Privacy notice

Last updated: 14 October 2026

This notice covers the WELTEN website, the direct-download and Mac App Store editions of the Mac app, beta and support correspondence, and purchase processing when you use those services. The Mac App Store edition uses Apple for purchases and updates; the direct-download sections describe our separate download and licensing services. Direct-download purchases and existing subscriptions use the production licensing service. Optional CommerceDev tests stay in the Stripe sandbox.

Who is responsible?

For privacy questions and requests, email hello@welten.app.

Website hosting

The public website is hosted using Cloudflare Workers Static Assets, provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Serving and protecting the website involves processing IP addresses and technical request data, such as the requested URL, time, browser information and referring page where transmitted.

The purpose is reliable delivery and protection against abuse. The legal basis is our legitimate interest in a secure, functioning website (Article 6(1)(f) GDPR). Technical data is retained only as necessary for delivery, security and incident investigation; applicable provider retention practices are described in Cloudflare’s privacy policy.

Cloudflare operates internationally, including in the USA. Its data processing terms describe safeguards for international transfers, including EU Standard Contractual Clauses where applicable. You can request information about these safeguards using our contact address.

Mac App Store purchases and updates

In the Mac App Store edition, Apple delivers the app and its updates and handles your Apple Account, payment and App Store transaction information. Apple's processing is described in App Store & Privacy. WELTEN does not receive your Apple Account password or payment card details.

WELTEN uses Apple's StoreKit to request the price and details of the one-time Unlock WELTEN purchase, start the purchase when you choose it, and restore purchases through Apple. The app checks verified, unrevoked purchase information on your Mac to determine whether access is unlocked and refreshes that state when transactions change. This does not create a WELTEN account or send purchase information to a WELTEN licensing server. The App Store edition does not use Stripe Checkout, licence recovery codes or the Sparkle updater.

While it runs, the App Store edition asks Apple's public App Store lookup service once a day which WELTEN version is current, so it can tell you when an update is available. The request contains only WELTEN's App Store ID; as with any connection, Apple receives your IP address and ordinary request information. Updates are still installed by the Mac App Store.

The App Store edition keeps its free-session allowance locally in a separate macOS Keychain item. Your forest, projects, focus history and settings remain in the app's local sandbox container; restoring an Apple purchase does not sync or import that progress. The support, optional YouTube playback and local-integration sections below also apply when you use those features.

Direct-download app files and updates

For the direct-download edition, download and update files are delivered through Cloudflare R2 at downloads.welten.app and the download routes on welten.app. Cloudflare receives the connection IP address and ordinary request information, including the requested file or update list, request time and browser or updater user agent. The purpose is to deliver the requested software, check update availability and protect the service against abuse. The legal basis is our legitimate interest in reliable, secure software delivery (Article 6(1)(f) GDPR). The Cloudflare provider, retention criteria and international-transfer safeguards described above also apply here.

In updater-enabled direct-download WELTEN releases, automatic update checks are off by default. You can choose “Notify me when an update is available” during setup or in Settings → Updates. You can also check manually. Installation requires confirmation. Update requests do not include your focus history, projects, intentions, folder links, licence identifiers or a system profile. Download delivery does not give us access to your locally stored focus data.

Personal direct-download beta links

When we send you a personal beta download link, we assign a random invitation code to your beta email address and the offered build. The address is not included in the URL or the app. Opening the invitation page alone is not counted. When the archive is served through its personal download button, we record daily counts of completed full-file deliveries, partial requests and delivery errors for that invitation. We do not store IP addresses, browser identifiers, cookies or a request-by-request browsing history in this database. Repeated downloads, forwarded links and automated scanners imitating a browser may count; these records do not prove an installation or use by a particular person.

We use this limited delivery record to manage beta invitations and help with download problems, based on our legitimate interest in operating and supporting the private beta (Article 6(1)(f) GDPR). The invitation page also offers the same approved app through a standard download without personal counting. You can object to personal delivery counting or ask us to revoke your link by contacting hello@welten.app. This does not affect your beta access.

