Privacy
Privacy Policy
Legible is a local-first Mac app. Your notes never leave your machine, and we collect almost nothing about you. This page explains, in plain terms, exactly what we do collect, why, and what you can do about it.
Who we are
Legible is operated by PF Creative Ltd, a company registered in the United Kingdom. For the purposes of UK GDPR, we are the data controller for the limited personal data described below. You can reach us about anything in this policy at hello@getlegible.app.
What information do we collect?
We collect only what's required to sell you the app, deliver your license key, and verify that key when you launch Legible.
When you buy Legible
Our payments provider, Paddle, collects the information needed to process your purchase: your name, email address, billing address, country, and payment details. We never see your card number. After a successful purchase, Paddle shares your email address and order ID with us so we can issue your license key.
When you use Legible
The app itself does not transmit your notes, your vault contents, or any usage telemetry anywhere. Reading happens entirely on your machine. The only network traffic Legible initiates is to our license server, and only to:
- Validate your license key on launch and when you activate it on a new device.
- Update a "last seen" timestamp on each periodic heartbeat, so we know an activation is still in use.
Those requests carry only your license key and a non-reversible identifier for your Mac (a one-way hash derived from the system hardware ID). The Mac identifier is never linked to your name or email outside of your own license record. It exists solely to enforce the per-license activation limit.
When you contact us
If you email hello@getlegible.app, we keep your message and our reply for as long as needed to resolve your query and for a reasonable period afterwards in case it becomes relevant again (typically up to 24 months).
What we do not collect
- The contents of your notes, vault, or any markdown file.
- Which files you open, how often you read, or how long you spend in the app.
- Analytics, telemetry, crash reports, or behavioural fingerprints.
- Cookies for tracking on this website. The marketing site uses no analytics scripts and sets no advertising cookies.
Why we process this data, and our lawful basis
Under UK GDPR we rely on two lawful bases:
- Performance of a contract. To sell you the license, deliver your key, and verify it on the devices you activate. Without this we cannot fulfil the purchase.
- Legitimate interest. To prevent license abuse (e.g. one key activated on hundreds of unrelated machines), to respond to your support queries, and to keep our records of purchases for accounting and tax purposes.
Who we share it with
We share the minimum required with a small set of trusted processors, each bound by contract and operating under their own published privacy terms:
- Paddle. Payment processing and merchant of record. Paddle holds your purchase record and handles VAT and sales-tax compliance on our behalf. See paddle.com/legal/privacy.
- Supabase. Hosts the license database: your email, license key, order ID, and activation records. Data is held in the EU (Ireland). See supabase.com/privacy.
- Brevo. Sends transactional emails such as your license-key delivery. Brevo holds your email address for as long as we keep your license record. See brevo.com/legal/privacypolicy.
We do not sell or rent your data to anyone, and we do not share it for advertising or profiling purposes.
How long do we keep your information?
We keep your license-key record for the lifetime of the license (typically 12 months from purchase, plus a reasonable period afterwards in case you ask us to look it up). Purchase records are kept by Paddle and by us for the period required by UK tax law (currently six years). Support emails are deleted after roughly 24 months of inactivity.
How do we keep your information safe?
License data is held in a Postgres database with row-level security policies that restrict access to a single service role. Communication between the app and our license server is over HTTPS. Webhook events from Paddle are verified using HMAC-SHA256 before we accept them. Passwords and license keys are never logged.
What are your privacy rights?
You have the following rights under UK GDPR:
- Access. Request a copy of the personal data we hold about you.
- Rectification. Ask us to correct anything that's wrong.
- Erasure. Ask us to delete your data. We can delete your license record, but note that this will invalidate your license. Paddle and your bank will keep their own records regardless.
- Portability. Receive your data in a machine-readable format.
- Objection and restriction. Object to or restrict how we use your data.
- Complaint. Complain to the UK Information Commissioner's Office at ico.org.uk if you believe we've handled your data improperly.
To exercise any of these rights, email hello@getlegible.app. We aim to respond within 14 days; the statutory limit is 30 days.
International transfers
Our license database is hosted in the EU (Ireland). Paddle and Brevo operate internationally and may process your data outside the UK or EU under their respective standard contractual clauses. We have chosen processors with adequate data-protection commitments.
Children
Legible is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to this policy
If we make material changes, we'll update the "Last updated" date at the top of this page and, where the change affects your rights, notify you by email before the change takes effect.
How to contact us about this policy
Email hello@getlegible.app with "Privacy" in the subject line. We read everything that comes in.