Privacy Policy

Effective date: 2026-05-31. Last updated: 2026-05-31.

What we collect

Data	When	Why
Email address	At checkout	License delivery
Hashed machine identifier (SHA-256 of license UUID + IOPlatformUUID, never the raw UUID)	On license activation and weekly heartbeat	Enforce 3-machine activation limit
License JWT (signed token, no personal information inside)	At activation	Verify license validity on the app side
Activation timestamps and revocation status	On every activation event	Operate the license system

What we do NOT collect

Your IP address or geolocation (Cloudflare logs are retained 7 days then discarded)
The content of your snippets, tools, or any input you process inside DevTray (all local, never sent to a server)
Application telemetry, crash reports, or usage analytics
Raw IOPlatformUUID (we hash it before sending; the server only sees an opaque hash)

Where data is stored

Cloudflare KV (Workers infrastructure, US/EU edge nodes)
Resend email logs (United States), 90-day retention
Paddle.com Market Limited (Merchant of Record) holds checkout and customer data per their privacy policy

Sharing with third parties

We share your email address with Paddle.com (Merchant of Record) at checkout and Resend (email delivery). We do not sell or share your data with advertisers or data brokers.

Your rights (GDPR, CCPA, LGPD)

You may request access to your data, deletion, or correction by emailing support@devtray.app. We respond within 30 days. For full account deletion, we will revoke your license keys, purge the KV record, and delete email logs we control.

Children

DevTray is not directed at users under 13. We do not knowingly collect data from children.

Changes

Material changes to this policy will be posted here with an updated date.

Contact

support@devtray.app