Invitation records are stored in a separate Cloudflare D1 database restricted to the European Union. Links expire after at most 90 days; the daily cleanup deletes expired invitation records and their counts. Private operational exports are reviewed and deleted when no longer needed for delivery or support. Cloudflare’s connection processing and transfer safeguards described above also apply. Neither these links nor their records are joined to focus history, projects or purchase data.

For delivery support, we receive internal Telegram summaries of new personal-link download counts. These include the beta email assigned to the link, its build, UTC day and a short invitation reference, so we can identify which invitation may need help. They contain no download URL or token, IP address or app usage data. Telegram therefore receives the assigned beta email and these delivery details; the Telegram processing information below also applies. This is a link assignment, not proof of who used it. You can use the standard download without personal counting instead.

Beta request form

The beta request form closed with the sales launch and no longer accepts requests. Entries submitted before then are handled and deleted as described in this section.

When you request beta access, we store your email address, your confirmation that you have a compatible Mac, your optional broad use category, the submission time and the version of this notice. We use this information to handle your request and contact you about a beta place. Submitting a request does not subscribe you to a newsletter, create an account or provide an immediate download. We do not check your Mac automatically.

The form is processed by Cloudflare Workers and stored in a Cloudflare D1 database configured with the European Union jurisdiction restriction. This limits where the database runs and stores data; website request processing may still occur internationally as described above. Your connection IP address is used for a short request limit to prevent abuse; it is not stored in the beta-request database. The form does not collect your app sessions, projects or forest.

To help us handle your request, the Worker sends us an internal alert through the Telegram Bot API. The alert contains only a short reference to your entry: not your email address, not your use category, not the time you submitted. We read the request itself from our own database. We store the alert time, its reference and retry status alongside your request. Telegram operates outside the European Union; see Telegram's privacy policy for its processing and international operations. This alert goes to us. Invitations are sent separately after review.

The legal basis is Article 6(1)(b) GDPR for handling your request for beta access, and Article 6(1)(f) GDPR for protecting the form against abuse. An email address and compatibility confirmation are required to process the form; the use category is optional. You can also contact us by email.

We delete form entries automatically after 180 days, with a daily cleanup, or earlier when you withdraw your request or the entry is no longer needed. To withdraw or ask for deletion, email hello@welten.app. Deleted data may remain temporarily in the provider’s recovery backups until those expire. Correspondence is handled separately as described below.

Email, beta and purchase enquiries

Email links open your own email application. No message is sent simply by clicking a link. If you send an enquiry, we process your email address, message, any name or attachments you provide, and correspondence metadata to respond and handle your beta, purchase, cancellation or withdrawal enquiry.

Our mailbox uses Titan Email, purchased through Name.com. Titan processes email for delivery and storage. See Titan’s privacy policy for its processing and international operations.

The legal basis is Article 6(1)(b) GDPR for requests relating to a potential contract, or Article 6(1)(f) GDPR for our legitimate interest in answering other enquiries. Providing this information is voluntary, but we need a reply address to answer. A beta enquiry does not subscribe you to a marketing newsletter.

We retain correspondence while the enquiry or beta request is active, then delete it when no longer needed. Ordinary resolved support enquiries are reviewed for deletion within six months of closure. Contract-related business correspondence and evidence needed for a specific claim or legal obligation are retained separately as described below.

Direct-download contract emails and electronic declarations

For direct-download purchases and subscriptions, we use Cloudflare Email Service to send contract documents, trial reminders and acknowledgements of cancellation or withdrawal. Cloudflare processes the recipient address, message contents and attachments, and delivery information such as message identifiers, timestamps and delivery errors. These are service messages, not a marketing subscription. Replies to hello@welten.app are handled through the Titan mailbox described above. The Cloudflare provider and international-transfer safeguards under Website hosting also apply to email sending.

