This is a translation for convenience. The German version (Datenschutzerklärung) is legally binding.

Privacy policy

Last updated: 4 October 2026

1. Controller

Naptrix – Fabian Frank
Johannishofweg 21A, 64579 Gernsheim, Germany
Email: [email protected]

A data protection officer has not been appointed and is not legally required.

2. The short version

This website sets no cookies, uses no analytics and loads no content from third parties. Personal data is only created when you visit the page (technically necessary server logs), write us an email, sign up for the newsletter or buy Kanora.

3. Hosting and server logs (Cloudflare)

The website is delivered via Cloudflare Pages: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary data: IP address, date and time, page requested, browser and operating system, previously visited page (referrer). Purpose: delivering the page, protection against attacks and abuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). A data processing agreement is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). We do not analyse this data ourselves.

4. Contact by email

If you write to us at [email protected], we process your email address and the content of your message in order to answer your request. The legal basis is Art. 6(1)(b) GDPR if the matter concerns a purchase or contract, otherwise Art. 6(1)(f) GDPR. Emails to this address are forwarded via Cloudflare Email Routing to our mailbox at WEB.DE (1&1 Mail & Media GmbH, Germany). We delete requests once they are dealt with and no retention obligations apply.

5. Fonts

The fonts are stored on our server and loaded from there. No connection to Google or other providers is made.

For the newsletter we only need your email address. Sign-up uses the double opt-in procedure: you receive an email with a confirmation link, and only after that are you subscribed. Brevo stores the time of sign-up, the time of confirmation and the IP address from which you confirmed, so that we can prove your consent. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every email or by message to us; afterwards we delete your address (we may keep proof of the earlier consent for up to three years, Art. 6(1)(f) GDPR).

The sign-up form is part of our page. When you click “Sign up”, your address goes to our own server function at Cloudflare, which passes it on to the email service provider; merely visiting the page loads nothing from it. The email service provider is Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, a company of Sendinblue SAS, Paris). Brevo stores the data on servers in the EU; for individual auxiliary services Brevo uses subprocessors in the USA, secured via the EU-US Data Privacy Framework or standard contractual clauses. The data processing agreement is part of our contract with Brevo. Opens and clicks in our emails are only counted anonymously by Brevo and are not linked to your address.

Depending on the language of the page on which you sign up, we add your address to a German-language or an English-language list at Brevo. For this, the form sends the language together with your address.

7. Purchase via Lemon Squeezy

Kanora is sold via Lemon Squeezy, which acts as reseller (merchant of record): Sold through Link, LLC (formerly Lemon Squeezy LLC), 222 Main Street, Suite 500, Salt Lake City, UT 84101, USA. Once sales start, the buy button on this page leads to Lemon Squeezy’s checkout page. There you enter your name, email address, country and payment details directly with Lemon Squeezy; Lemon Squeezy is responsible for this itself (its own privacy policy: lemonsqueezy.com/privacy). From Lemon Squeezy we receive the data needed for licensing and support: name, email address, country, order and license key. The legal basis is Art. 6(1)(b) GDPR. Lemon Squeezy also processes data in the USA.

8. Download via GitHub

The beta version is hosted on GitHub (GitHub, Inc., USA). When you click the download link you connect directly to GitHub; GitHub’s privacy policy applies. Our page does not embed any content from GitHub.

9. Privacy in the Kanora app

Kanora runs on your PC. Measurements, sessions, settings and configurations are only stored locally and not transmitted to us on their own. The app only connects to the internet in these cases:

License check (Lemon Squeezy): license key and the name of your PC (Windows computer name), so that you recognise the activation in your Lemon Squeezy account. The key is checked at startup and about every half hour. Legal basis: Art. 6(1)(b) GDPR.
Update check (purchased version only): Shortly after startup the app asks updates.kanora.dev whether a new version is available. This address runs via Cloudflare (see 3. Hosting and server logs) and forwards the request to GitHub (GitHub, Inc., USA), where the version information and the installer are stored. Only the technically necessary connection data is transmitted to Cloudflare and to GitHub (IP address, time and the program's technical identifier (user agent)), no measurements and no sessions. The app downloads the installer from GitHub only after you explicitly confirm in the update window; GitHub’s privacy policy applies (see 8. Download via GitHub). The automatic check can be switched off in the settings; you can also check manually. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, up-to-date software).
Cover images and title suggestions (Steam): Game names are sent to Steam’s public store search (Valve Corporation, USA), images are loaded from the Steam CDN. No account, no further data apart from the technically required IP address. Can be turned off in the settings. Legal basis: Art. 6(1)(f) GDPR.
SteamGridDB (optional): Only if you enter your own API key are game names also sent to SteamGridDB.
Feedback from the app: Only if you yourself click “Send” in the feedback window or the error window. What is transmitted: your text, the chosen category, app version, operating system and language, plus contact details if you enter any. For an error report, the app’s error message is added; user names in file paths, email addresses, IP addresses and license keys in the error message and the description are masked beforehand. The report goes to our server at Cloudflare (api.kanora.dev) and is stored in a database in the EU. We also receive an email notification containing the content of the report; during the beta it goes to our mailbox [email protected] (Google Ireland Limited, Ireland; Google also processes data in the USA and is certified under the EU-US Data Privacy Framework). We store neither your IP address nor a device identifier, and only the day as the time. AI (Claude by Anthropic) helps us sort and summarise. Legal basis: Art. 6(1)(f) GDPR (fixing errors and answering your message). We delete reports at the latest twelve months after receipt, reports from the beta after the beta ends.
Diagnostic reports: Only if you yourself click “Send report” in the “Diagnostic report” window. The report is shown to you in full beforehand, and you can edit it. User names in file paths, the user name and the name of your PC, email addresses, IP addresses, the serial number of your handheld, license keys and key-like character strings are masked in the report text. What is transmitted: the text shown (app version, Windows version, device data, the latest warnings and errors from the app’s log, optionally the full log and a session with game, launcher, measurements, crashes and configuration; the text also contains the time the report was created), your note and contact details if you enter any, plus app version, operating system and language. Storage, email notification, help from AI, legal basis and deletion period are the same as for feedback from the app.
Anonymous feedback for the knowledge base: Only if, after an AI assessment of a crash, you expressly click “Send exactly this”. The app shows you the full content beforehand. What is transmitted: app version, language, the launcher used, the device model, for each crash the first line of the crash message (without time and process IDs) together with the ID of a matching knowledge-base entry, the AI’s answer saved by you and your verdict on whether it helped. User names in file paths, user and PC names, email and IP addresses, the handheld’s serial number, license keys and key-like character strings are masked by the app beforehand. We store neither IP address nor license key, session or device identifier, and only the day as the time. The data sits in a database at Cloudflare in the EU and is used to improve the crash explanations in Kanora. Because we cannot link a report to a person, it can no longer be looked up or deleted individually afterwards (Art. 11 GDPR). Legal basis: your consent by clicking (Art. 6(1)(a) GDPR).
Release notification (beta version only): Only if you enter your email address via the “Release info” button and click “Sign up”. The app then transmits your email address, the app language and its version number (as the app’s identifier in the request header) to the same server function as the form on this website. Everything else, including the confirmation email, works as described under 6. Newsletter.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. A message to [email protected] is enough.

You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

11. Encryption

The website is delivered exclusively via HTTPS (TLS).