Privacy Policy

1. Overview and Data Controller

We take your privacy seriously. This privacy policy informs you about the nature, scope, and purpose of the processing of personal information when using the StayGray iOS App, Browser Extension, and Website.

Data Controller

We have not appointed a Data Protection Officer (DPO) because we are not legally required to do so.

2. General Principles

We process personal information in accordance with the GDPR and applicable national laws. We process only the information necessary to provide the service, keep it secure, and fulfill contractual and legal obligations.

No website tracking: Our website does not use cookies, localStorage, analytics tools, embedded third-party content, third-party fonts, or website error tracking.

3. Website Hosting and Extension Validation API (Vercel)

Our website and the validation API for our browser extension are hosted by Vercel Inc. in the USA.

Data processed (technical access data):

• IP address
• Date and time of request
• Requested URL
• User agent, including browser type, version, and operating system
• Referrer, if provided by the browser
• Security and error-related technical data, where applicable

Purpose: Providing the website and API, and ensuring security and stability, including abuse prevention and defense against attacks.

Legal basis: Art. 6(1)(f) GDPR, which relates to legitimate interest in secure and stable operation.

Retention (Vercel logs on the free plan):

• Runtime logs are stored for 1 hour on the Hobby free plan
• Build logs are stored indefinitely for each deployment

We avoid logging unnecessary personal information in application logs.

International transfers (USA):

Vercel may process data in the USA. Vercel provides a Data Processing Agreement and supports transfer mechanisms such as Standard Contractual Clauses (SCC). Vercel also states it is certified under the EU-U.S. Data Privacy Framework (DPF).

4. Data Processing in the iOS App

4.1 Subscriptions and Payments (Apple App Store and RevenueCat)

Subscriptions are sold via the Apple App Store. We use RevenueCat to manage subscription status in the app.

Information we receive and process:

• From RevenueCat, we receive a typically pseudonymous App User ID, subscription status, entitlements, and purchase metadata such as the purchase date
• We do not receive credit card details or full payment information from Apple

Purpose: Provide and manage Plus features and verify subscription status.

Legal basis: Art. 6(1)(b) GDPR, which relates to the performance of a contract.

Retention:

• We keep the minimum subscription status and identifier data needed to provide access for the duration of the subscription and for subscription-related support, then delete it upon request where feasible
• Apple retains App Store purchase-related data for periods required by financial and legal obligations, which often involve long retention periods

4.2 Crash Diagnostics (No third-party SDK)

We do not use a third-party crash reporting SDK.

If users have enabled sharing of Apple diagnostics, Apple may provide us with aggregated or device diagnostic information to help improve stability.

Data processed, if provided via Apple diagnostics:

• Device state at the time of the crash
• Device type and iOS version
• Crash and diagnostic logs

Purpose: Improve app stability.

Legal basis: Art. 6(1)(f) GDPR, which relates to legitimate interest in product quality and stability.

Retention: We keep diagnostic information only as long as necessary to investigate and fix issues, then we delete or aggregate it.

5. Data Processing in the Browser Extension

5.1 Permissions and Local Functionality

The extension requires access to websites solely to inject CSS code that turns the page grayscale.

Local processing only: We do not collect, store, transmit, or analyse your browsing history or page content.

5.2 License Purchase and License Validation (Lemon Squeezy + Vercel API)

Payments for the extension are handled by Lemon Squeezy, who acts as the Merchant of Record. To activate the extension, you enter a license key. The extension validates it daily by sending it via our Vercel API to Lemon Squeezy for verification.

Data processed:

• License key entered by you
• Validation result, including whether it is valid or invalid and related status metadata
• Technical request data, such as IP address, timestamp, and user agent, when calling our API and Lemon Squeezy

Purpose: License verification and fraud prevention.

Legal basis: Art. 6(1)(b) GDPR, which relates to the performance of a contract.

Retention:

• On the extension, the license key is stored locally so the extension remains activated, and it can be removed by uninstalling or clearing extension data
• On Vercel, runtime request logs are retained for 1 hour on the Hobby plan, and build logs are kept indefinitely
• Lemon Squeezy retains purchase-related data as needed for providing its service and for legal and accounting obligations according to its policies

6. Contact and Support

If you contact us via email, we process your email address and the content of your message.

Purpose: Responding to inquiries and support.

Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.

Retention: This information is deleted 30 days after the request has been fully resolved, unless statutory retention obligations apply.

7. Required vs Optional Data

• For paid extension features, a license key is required to activate those features, as activation will otherwise fail
• For Plus features in the iOS app, subscription status is required to unlock those features
• For website and API delivery, technical access data is necessary to deliver the service securely

8. Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

9. Your Rights

You have the GDPR rights of access, rectification, erasure, restriction, data portability, and objection under Art. 15 to 21 GDPR. To exercise these rights, please contact contact@staygray.app.

Some data is handled by third parties as independent controllers, such as Apple for App Store purchases, in which case you may also need to contact the relevant provider.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority under Art. 77 GDPR.

Competent authority for us: Die Landesbeauftragte für den Datenschutz Niedersachsen.

11. Children's Privacy

Our services are not directed specifically at children. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us and we will take appropriate steps.

12. Changes to this Privacy Policy

We may update this privacy policy when necessary. The Last Updated date indicates the current version.