When you use our cancellation or withdrawal form, we process your name, confirmation email address, description of the contract and any optional order reference. For cancellation, this also includes the cancellation type, requested end date and a reason if you choose extraordinary cancellation. We record the declaration, its receipt time and processing status to acknowledge it, identify the contract and handle the request. The form needs enough information to identify you and your contract and an email address for the electronic acknowledgement; no account, app access or recovery code is required.

The legal bases are Article 6(1)(b) GDPR for handling the contract and your request, Article 6(1)(c) for required contract information, acknowledgements and record keeping, and Article 6(1)(f) for necessary delivery troubleshooting and protection against misuse. Declaration and message contents are stored encrypted in our EU-restricted Cloudflare D1 database. Our service keeps contract correspondence and its delivery record for six years after the relevant calendar-year end; unresolved delivery or declaration cases and documented legal holds remain restricted until resolved and their retention period has passed. The scheduled cleanup can be delayed by failed runs. Cloudflare's separate delivery-event records are currently available and retained for 31 days; this is separate from our contract archive and the provider's other security and legal processing.

Direct-download checkout and transaction information

When you choose a direct-download purchase or CommerceDev sandbox test, that edition opens Stripe-hosted Checkout using Stripe Managed Payments, identified as “Sold through Link”. Stripe/Link receives the information you enter, such as email, billing and payment details, as well as transaction and technical connection information. In the sandbox, use test payment details. We can access relevant order, contact, billing, payment-status and support information through Stripe to fulfil and support the request. The WELTEN app and licence database do not store your full card number or security code.

Stripe/Link also processes information for its own consumer services and legal obligations. It is not solely our processor for all these activities. Its responsible entities, processing, retention and international transfers are explained in Stripe’s privacy policy and Link’s privacy centre. A Link billing account is separate from WELTEN. Stripe-hosted pages may use cookies and similar technologies under their own notices.

For a subscription, we also process the selected plan, subscription and customer references, trial and paid-period dates, payment status, cancellation requests and renewal/end dates. We use these records to provide the correct access period, send required service messages, stop renewals and reconcile refunds or a switch to one-time ownership. Billing information comes from your Checkout entries and Stripe's transaction updates; focus history is not used for billing.

We process necessary transaction and licence information to fulfil the contract or handle steps you request before it (Article 6(1)(b) GDPR). Specific legal record-keeping duties use Article 6(1)(c). Necessary abuse prevention and enforcement of the agreed personal activation limit use Article 6(1)(f), based on our interest in protecting the service. Payment and ownership information is necessary to verify paid access; optional installation names are voluntary. The free focus sessions do not require payment details.

Direct-download licence activation, recovery and checks

The direct-download licence service processes a random installation credential, a licence identifier, recovery-code verifier, purchase reference and status, activation identifiers, activation/deactivation dates and any installation name you choose. These support licence verification, restoration and management of two personal installations. The database stores hashed credential/recovery verifiers; they are pseudonymous data, not anonymous data. Credentials are transmitted over HTTPS when needed to authenticate a request. The Mac app keeps credentials and its verified offline proof in the macOS Keychain.

WELTEN does not automatically send your computer name or use a hardware fingerprint. It sends a licence reference to Stripe to associate the payment with the correct licence. It does not send focus sessions, projects, intentions, folder links or forest contents to the licence service. A recovery code is not required in ordinary support email and should not be included.

After activation, automatic online checks run on launch or foreground entry at most once per hour, and hourly during runtime. Pending purchases are checked more frequently; manual refresh is also available. A connection failure does not expire an activated one-time licence. A successful check can record a verified revocation or deactivation. Contact hello@welten.app for human review of an incorrect access result.

The service uses Cloudflare Workers and D1. The production and sandbox licence databases use the EU jurisdiction restriction, while edge request processing may occur internationally. The Cloudflare provider and transfer safeguards above apply. Request processing exposes the connection IP address and ordinary HTTP information to the host. Short-lived IP-derived request-limit identifiers are separate from licence records and are removed when older than one hour by a ten-minute scheduled job; unsuccessful runs can delay cleanup.

