Skip to content
Kajero
Download

Privacy policy

Last updated: October 2026

This policy explains which personal data we process when you visit this website, download Kajero or buy a license, and what the Kajero app sends where. Kajero has no accounts and no newsletter, the app sends no telemetry, and your notes never reach us.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

Carlo Nölle
Bonner Straße 18
50677 Cologne
Germany

Email: hello@codeattack.io
Phone: +49 221 42364393

No data protection officer has been appointed, as the requirements of Art. 37 GDPR are not met.

2. Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you open a page, Vercel processes on our behalf the technical data your browser sends and writes it to server logs:

  • IP address and the approximate location derived from it
  • date and time of the request
  • requested page and referrer URL
  • browser type and version, operating system

This is technically necessary to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating the website). Vercel keeps the logs for a limited period depending on its plan; we don't combine them with other data.

Vercel processes the data under its Data Processing Addendum. Transfers to the USA rely on the Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where Vercel is certified, the EU-US Data Privacy Framework. More: https://vercel.com/legal/privacy-policy

3. Downloads and updates

The Kajero app and its updates are served from https://updates.kajero.codeattack.io/, which runs on Amazon CloudFront in front of an Amazon S3 storage bucket in Frankfurt (Amazon Web Services). When you download Kajero, or the app checks for an update, AWS processes the technical data of the request (IP address, time, requested file, browser or app version) to deliver the file. We have not switched on access logs for this server.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in delivering the app and its updates). AWS processes the data under its Data Processing Addendum; transfers outside the EU rely on the Standard Contractual Clauses and the EU-US Data Privacy Framework. More: https://aws.amazon.com/privacy/

4. Buying a license

Licenses are sold through Polar (Polar Software) as merchant of record. The checkout runs on Polar's site, and Polar is the seller: it collects your name, email address, billing address and payment data, handles payment, invoices and taxes, and issues the license key. Polar's own privacy policy applies to this: https://polar.sh/legal/privacy

Polar passes on to us the order details we need to provide the license and answer questions about it, such as your name, email address, country and license key. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). We keep this data as long as the license is in use and statutory retention periods require.

5. Web analytics (Umami)

When it is configured, this website counts visits with Umami, an open-source analytics tool that we run on our own server in Germany. Umami sets no cookies, stores no IP addresses and creates no fingerprints or cross-site profiles. It records aggregated statistics only: pages viewed, referrer, browser, operating system, device type, screen size, language, country, and clicks on the download and buy buttons. No data goes to third parties.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in knowing how the website is used). No consent is needed, as Umami stores nothing on your device.

6. Cookies

This website sets no cookies and stores nothing on your device. The language comes from the address (/en or /de); when you open the start page without one, it follows the language setting of your browser.

7. The Kajero app

Your notes live in a database on your Mac. The app has no account and sends no usage statistics or crash reports. It connects to the internet only for these requests:

  • Updates: the app downloaded from this site checks https://updates.kajero.codeattack.io/ for new versions (see section 3).
  • License: when you activate a license key, the app sends it to Polar's license API to check it (see section 4).
  • AI: if you connect an AI provider (OpenAI, Anthropic, Google Gemini or OpenRouter), the app sends the text a feature needs straight from your Mac to that provider, with your own key. That provider's privacy policy applies; we receive nothing. With a local model in Ollama, the text stays on your Mac.

A build from source makes no update or license requests.

8. Email

If you email us, we process your email address and your message to answer you. The legal basis is Art. 6(1)(b) GDPR where your message concerns a license, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete the emails once the matter is settled and no statutory retention period applies.

9. Your rights

Under the GDPR you have the right to:

  • access the personal data we process about you (Art. 15)
  • have inaccurate data corrected (Art. 16)
  • have your data erased, unless statutory retention periods apply (Art. 17)
  • restrict processing (Art. 18)
  • receive your data in a machine-readable format (Art. 20)
  • object at any time to processing based on legitimate interest (Art. 21)

To exercise these rights, email hello@codeattack.io.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
https://www.ldi.nrw.de

10. Changes

We update this policy when the website, the app or the legal requirements change. The date at the top shows the current version.