Privacy policy

PLACEHOLDER: the operating legal entity and its postal address must be inserted here before this page is published. Nothing below invents one.

Who this covers

This policy covers the ClickyPanel desktop application and the clickypanel.com website. "We" means the operator of ClickyPanel; contactsupport@clickypanel.com.

The desktop app

What stays on your computer

Everything you connect and everything the app fetches. Analytics credentials, the list of sites you added, cached traffic numbers and your settings are written to a local SQLite database in your operating system's application data directory. None of it is sent to us, and there is no ClickyPanel account or server to send it to.

How credentials are stored

API keys, tokens and provider passwords are encrypted at rest with XChaCha20-Poly1305. The encryption key is derived from stable identifiers of the machine the app is installed on, so a copied database is inert on any other computer and the credentials do not appear in plain text in backups, cloud-synced folders or support bundles.

Stated honestly: this is not OS keychain protection. The identifiers the key is derived from are readable by any software already running under your user account, so this defends against copies of the database leaving your machine, not against malware on it. Moving the key into the operating system's credential store is planned, and this section will be updated when it ships rather than before.

Who your data is sent to

Only the analytics providers you connect. The app calls their APIs directly from your computer, using the credentials you gave it. Their handling of that request is governed by their own privacy policies.

Crash reports

The app sends anonymous crash reports to Sentry, and this is on by default. A report contains the error, a stack trace, the app version and the operating system version. It does not contain your credentials, your site list or your analytics data. You can turn crash reporting off in Settings, and it stops immediately. We do not claim zero telemetry while this is switched on by default.

Updates

The app checks for new versions by requesting an update file from GitHub. That request reaches GitHub's servers with your IP address and app version, as any HTTP request would.

This website

clickypanel.com is a static site on Cloudflare Pages. It sets no cookies, runs no advertising or tracking scripts, and loads its fonts from its own domain rather than a third party. Cloudflare processes request logs as our hosting provider.

The v2 upgrade form

The v2 upgrade claim is the only form on this site and the only place it accepts an email address. There is no mailing list and no waitlist to join.

What happens to the address you type: it is compared against the list of ClickyPanel v2 purchase addresses, which is held as irreversible SHA-256 hashes rather than as addresses, and it is used to derive your personal discount code. Then the request ends. There is no database behind the form and nothing about your claim is written down or logged, which is also why claiming twice simply gives you the same code again. A successful claim hands you to Dodo Payments' checkout, and your address is covered by the section below from that point on.

Purchases

Payments are handled by Dodo Payments as merchant of record. They collect the billing details needed to take payment and charge tax; we receive your email address, your licence key and the country of purchase. We never see your card number.

Your rights

You can ask what we hold about you, ask for it to be corrected, or ask for it to be deleted, by writing to support@clickypanel.com. Because the app holds nothing on our side and the upgrade form stores nothing, such a request concerns only your purchase record, which is held by Dodo Payments as merchant of record. To erase what the app stores, use Clear all local data in Settings, or delete its application data directory.

Changes

If this policy changes materially, the updated date above changes with it and the change is noted in the changelog.