Direct-download licence and financial record retention

We keep the minimal purchase, licence and recovery records while the licence remains valid and recoverable. A perpetual licence is not deleted solely because of inactivity. Deactivated-installation identifiers and state remain recognisable for as long as an old credential or signed proof can still be presented; a perpetual proof can require a long-lived minimal record.

The scheduled cleanup provides deletion of optional deactivated-device names and confirmed abandoned checkouts after 30 days, processed operational event details after 90 days, and necessary ended-subscription contract evidence normally three years after the end of the relevant calendar year. Minimal ownership and replay-protection records remain where needed for recovery or to reject an old credential. Financial records, contract correspondence, unresolved processing and documented legal holds follow their separate rules below and under Contract emails and electronic declarations. These are purpose-based WELTEN limits, not universal GDPR deadlines. The cleanup runs every ten minutes; unsuccessful runs can delay deletion.

Where German retention duties apply, accounting vouchers and invoices are normally kept for eight years, required business correspondence and other tax records for six years, and required books and financial statements for ten years, from the relevant calendar-year end. Longer retention is limited to a specific legal duty, proceeding or documented claim. These duties do not require us to retain all technical licence metadata for the same period. See Section 147 AO and Section 14b UStG.

Deletion requests are assessed individually. We explain any minimum data that must remain and why. A privacy request does not automatically forfeit a valid licence. Link account/order deletion is separate from WELTEN licence records and does not delete your locally stored forest. Deleted data can remain temporarily in provider recovery backups until they expire; provider-operated logs and backups follow the applicable settings and notices.

Cookies and media

Our website does not use advertising cookies or browser storage for visitor identification. Fonts, images and the demo video are served with the website; there is no embedded YouTube player. Cloudflare Web Analytics is enabled as described below. Ordinary hosting request processing still occurs as described above.

Cloudflare Web Analytics

We use Cloudflare Web Analytics, provided by Cloudflare, Inc. at the address listed under Website hosting, to understand visits and improve page loading and usability. Cloudflare adds a measurement script to our website, processes its reports and makes statistics available to us in our Cloudflare account.

The reports include page and referring-page URLs, page-load timestamps, a random identifier for the current page load, and technical performance measurements such as loading times, visual stability and responsiveness. Depending on browser support, this includes resource timings and browser memory measurements. Statistics can be grouped by page, referring website, country, browser, operating system and device type. These are website measurements, not records of your focus sessions or forest. We do not combine them with beta email addresses, personal download records or licences.

According to Cloudflare’s description of the measurement script, it does not read or write cookies or browser storage. The page-load identifier is not a persistent visitor identifier. Cloudflare receives your connection IP address when handling the request; it states that its RUM service discards that address at the receiving data centre rather than storing it in its core databases or logs. This statement concerns the analytics service; ordinary hosting and security processing is described separately above.

To the extent personal data is processed, we rely on our legitimate interest in understanding website reach and improving its performance and usability (Article 6(1)(f) GDPR). Cloudflare provides this service for us under its data processing terms. Processing can take place outside the EEA, including in the USA; the international-transfer safeguards described under Website hosting apply.

Cloudflare currently retains unsampled measurement data for seven days and then reduces the dataset for longer-term statistics. Its reporting service gives us access to the previous six months. This reporting window is not a promise that every provider-held copy is deleted after six months; Cloudflare’s analytics documentation and privacy policy explain its processing and retention. We do not maintain a separate archive of individual analytics reports.

You may object to processing based on legitimate interests as explained under Your rights. You can also prevent this browser measurement by blocking Cloudflare Web Analytics with your browser or a content blocker; the website remains available.

Your rights

Subject to the conditions in the GDPR, you can request access, correction, deletion, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Where processing relies on consent, you may withdraw it for the future.

