Privacy Policy

Knowtarium is run by Magentix Studio UG (haftungsbeschränkt), Kaiserring 14-16, 68161 Mannheim, Germany. Full company details are on the Imprint page. Magentix Studio UG is the controller for all processing described here. For anything privacy-related, email contact@magentix.studio.

The short version: there are no accounts, your documents never leave your computer, and the website has no ads, no tracking cookies and only anonymous, cookie-free visit counts. We process personal data only to sell you a license key, email it to you and activate it on your computers.

Knowtarium opens folders on your computer and works on them there. Your bundles, documents, review history and comments stay on your device; we never receive them. The app doesn't call AI models, and its MCP server runs locally, started by the agent you connect.

Your license key

A license key contains the email address you bought it with and the Paddle transaction reference, signed so the app can check it. The app stores the key in its settings folder and shows the email address it belongs to.

Activating a computer

Each license works on a limited number of computers. When you activate the app on a computer, it sends us your license key and a device ID once. The device ID is a one-way hash made on your computer: it tells your computers apart, but we can't work out your hardware, name or files from it. We store the hashes for each license, so we can enforce the limit and let you deactivate a computer. We also check the key against a list of keys that were published and blocked. After activation the app works offline and doesn't contact us about your license again, unless you deactivate a computer.

Update checks

The app checks for new versions by downloading a small update file from our download server. Like any web request, this reveals your IP address, the app version and your operating system to the server. We don't link these requests to you or your license.

No telemetry

The app sends no usage analytics or crash reports. If we ever add either, it will be off until you turn it on, and this policy will describe it first.

Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR); the device limit and the blocklist also serve our legitimate interest in preventing misuse of license keys (Art. 6(1)(f) GDPR).

License keys are sold through Paddle as merchant of record. Paddle handles the checkout, your payment details, invoicing and VAT; we never see your full payment data. Paddle's privacy policy applies to the checkout.

When a purchase completes, Paddle sends us your email address, the product and a transaction reference. We use them to create your license key and email it to you. We don't keep our own customer database: purchase records stay with Paddle.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal bookkeeping obligations (Art. 6(1)(c) GDPR).

We send your license key right after you buy, and, for pre-orders, a second email with download links when the app is released. These are part of your purchase, so there's nothing to opt out of; we don't send marketing emails.

If you use the "resend my key" form, we look up the address you enter in Paddle and, if it bought a key, email the key to it again. We don't store the address you enter.

Delivery is handled by Resend as our processor. Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for the resend form, also our legitimate interest in helping you recover a key (Art. 6(1)(f) GDPR).

The website is hosted by Vercel. To deliver pages and protect the site from attacks, Vercel processes your IP address and technical request data such as the browser type, in short-lived server logs.

Visit statistics

We count visits with Vercel Web Analytics to see which pages people read and where they came from. It uses no cookies, does no cross-site tracking and builds no profiles. For each page view it records the page, the referring site, your country and region, your browser, operating system and device type, and the time. Visitors are told apart by a hash of the request that is discarded after 24 hours, so a visit can't be tied to you, your IP address or your activity on other websites. We only see aggregated numbers.

There is no advertising and there are no third-party trackers. Fonts are served from our own domain, so loading a page doesn't contact Google or any other font service.

Legal basis: our legitimate interest in delivering a secure website and understanding, in aggregate, how it is used (Art. 6(1)(f) GDPR).

The website stores one item on your device:

It's strictly necessary for the setting you chose (§ 25(2) TDDDG). When you open the checkout, Paddle may set its own cookies needed to process the payment; Paddle's policy covers them.

We don't sell, rent or share your data with advertisers or data brokers. These providers process data on our behalf:

• Vercel (USA, EU-US Data Privacy Framework): website hosting and anonymous visit statistics
• Cloudflare (USA, EU-US Data Privacy Framework): the license service (receiving Paddle's purchase notifications, creating and emailing license keys, activating computers), and hosting downloads and updates
• Paddle (UK): merchant of record for license keys
• Resend: delivery of license emails

Where a provider is outside the EU/EEA, transfers rest on an adequacy decision (the EU-US Data Privacy Framework, or the UK adequacy decision) or on the EU Standard Contractual Clauses.

• Purchase records: kept by Paddle as merchant of record, for as long as tax law requires (10 years under German law).
• License emails: delivery records are kept by Resend for a limited period, then deleted.
• Device activations: the license and the device hashes are kept for as long as the license exists. A deactivated computer's hash is deleted.
• Blocked keys: kept on the blocklist for as long as the license exists, so the key stays blocked.
• Website server logs: kept by Vercel for a short period for security, then deleted. Update server logs: kept by Cloudflare for a short period, then deleted.
• Visit statistics: kept only as aggregated numbers; the hash that tells visits apart is discarded after 24 hours.
• Data in the app: stays on your computer until you delete it. We never hold a copy.

Under the GDPR you can ask us for access to your data, correction, deletion, restriction of processing and a portable copy, and you can object to processing based on legitimate interest.

To exercise any of these rights, email contact@magentix.studio, ideally from the address you bought with so we can find your license. We respond within 30 days.

You can also lodge a complaint with a data protection authority. For us, the competent authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

Knowtarium isn't directed at children under 16, and we don't knowingly collect their data. If you believe a child has given us data, contact us and we'll delete it.

When this policy changes, we update this page and the date at the top.