Privacy

The plugin

Heimdall3D makes no network connections. It does not check in, does not look for updates and does not report what you opened. That is not a policy that could quietly change in a later build: the DLL imports only GDI32, KERNEL32 and USER32. No networking library is linked into it at all. Anyone can verify that with a dependency viewer.

Your licence key is checked on your own machine against a key embedded in the plugin. No activation, no machine fingerprint, no account. Nothing about the files you browse leaves your computer.

If the plugin crashes it writes one short text file on your own machine. That file records the fault, the call stack, the name and size of the file being previewed, and how far the preview had got. It goes to %LOCALAPPDATA%\Heimdall3D\crash, or to the LocalLow folder of the same name when the Windows preview pane is the host.

The newest five are kept and older ones are deleted. Nothing is sent anywhere, and you can delete the folder at any time. A full memory image of the process is written only if you set HEIMDALL_CRASH_DUMP=1.

This website

Reading these pages sets no cookie. Signing in to the admin area sets one, and it holds a session token and nothing else. Its path is /admin, so your browser does not send it with a request for a public page.

No analytics, no tracking pixels, no embedded fonts. Every page except the one that takes a payment loads nothing from anywhere but this server, and the site's own content-security policy forbids it on those pages rather than leaving it to good behaviour.

The exception is the buy page, and it is described under When you buy below. It is the only page on this site that loads a script from anyone else.

The site software keeps no visitor log of its own. It writes startup messages, errors, and a few lines saying what it did: that a report was stored, how long it was and which country it came from, that a download was asked for under a filename this build does not publish, that a sign-in used a recovery code or a code that was already spent, how many expired sessions were deleted. No line carries an email address, an IP address, or the text of a report.

The site runs on a server in Nuremberg, Germany, rented from Hetzner. No content delivery network sits in front of it and no request is routed through a third party. Hetzner is my processor for the hosting itself and does not read the data.

The web server in front of the site writes one ordinary log line per request: your IP address, the time, the page or file requested, the response status and the browser's user agent string. That is what any web server writes, and it is what a download is counted by. Those lines stay on that machine, are not joined to anything else, and are not sold or shared.

On the machine itself, the operating system records service start and stop events, as any Linux system does. Nothing there identifies a visitor.

When you buy

The payment is handled by a reseller acting as merchant of record. Card details go to them and never reach this server or me. I could not see them if I wanted to.

The buy page loads one script from cdn.paddle.com, which is the reseller's own. Opening that page fetches it, so Paddle's servers see the request: your IP address, the time, and the browser string, the same three things any server sees. No other page on this site loads it, and the script is not on the pages you read before deciding to buy.

That script tries to load a second one, an analytics library at public.profitwell.com. This site's content-security policy names Paddle's own domain and nothing else, so the browser refuses that request and it is never fetched. The claim above that there are no analytics on this site holds on the buy page too.

Pressing the buy button opens Paddle's checkout in a frame over the page. Everything typed into it goes to Paddle and not to this server: your name, your address, your card number and your VAT ID if you give one. Their frame is theirs, and this site cannot read what is in it. What comes back to me is the outcome, described in the next paragraph.

What I receive is your email address and the order reference, and those exist for exactly two purposes: to issue your licence key, and to send it to you again if you lose it. Your address is also written inside the key itself, which is how the key stays personal to you and why a shared key is not anonymous.

That reseller is Paddle. They are a separate controller for the payment data, not my processor: they decide what they collect to take a card payment, to meet their own anti-fraud obligations, and to charge and remit the VAT in your country. Their policy governs that data, and this one cannot speak for it.

The order records I keep are your email address, the order reference, what was bought, the time the merchant billed it, and the time your key was sent. No amount and no payment detail is stored here. Those are business records under German law, so they are kept for the statutory retention period set by § 147 AO and § 257 HGB. That period is longer than most people expect, and it is not mine to shorten: an invoice I am required to be able to produce is not something I may delete on request. Everything outside those records is deleted when it stops being useful.

When you send a report

The form on the front page stores exactly what you type into it: the description, and the email address if you filled that field in. Nothing else is recorded with it. No IP address, no browser string and no identifier of any kind is attached to the report, so a stored report cannot be traced back to the person who sent it unless that person put their address in it.

Reports are read to fix the thing they describe. An address given with one is used to answer it and for nothing else: it is not added to any list. Reports are deleted when the thing they describe is fixed or judged not to be a fault.

The release list

If you give your address to the release list, that address is stored so a confirmation request can be sent to it. Nothing is sent to an address that has not answered that request, which is the double opt-in that § 7 UWG requires. An address that never confirms is deleted rather than kept.

The list carries one message per release and nothing else. It is not shared and not sold. Every message carries an unsubscribe link, which opens a page with one button and needs no reply and no account. The address is kept after that, and kept for one purpose: so that it stays off the list. You can also ask to have it erased outright by mailing quark@heimdall3d.com.

When you email me

Support email lands in an ordinary mailbox and stays there until it is no longer useful. If you send a file so I can reproduce a bug, it is used for that and deleted afterwards.

Key recovery

The recovery page emails your key to the address that bought it, and never displays it. That is a privacy decision as much as a security one: a page that showed a key to whoever typed an address would let anyone find out what someone else had bought.

Accounts

An account, where one exists, holds an email address and a password hash. The password itself is never stored, only a hash it cannot be recovered from. Signing in records the address and the browser string the sign-in came from, so the account holder can see their own sessions and end one they do not recognise. A session row is kept until it expires or you end it, whichever happens first, and the row is deleted within an hour of that.

Administrative actions are recorded: which account acted, what it did, when, and the address it acted from. That record is kept rather than pruned, because it is itself a security control. None of this is passed on to anyone.

A failed sign-in is recorded the same way, and that one can be about somebody with no account here. The record holds the email address typed into the form, the IP address it was sent from, the time, and a short reason the attempt failed. That reason says which step failed, so it records whether an account exists at that address. It is written whether or not one does, so typing an address into the sign-in form puts it in that record even if it has never been used here for anything else.

Those rows are kept indefinitely. An attempt to get into the admin area is the thing an audit trail exists for, and a trail that expires before the attempt it describes is found is not one. The admin area is not linked from any page and nothing on this site asks you to sign in, so a row here is either mine or somebody probing the form.

Your rights

You can ask what I hold about you, ask for it to be corrected, or ask for it to be deleted, subject to the retention periods above. Email quark@heimdall3d.com. You also have the right to complain to a data protection supervisory authority.