This Privacy Policy (“Policy”) describes how Heylel Labs, a sole proprietorship operated by Martin Pacheco (“DockDuck”, “we”, “us”, or “our”), collects, uses, discloses, and protects personal data in connection with the DockDuck desktop application for macOS (the “App”), the website at https://dockduck.app and its subdomains (the “Site”), and related services (together, the “Services”).
We are the data controller for the personal data described in this Policy, except where the data is processed by our Merchant of Record (see Section 5), which acts as a separate controller and/or processor for payment and tax purposes.
By using the Services, you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Services.
1. Privacy-by-design summary
DockDuck is engineered to operate locally on your device.
The App does not upload, transmit, scan off-device, index in the cloud, or otherwise send the contents, names, paths, or metadata of your files and folders to us or any third party. All file management occurs locally on your Mac.
The limited personal data we do process is described in detail below.
2. Definitions
- “Personal data” means any information relating to an identified or identifiable natural person.
- “Processing” means any operation performed on personal data (e.g. collection, storage, use, disclosure, deletion).
- “Controller”, “Processor”, “Data Subject”, “Sub-processor” have the meanings given in the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR.
- “Merchant of Record” or “MoR” means the entity that sells the App to you as reseller and is responsible for billing and tax (see Section 5).
3. Personal data we do not collect
- The contents, file names, directory paths, thumbnails, or metadata of your files and folders.
- Keystrokes, screen contents, or in-App navigation history.
- Location data, contacts, photos, or any other on-device personal content.
- Special categories of data under GDPR Art. 9 (we neither seek nor want it).
4. Categories of personal data we process
| Category | Examples | Source | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|---|
| Order & identity data | Name, email, country, license key, order ID | Our MoR at purchase | Deliver, validate & support your license | Art. 6(1)(b) contract | Duration of license + statutory tax period |
| License-validation data | License key, anonymous device identifier, activation count | The App, at activation/validation | Verify license validity, manage device activations, prevent abuse | Art. 6(1)(b) contract; 6(1)(f) legitimate interest (anti-piracy) | Until license deactivation + short log window |
| Update / connection data | IP address, App version, macOS version, CPU architecture, request timestamp | Automatic update checks (Sparkle → our CDN) | Serve the correct update; security; abuse prevention | Art. 6(1)(f) legitimate interest | Short-lived server logs (≤ 30 days) |
| Optional diagnostics | Crash reports, anonymized/aggregated feature-usage events | The App, only if you opt in (“Share Technical Data”) | Diagnose crashes; improve the App | Art. 6(1)(a) consent | Aggregated; raw reports ≤ 90 days |
| Support data | Email address, message contents, system info you provide | You, when you contact us | Provide support, respond to requests | Art. 6(1)(b)/(f) | Up to 24 months after resolution |
| Site & cookie data | IP, browser/device type, pages viewed, referrer | The Site / analytics | Operate, secure, and measure the Site | Art. 6(1)(f); 6(1)(a) for non-essential cookies | Per Section 6 |
Where we rely on consent, you may withdraw it at any time (e.g. by disabling diagnostics in Settings) without affecting prior processing.
5. Payments and the Merchant of Record
Purchases of DockDuck are sold and processed by our reseller and Merchant of Record, Sold through Link, LLC (formerly Lemon Squeezy, LLC), 222 South Main Street, Suite 500, Salt Lake City, UT 84101, USA (“Lemon Squeezy”).
When you buy a license, Lemon Squeezy collects and processes your name, email, billing address/country, and payment-method details as a controller and/or processor for payment, fraud-prevention, invoicing, and tax purposes, and provides us with limited order data (name, email, country, order ID, license key). We never receive or store your full payment-card number.
Lemon Squeezy’s terms govern the payment relationship:
- Privacy Policy: https://www.lemonsqueezy.com/privacy
- Buyer Terms & Conditions: https://www.lemonsqueezy.com/buyer-terms
- Data Processing Agreement: https://www.lemonsqueezy.com/dpa
6. Cookies and similar technologies (Site)
The Site uses strictly necessary cookies required to operate and secure it. With your consent (where required), we may use privacy-respecting analytics to measure traffic. We do not use cross-site advertising trackers. You can control cookies via your browser settings and any cookie banner presented on the Site.
