Privacy policy

This policy explains which personal data is processed when you visit publit.si, buy Publit.Si, claim access to the source code and contact support. The Publit.Si app itself runs on your Mac or Windows PC; see section 9.

1. Controller

Max Anton Schneider (maxschneidercodes)
Sole trader
c/o MDC Management#1582
Welserstraße 3
87463 Dietmannsried
Germany

Email: info@maxantonschneider.com

We are not required to appoint a data protection officer and have not appointed one.

2. In short

• The website sets no cookies and stores nothing in your browser (no local storage).
• There is no tracking, no analytics, no advertising and no social media plugins.
• We serve fonts, images and videos ourselves. Loading the pages sends no data to Google Fonts, YouTube or similar services.
• Because we neither store nor read anything on your device beyond what is technically needed to show the page, no consent under Section 25 TDDDG is required and there is no cookie banner.

3. Hosting by Vercel

The website and its server functions run on Vercel Inc., USA. For every request Vercel processes technically necessary data: IP address, date and time, requested URL, referrer, browser and device information, status code and amount of data transferred. The purpose is to deliver the pages, keep them stable and fend off attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure and reliably available website. Vercel processes the website and function data on our behalf under a data processing agreement (Vercel DPA). Vercel is certified under the EU–US Data Privacy Framework; the EU standard contractual clauses apply in addition. Vercel keeps this data only as long as needed for operation and security. For some of its own service-generated data, Vercel acts as a controller; see the Vercel privacy notice.

4. Logs of the server functions

The functions for claiming access (/api/claim) and for notifications from Lemon Squeezy (webhook) write logs so we can trace errors when granting or removing access. They may contain your GitHub username, order, license and activation identifiers, a shortened license key and technical error messages. We do not log full license keys.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, traceable delivery). The regular retention period for these runtime logs in our Pro plan without Observability Plus is one day (see the Vercel documentation). We do not export them to other systems. Vercel's privacy notice additionally describes its own operational and security data.

5. Buying through Lemon Squeezy

Lemon Squeezy (Sold through Link, LLC, USA) handles the purchase as reseller and merchant of record. As an independent controller, Lemon Squeezy processes your name, email address, billing address, payment data, tax details and IP address for payment, invoicing, taxes and fraud prevention. The Lemon Squeezy privacy policy applies.

When you request immediate supply using the checkbox above the buy button, we initially record the exact declaration and its version, server time, selected plan and a reference in private Vercel Blob storage. We pass the reference and signed confirmation data to Lemon Squeezy to link them to your order. You enter your email address only at Lemon Squeezy checkout; after purchase we add it to the associated order record from the signed order notification. The individual receipt includes the declaration. These records document your request and contract performance (Art. 6(1)(b) and (c) GDPR), and preserve evidence for legal claims (Art. 6(1)(f) GDPR).

If you use Withdraw from contract, we store your declaration, name, confirmation email, order reference and receipt time in the same private storage and check the order details with Lemon Squeezy. We send an acknowledgement by email and a copy for processing; live declarations also go to Lemon Squeezy as seller. An order that cannot immediately be matched is retained for manual review. Legal bases are Art. 6(1)(b) and (c) GDPR. These documents contain no complete card details or license keys. We retain them for contract processing, applicable recordkeeping duties and the period needed to establish or defend legal claims; afterwards they are deleted. Vercel processes the stored records on our behalf; the storage region is Frankfurt, Germany. International processing by the providers remains subject to the safeguards described below.

We receive your name, email address, country, order and license details from Lemon Squeezy, but no complete payment data. We use them to deliver your access, provide support and carry out refunds (Art. 6(1)(b) GDPR), and keep order and accounting records as long as commercial and tax law require (Art. 6(1)(c) GDPR).

6. Claiming the source code

On the Get the code page you enter your license key and GitHub username. We check the key through the Lemon Squeezy license API and create an activation there that contains your GitHub username. This is how we count the accounts your plan allows. We then ask GitHub to invite your account to our private repository.

GitHub, Inc. (USA) processes your username and the invitation as an independent controller under its privacy statement. The legal basis is Art. 6(1)(b) GDPR, since we cannot deliver the code you bought without these steps. The activation and repository access last as long as your license is valid. Activation records are kept with Lemon Squeezy; the separate purchase-consent and withdrawal records are described in section 5.

7. Refunds and deactivation

If Lemon Squeezy fully refunds an order or a license key is deactivated, Lemon Squeezy notifies our server function. We then remove the related GitHub accounts from the repository. This processes order and license identifiers and the stored GitHub usernames (Art. 6(1)(b) and (f) GDPR).

8. Email and support

When you write to us, we process your email address, name, the content of your message and anything you send along, such as an order number, error messages or log excerpts. The legal basis is Art. 6(1)(b) GDPR for questions about your purchase, license and setup, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Our mailbox is run by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on our behalf under a data processing agreement. Google may also process data in the United States; Google is certified under the EU–US Data Privacy Framework, and the EU standard contractual clauses apply in addition.

We delete correspondence once your request is settled and no follow-up questions or claims are to be expected, at the latest three years after the end of the year. We keep business letters and accounting records as long as commercial and tax law require (usually six, or eight to ten years; Section 257 HGB, Section 147 AO). Please do not send us passwords, access tokens or API keys.

9. The Publit.Si app on your Mac or Windows PC

Publit.Si runs on your own computer. Accounts, posts, media and statistics stay there; we receive none of it. You are responsible for the data processing in the app, including when you use it for clients.

Depending on what you set up, the app sends data directly to third parties: to Meta, Google and TikTok through their official APIs, to Cloudflare for the tunnel the platforms use to fetch your media, and, for AI features, through the Claude Code, Codex or Cursor application installed on your computer to Anthropic, OpenAI or Anysphere (the maker of Cursor), depending on which one you use. Their terms apply. We only receive diagnostic data if you send it to us yourself.

10. Links to other websites

If you follow a link, for example to Lemon Squeezy, GitHub or the platforms, that provider's privacy policy applies. No data is sent to these providers before you click.

11. Recipients and transfers outside the EU

• Vercel Inc., USA: hosting and server functions (processor)
• Google Ireland Limited, Ireland, with Google LLC, USA: email (processor)
• Sold through Link, LLC (Lemon Squeezy), USA: purchase, invoicing, license keys (independent controller)
• GitHub, Inc., USA: repository access (independent controller)

Transfers to the United States rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR). Where Lemon Squeezy and GitHub act as independent controllers, their privacy policies describe their safeguards.

12. Whether you must provide data, and automated decisions

You do not have to provide any data to visit the website. Buying and claiming require the data described above; without it we cannot deliver the code. We make no automated decisions and create no profiles within the meaning of Art. 22 GDPR.

13. Your rights

Under the GDPR you have the right to

• access your data (Art. 15),
• have incorrect data corrected (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• withdraw consent with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing it unless we can demonstrate compelling legitimate grounds, or the processing serves the establishment, exercise or defence of legal claims.

An email to info@maxantonschneider.com is enough for any request. You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), such as the authority responsible for us, the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, or the authority where you live.

14. Changes

We update this policy when the website, the purchase process or the law changes. The version published here, with the date above, applies.