Privacy Policy

Controller

The app collects none of your content

Mellan has no accounts and no cloud sync. Your clipboard content and notifications travel directly between your Mac and your phone over an encrypted Bluetooth Low Energy link that the two devices establish when you pair them. None of that content reaches us, and none of it is stored anywhere but on your own devices. Sending from Android is an explicit action you take, unless you turn on automatic clipboard sync. Then the Android app reads your clipboard in the background, including text you copy in other apps, and sends it to your paired Mac the same way. You can turn it off at any time.

The apps send us no telemetry, no crash reports and no usage analytics. The only server the Mac app talks to is ours, to activate and check its licence, as described under Payments and licences below.

This website

Legal basis in brackets, per Art. 6(1) GDPR.

• Hosting (Vercel Inc., USA). Serving this site creates server logs containing your IP address, user agent, requested page and timestamp. Used to deliver the site and keep it secure; deleted on Vercel’s rolling schedule. (Art. 6(1)(f) — legitimate interest in a working, secure website.)
• Analytics (Plausible, self-hosted by us at insights.wsky.dev).We run the analytics server ourselves, so no third party receives your data. Cookieless and privacy-first: no cookies, no cross-site tracking, no personal profiles. IP addresses are not stored; they are only used transiently to generate a daily, salted, non-reversible visitor hash. (Art. 6(1)(f) — legitimate interest in basic visitor statistics.)
• Bot protection (Vercel BotID). Runs on form submissions to block automated abuse, processing request headers and signals about your browser. (Art. 6(1)(f) — legitimate interest in preventing spam.)
• Waitlist (closed). Before sales opened, you could leave your email address to hear when Mellan became available. We keep those addresses, and when each was added, with Upstash (servers in the EU) only to send that one announcement. We use them for nothing else and never sell or share them, and we delete the list once the announcement has gone out, or sooner if you ask us to. (Art. 6(1)(a) — your consent, withdrawable at any time.)
• Fonts. Typefaces are served from this website’s own domain. No request goes to Google Fonts or any other font CDN, so no data is transmitted to a third party when a page loads.

Payments and licences

Our order process is conducted by Paddle.com, who act as Merchant of Record and as an independent controller for your payment data. We never receive your full card number. To issue your licence and handle refunds we read the purchase record from Paddle, which also contains limited payment details (the type of card, its last four digits, expiry date and cardholder name), the order amounts and references to your billing address. We use these only to check the purchase and do not store them. From your customer record we read your email address. See Paddle’s privacy notice.

• Your licence (Upstash, servers in the EU). We store your licence key, the email address and order reference it was bought with, and when it was bought. For each Mac that activates the key we store the identifier and the name the Mac app reports for it, when it was activated and when it last checked its licence. We use this to deliver your key, to hold each licence to its Mac limit and to let you see and remove the Macs using it. We keep it for as long as the licence exists, or until you ask us to delete it. (Art. 6(1)(b) — performing our contract with you.)
• Licence emails (Amazon Simple Email Service, servers in the EU).Your key is emailed to you after purchase, and again if you request it on the licence page. Amazon Web Services processes your email address and the message to deliver it. (Art. 6(1)(b) — performing our contract with you.)

Your rights

Under the GDPR you can request access to your data, correction, deletion, restriction of processing, and data portability; you can object to processing based on legitimate interests; and you can withdraw consent at any time with future effect. Write to help@mellan.app — one person reads that inbox and will answer within 30 days. You also have the right to complain to a supervisory authority, for example the Bayerisches Landesamt für Datenschutzaufsicht.

Transfers outside the EU

Vercel, Paddle and Amazon Web Services may process data in the USA. Those transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

Changes

We update this policy when the site or the product changes. The current version always lives at this address.