You may also complain to a supervisory authority, including the Independent Centre for Data Protection Schleswig-Holstein (ULD). We do not use your enquiry for automated decision-making or profiling.

App usage statistics (discontinued)

WELTEN no longer collects app usage statistics. Current versions contain no statistics option and send no usage reports.

Some earlier beta builds offered optional statistics, off by default and based on your consent (Article 6(1)(a) GDPR). After opting in, the app could report three milestones once per local installation: joining the measurement, completing a first focus session and returning to focus within seven days. Reports contained the event type, app build, schema version, new/existing setup classification, UTC day and completion-cohort day, plus a random event identifier to prevent retry duplicates. They contained no persistent installation identifier, project names, notes, session durations, focus history or world content, and were not linked to your email, licence or purchases.

Our service no longer accepts these reports. It rejects them without storing them, and an earlier build then discards any report still waiting on your Mac. Updating to a current version removes the remaining local statistics state. Reports received earlier only contributed to daily aggregate counts by build and UTC day, which we cannot attribute to a person. Event deduplication records were deleted after 14 days; the aggregate counts are deleted after 12 months at the latest, subject to the provider’s backup expiry. Internal Telegram summaries of these counts contained no identifiers or contact details and are removed when no longer needed.

Direct-download counters

Measurement-enabled download routes distinguish public downloads, update downloads through the separate update link offered to existing users, and our internal tests. We keep aggregate daily counts of completed full-file deliveries, partial requests and errors by build and route for up to 12 months. Requests from recognisable crawlers, link previews and scripted clients are delivered but not counted; the browser user agent is checked during the request and not stored. These aggregate counters use no cookies, per-person invitation identifier or app identifier. Personal beta links have the separate, limited delivery record explained above. A delivery count does not prove completed installation or identify a unique person. Existing direct archive links and update requests remain separate technical delivery statistics. Cloudflare’s ordinary connection processing still applies.

New counts through the standard public download route can also appear in our internal Telegram summaries, with the event type, build, UTC day and the country Cloudflare derives from the connection IP address. The address itself is not read or stored; only the two-letter country code is kept in the delivery bookkeeping described below, and the download counters stay without a country. Internal test downloads are excluded. Personal-link deliveries use their separate reference-based alert and do not create a second public-download alert. Telegram’s processing and international operations are described in Telegram’s privacy policy. Delivery and retry bookkeeping in D1 is removed by a daily job once its event day is more than 14 days old; personal-link bookkeeping is also removed when its invitation is deleted. Telegram messages are separate operational copies, reviewed and removed when no longer needed.

Profile short links

Our social media profiles link to short addresses on welten.app, such as welten.app/ig, that forward to the homepage. For each short link we count forwarded visits per UTC day in the aggregate database used for the download counters and keep these counts for up to 12 months. Link previews, prefetches and recognisable crawlers are forwarded but not counted; the browser user agent and request headers are checked during the request and not stored. We store no IP address, cookie, identifier or query string, so a count cannot show who followed a link or whether a visit led to a download or purchase.

We use these counts to understand which of our own profiles brings visitors to the website, based on our legitimate interest in understanding the reach of our channels (Article 6(1)(f) GDPR). Cloudflare’s ordinary connection processing described under Website hosting still applies. You can also open welten.app directly.

Optional YouTube playback in the app

In versions offering YouTube in Settings → Focus Sound, you can separately allow WELTEN to play a YouTube video or playlist during focus sessions. Playback uses YouTube’s official embedded player (served from youtube-nocookie.com), which WELTEN shows above Wurzel on your Mac. No browser, browser extension or YouTube sign-in is required. WELTEN loads nothing from YouTube until you allow playback and then test it or start a focus session with YouTube enabled.

While the player is open, Google receives ordinary connection and playback information, including your IP address, the selected content and that the player is embedded by WELTEN; ads may play. The player uses a temporary website data store, so YouTube cookies and sign-in are not kept after playback ends. WELTEN does not send your project names, intentions, session records, world progress, licence data or anonymous usage events, and playback does not pass through a WELTEN server. Links that leave the player, such as Open on YouTube, open in your default browser, where that browser’s own cookies and any existing sign-in apply.

