory authority. The competent local authority is the Hamburg Commissioner for Data Protection and Freedom of Information, datenschutz-hamburg.de.

Contact mpochert+storagemap@gmail.com to exercise your rights. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

10. Changes to this policy

We may update this policy when the product, providers, or legal requirements change. The current version and effective date are always published on this page.