Privacy - WordPad

Privacy Policy

Last updated: 2026-11-10

This policy explains which personal data the Sunfish Software website (sunfish.software) and the FANDUST plugin process, why, and what rights you have. We don't use analytics, advertising, tracking or social media plugins, and we don't load fonts or scripts from other websites.

1. Who is responsible

Max Beier, trading as Sunfish Software
Postal address: see the Legal Notice (Impressum)

E-mail: privacy@sunfish.software

2. Visiting the website

The website runs on Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you open a page, your browser sends technical data such as your IP address, the requested address, date and time, and browser type. Cloudflare and we use this data to deliver the website and to protect it against attacks and abuse. Error and request logs are kept for a few days.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website).

3. Cookies and browser storage

We set two cookies, both strictly necessary:

  • sid: keeps you signed in. Deleted when you sign out, otherwise after 30 days.
  • csrf: protects forms against misuse from other websites. Deleted when you close the browser.

When you move or maximize a window on the website, its position is saved in your browser's local storage so it stays where you put it. This never leaves your browser. You can remove it by clearing your browser's site data.

Legal basis: ยง 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR. No consent is needed for these.

4. Your account

When you create an account, we store your e-mail address, your password (only as a salted hash, never in readable form), the creation date, the date you confirmed your e-mail address and the date you accepted the Terms of Use. We need this to provide the account, the downloads and the activation of FANDUST.

Legal basis: Art. 6(1)(b) GDPR (contract).

5. Activating FANDUST

When you activate FANDUST, the plugin sends your e-mail address and password, an identifier of your computer (a one-way hash of the device ID, from which the device ID can't be recovered), the computer name and the FANDUST version to our server. We store the computer identifier, the computer name, the activation date and the date of the last check, to enforce the limit of 3 computers per account and to show your computers on the My Account page.

If you choose "Activate in Browser" instead, FANDUST sends the computer identifier, the computer name, the FANDUST version and a random check value (not your password) and opens our website in your browser. After you sign in there, the browser hands a one-time code to FANDUST on your own computer (127.0.0.1), and FANDUST exchanges it for the activation. This request, with the computer identifier and name, expires after 10 minutes and is deleted within a day.

When FANDUST checks in, we also note the hour in which your account started it. We keep this for 3 days to see how many people use FANDUST at what time; then it is deleted.

FANDUST checks about once a day which version is available for download, so it can tell you about updates. This request contains no information about you or your computer apart from the IP address that every internet connection needs; we don't store it. You can turn this off under Options > Check for Updates Automatically.

Each time FANDUST starts, it asks our server whether the activation is still valid. This sends the license data (e-mail address, computer identifier and activation number) and updates the date of the last check.

Legal basis: Art. 6(1)(b) GDPR (contract).

To see which websites send visitors here, we count page views per day and per linking website (only its address, for example rekkerd.org, or "direct"). Nothing about you is stored for this, no cookie is set, and the counts are deleted after 90 days.

6. Downloads

We record which version (macOS, Windows or Linux) your account downloaded and when, to spot abuse of the download.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).

7. Protection against abuse

To slow down password guessing and spam, we count sign-in, sign-up, password reset and activation attempts per IP address. These counters expire after at most one hour and are deleted within a day.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting accounts).

8. E-mails

We send e-mails only when they are needed for your account: to confirm your e-mail address and to reset your password. No newsletters. These e-mails are sent through Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), which processes your e-mail address and the content of the e-mail for this purpose.

Legal basis: Art. 6(1)(b) GDPR (contract).

9. Service providers and transfers outside the EU

Cloudflare (hosting, database, DNS) and Resend (e-mail) process data on our behalf, under data processing agreements according to Art. 28 GDPR. Both are based in the USA. Transfers to the USA are covered by the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise by the EU Standard Contractual Clauses.

10. How long we keep data

  • Account, activations and download records: until you delete your account. You can do this at any time on the My Account page; the data is deleted right away.
  • After you delete your account we keep only the numbers of its activations, without any personal data, so that FANDUST on those computers stops working.
  • Sign-in sessions: 30 days. Links in e-mails: 48 hours (confirmation) or 1 hour (password reset).
  • Abuse counters: at most 1 hour. Server logs: a few days.

11. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21). To use these rights, write to privacy@sunfish.software. You can delete your account yourself on the My Account page.

You also have the right to complain to a data protection supervisory authority, for example the one in the German federal state where you live or where we are based.

12. Changes

If we change how we process data, we update this page and the date at the top.