We rely on your consent to enable this optional connection (Article 6(1)(a) GDPR). YouTube processes data under Google's Privacy Policy, including its retention and safeguards for international processing.

WELTEN keeps the chosen link, one playback position and source-specific volume preferences locally on your Mac. Replacing or removing the link clears its position; local-data erasure removes these preferences.

Turn off “Allow YouTube playback” to stop playback and withdraw permission. This does not erase information Google already received and does not affect earlier processing. The timer and local noise remain available without YouTube.

Optional local integrations

In versions offering Apple Reminders, you can grant macOS permission and select lists in Settings → Integrations. WELTEN reads list names, colours and open-task counts, and keeps task titles, list/task identifiers, due dates and completion state from selected lists in a local cache. Counting tasks in other lists does not keep their contents. Selecting a task for a session stores a local title and reference with that session. Only an explicit Mark complete or Reopen action changes a reminder; finishing a timer does not. WELTEN does not collect reminder notes, attachments or account credentials and does not send tasks to a WELTEN server. Reminders and any connected account, such as iCloud, handle their own synchronisation.

Disconnecting Reminders clears the local cache, selection and pending actions. The cache also expires after 30 days without refresh. Previously recorded task snapshots stay with your local session history until you delete that history. You can revoke Reminders permission in macOS System Settings. The purpose of this local access is the optional task feature you request; where GDPR applies to our processing, the legal basis is Article 6(1)(b). The local records are not used for analytics.

Optional Spotify playback controls the Spotify app installed on your Mac through macOS Automation. WELTEN keeps your chosen playlist link and preferences locally, sends playback commands to Spotify and reads its playback state. It does not receive your Spotify password, use Spotify's Web API or send playlists or focus data to a WELTEN server. Spotify handles its own account, playback and network processing under its privacy policy. Turn off this feature in Focus Sound settings or revoke Automation permission in macOS to stop future control.

The optional macOS Focus integration runs the Shortcut you choose to turn Focus on or off. WELTEN passes only the on/off instruction to its bundled Shortcut, not session or task details. Your own Shortcuts may perform other actions or contact services according to their configuration. Spotify and Focus automation provide the local features you request (Article 6(1)(b) GDPR where applicable); neither sends data to WELTEN. Their settings remain on your Mac until changed or local app data is erased.

Direct-download purchase recovery by email

To replace a lost direct-download recovery code, we use the email from your original completed direct-download purchase. We store it encrypted, together with a keyed lookup hash, purchase reference and date. This enables the recovery service you request (Article 6(1)(b) GDPR); protection against abuse is based on Article 6(1)(f) GDPR. Recovery does not create a WELTEN account or give us access to local focus data.

Recovery links and the necessary secure browser session expire after 30 minutes. Tokens are stored as hashes; queued emails containing a link are encrypted and deleted when the link expires. A new code is encrypted for up to ten minutes so an interrupted response can be retried; after that only its verification hash remains. Code-change event records and notification contents are retained for 30 days. Expired records are removed by the ten-minute maintenance job and cannot be used after expiry.

The original purchase address remains available while the licence ownership record is maintained; for retired subscriptions it is deleted with the existing retirement process described above. Support cannot redirect recovery to another mailbox. Rate limiting uses keyed address and connection-IP hashes for up to one hour, with cleanup on the next maintenance run. Recovery pages do not use tracking or analytics.

The existing Cloudflare hosting, EU-restricted D1 storage, transactional email delivery and transfer safeguards apply. The short-lived recovery cookie is necessary to perform your requested recovery and is not used outside that process.

The Mac app

Your focus sessions, projects and world are stored locally on your Mac. Visiting this website, testing Checkout or restoring a licence does not give us access to them. Licence operations are separate from local focus data and are not used for product analytics.