7. How we use personal data
We process personal data to: (a) deliver, activate, and validate your license; (b) provide updates and security fixes; (c) provide customer support; (d) diagnose crashes and improve the App (with consent); (e) operate, secure, and measure the Site; (f) comply with legal, tax, and accounting obligations; and (g) detect, prevent, and address fraud, abuse, and security incidents. We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data.
8. Disclosure of personal data and sub-processors
We do not sell or rent personal data. We disclose limited data only to:
- Service providers / sub-processors acting on our behalf under
appropriate contractual safeguards:
- Sold through Link, LLC (Lemon Squeezy) — payments, tax, invoicing (Merchant of Record).
- Amazon Web Services, Inc. (CloudFront / S3) — hosting of the update feed and the Site; CDN.
- Legal / safety: where required by law, court order, or to protect our rights, users, or the public.
- Business transfers: in connection with a merger, acquisition, or asset sale, subject to this Policy.
A current list of sub-processors is available on request at the contact in Section 16.
9. International data transfers
We operate worldwide and our providers (including Lemon Squeezy and AWS) are located in the United States and other countries. Where personal data of EEA, UK, or Swiss data subjects is transferred outside those areas, the transfer is protected by an appropriate safeguard under GDPR Chapter V, such as the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, and/or transfers to providers certified under the EU-U.S. Data Privacy Framework, where applicable.
10. Data retention
We retain personal data only as long as necessary for the purposes set out in Section 4, after which it is deleted or anonymized. Order and tax records are retained for the period required by applicable tax and accounting law (commonly up to 7–10 years). You may request earlier deletion subject to our legal obligations (see Section 11).
11. Your rights (EEA / UK / Switzerland — GDPR)
Subject to applicable law, you have the right to: access your personal data; rectify inaccurate data; erase data (“right to be forgotten”); restrict or object to processing (including processing based on legitimate interests); data portability; and to withdraw consent at any time where processing is based on consent.
To exercise any right, email martin@heylellabs.com. We will respond within one month (extendable by two months for complex requests, with notice). We may need to verify your identity. You also have the right to lodge a complaint with your local supervisory authority (e.g. your national Data Protection Authority).
For order/payment data held by Lemon Squeezy, you may also contact Lemon Squeezy directly.
12. Your rights (California — CCPA/CPRA)
In the last 12 months, we may have collected the categories of personal information described in Section 4 (identifiers, commercial information, internet/network activity, and limited geolocation inferred from IP), collected from the sources and for the business purposes described above.
We do not “sell” and do not “share” personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act, as amended (“CCPA/CPRA”). We do not process sensitive personal information for purposes requiring a right to limit.
California residents have the right to: know/access the categories and specific pieces of personal information collected; delete personal information; correct inaccurate information; and not be discriminated against for exercising these rights. You may exercise these rights, or use an authorized agent, by emailing martin@heylellabs.com.
13. Other U.S. state privacy rights
Residents of states with comprehensive privacy laws (e.g. Virginia, Colorado, Connecticut, Utah, Texas, and others) may have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising or profiling. We honor these rights and do not engage in targeted advertising. Contact us at martin@heylellabs.com.
14. Security
We implement reasonable technical and organizational measures appropriate to the risk, including transport encryption (HTTPS/TLS), least-privilege access, and minimization of the data we collect. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your license key and device secure.
15. Children
The Services are intended for users 16 years and older and are not directed to children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us personal data, contact us and we will delete it.
16. Changes and contact
We may update this Policy from time to time. Material changes will be posted on this page with an updated “Last updated” date and, where required, with additional notice. Your continued use of the Services after changes take effect constitutes acceptance.
Controller: Heylel Labs — Martin Pacheco Email: martin@heylellabs.com