Privacy

This is a courtesy translation. Only the German version is legally binding. Read the German version

Last updated: 13 October 2026

Controller

MOJM – Owner: Oliver Terp
Heinrich-Lübke-Str. 16
42579 Heiligenhaus
Germany
Email: [email protected]

This website

This website sets no cookies of its own and uses no analytics. It uses your system fonts, and all files are served from this domain. The exceptions are Cloudflare’s security cookies and the checkout page, see below.

Server and server logs

This website runs on our own server, hosted by Hetzner Online GmbH in a data centre in Germany. When you open a page, the web server logs connection data: your IP address, the time of the request, the requested URL, the response status and your browser’s user agent. We use these logs only to operate the website securely and to find errors, and delete them after 14 days. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).

Download statistics

When you download Cavvy with the download button on this website, we count the download. We store the time, the app version, the country Cloudflare determines from your IP address, whether the request came from a Mac, the website that linked to the download (its domain only) and whether the request looked automated. We do not store your IP address or anything else that identifies you. We use these counts to see how many people try Cavvy, and delete them after 90 days. The legal basis is our legitimate interest in knowing how our product is received (Art. 6(1)(f) GDPR).

Cloudflare

Requests to this website, including app updates and downloads, pass through Cloudflare (Cloudflare, Inc., USA), which protects the site against attacks and delivers it. Cloudflare processes connection data such as your IP address and the requested URL on our behalf, under its Data Processing Addendum, which includes the EU Standard Contractual Clauses for transfers to the USA. See also Cloudflare’s privacy policy. The legal basis is our legitimate interest in protecting the website against attacks and abuse (Art. 6(1)(f) GDPR).

To tell people from bots, Cloudflare stores the cookie __cf_bm in your browser. It expires after 30 minutes of inactivity, and only Cloudflare can read its encrypted content; it is not linked to any account or identifier on this website. If Cloudflare shows you a security check, passing it stores the cookie cf_clearance, so that the check is not repeated. Neither cookie is used for tracking or advertising. Both are strictly necessary to protect the website, so no consent is required for them (§ 25(2) no. 2 TDDDG).

Language

On your first visit, this website shows the language your browser asks for. A small script in your browser decides this from the language setting your browser shares anyway; it sends nothing to us. If you pick a language in the language menu yourself, your browser stores that choice in its local storage (localStorage, entry mojm-lang, only the language code), so the website can respect it on your next visit. The entry never leaves your device, and you can delete it at any time in your browser settings. It is strictly necessary for the language choice you asked for, so no consent is required for it (§ 25(2) no. 2 TDDDG).

The Cavvy app

Cavvy has no telemetry and requires no Cavvy account. We receive no data about how you use the app. Apple Intelligence features run on your device. Cavvy does not store SSH keys; it uses your existing SSH configuration.

Two features contact web services directly from your Mac when you use them; we receive none of this data. When you choose a project icon, Cavvy looks up the logos of the tools your project uses: it sends their names to Wikidata and loads the icon from each tool’s website. The usage display for Claude Code is off until you turn it on; it then reads your Claude Code login from the macOS Keychain and asks Anthropic for your current limits. Codex limits are read from local files.

The coding agents you choose and the remote servers you connect to may process data under their own policies. Review those policies before using them.

Updates

To check for updates, Cavvy downloads the update feed from this server. The request carries Cavvy’s version in its user agent and nothing else. Like any request, it appears in the server logs described above. The legal basis is our legitimate interest in providing secure updates (Art. 6(1)(f) GDPR).

Purchases

Purchases are handled by Paddle (Paddle.com Market Ltd), our Merchant of Record and payment provider. Paddle is the seller of the license, processes your name, email address, billing address and payment details as its own controller, issues the invoice and handles taxes, under its own privacy policy.

The checkout is the only part of this website that loads an external script: the page /buy (and its versions in other languages, such as /de/buy) loads Paddle.js from paddle.com when you open it. No other page does. Paddle’s checkout may store data in your browser under Paddle’s own policy.

License delivery

After a purchase, Paddle notifies our server. The server asks Paddle for the purchase, creates your license from it and sends it to the email address you gave Paddle, through our own mail server. The license contains the transaction ID, your email address, your name if Paddle has it, and the purchase date. We don’t store your purchase or your license; the license is recreated from Paddle’s records whenever you need it. The legal basis is the delivery of the license you bought (Art. 6(1)(b) GDPR).

If you request your license again on the license page, we use the email address you enter only to look up purchases at Paddle and to send the email. To prevent abuse, the server briefly keeps your IP address and the email address in memory to limit the number of requests; they are discarded within about an hour. The legal basis is your request (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on our legitimate interests (Art. 15–21 GDPR). To exercise these rights, write to [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (ldi.nrw.de).

We do not use automated decision-making or profiling.