What we collect, which is almost nothing.

Who is responsible

Klarluft B.V. is the controller for the personal data described on this page. The full registration details are on the legal notice.

Controller

Klarluft B.V.

Address

Van Aerssenlaan 40C, 3039 KE Rotterdam, The Netherlands

Contact

contact@klarluft.com

Why there is no cookie banner

Consent banners exist because of a specific rule: under the EU ePrivacy rules, you must be asked before a site stores or reads information on your device. Cookies are the usual example, but the rule covers local storage and device fingerprinting too.

This site does none of those things. It writes no cookie, no local storage entry, and no identifier of any kind to your browser. There is therefore nothing for you to consent to, and asking anyway would be theatre.

The GDPR still applies to the small amount of data described below, which is handled on the basis of legitimate interests rather than consent. You can object to that at any time — see your rights.

What this website collects

Aggregate page-view statistics

We use Cloudflare Web Analytics, which is cookieless by design. It reports the page visited, the referring site, browser and operating system, device type, country, and how quickly the page loaded. It does not build a profile, and it does not follow you to any other site.

To count a visit as distinct, Cloudflare hashes properties of the request — including your IP address and user agent — on its own servers and discards them. Nothing is written to your device, and nothing that identifies you is stored. Loading this measurement is the only third-party request the page makes: a small script from static.cloudflareinsights.com.

Serving and securing the site

The site is hosted on Cloudflare's network. Like any web server, it processes your IP address and request headers in order to deliver the page and to defend against attacks and abuse. Cloudflare acts as our processor for this, under its data processing addendum.

The one script that runs in your browser

The download buttons reorder themselves to put your own platform first, because handing a Windows visitor a macOS disk image helps nobody. That decision is made entirely inside your browser: it reads the platform your browser reports and, on a Mac, the graphics renderer string to tell Apple silicon from Intel. It stores nothing, and it sends nothing anywhere — not to us, not to anyone. Every download link works identically with JavaScript switched off.

What we deliberately do not do

• No accounts, sign-ups, forms or newsletter.
• No advertising, retargeting or conversion pixels.
• No social media embeds or share widgets.
• No session recording or heatmaps.
• No fingerprinting for the purpose of tracking anyone.
• No third-party fonts or image hosts. Typefaces are served from this domain rather than linked from Google Fonts, so loading the page tells Google nothing.

When you follow a link off this site

Downloads are hosted as GitHub release assets, so following one sends you to GitHub. At that point GitHub receives your request and its own privacy statement governs what happens next. We receive no notification that you downloaded anything.

The Product Hunt badge near the top of the page is a link, not an embed. Product Hunt publishes it as an image served from their own servers; we copied the artwork into this site instead, so displaying it costs no request to them and they learn nothing about you from your simply loading the page. Click it and you are on their site, under their privacy notice, exactly as with GitHub above.

What the desktop app collects

Nothing that reaches us. GitWarren has no server, no account and no telemetry of any kind. Your repository paths, reviews, comment threads and comments are written to a single SQLite file in your operating system's application-data directory, alongside a folder holding any images you paste into a comment. That file is the whole of it.

Branch names, commits and diffs are not stored at all. They are read from git each time they are shown, which is also why the app can review work that has not been committed yet.

The one exception is updates. A packaged copy of the app asks GitHub for the latest release on launch and every six hours after that. That request tells GitHub your IP address, the version you are running and your platform, in the same way visiting any web page would. It tells us nothing — we never see it. The Linux deb and rpm packages do not auto-update, so they make no such request.

Local AI agents talk to the app over a standard-input/output MCP connection on your own machine. No network is involved in that either.

If you email us

We keep the correspondence for as long as it takes to deal with your question, and for a reasonable period afterwards in case you follow up. We do not add your address to any mailing list, because there isn't one.

Legal bases

• Delivering and securing the site — our legitimate interests in running a website that works and stays up (Article 6(1)(f) GDPR).
• Aggregate statistics — our legitimate interests in knowing roughly how many people arrive and from where. The balance falls in your favour easily here: there is no identifier, no profile, and no way to single you out.
• Answering your email — our legitimate interests in replying to someone who wrote to us.

How long anything is kept

Cloudflare keeps the aggregate statistics for a short rolling window — around a month on our plan — after which they are gone. We do not export them, archive them, or combine them with any other source. Request and security logs are retained by Cloudflare for a short period under its own policy. Email is kept as described above.

Who else is involved

• Cloudflare, Inc. — hosting, content delivery, protection against attack, and the aggregate statistics.
• GitHub, Inc. — the source code, and the release files the download buttons and the app's updater point at.

That is the complete list. Nothing is sold, and there is nothing here that could be sold.

Transfers outside the EEA

Both companies above are based in the United States. Cloudflare relies on its certification under the EU–U.S. Data Privacy Framework, with the European Commission's standard contractual clauses as the fallback, as set out in its data processing addendum. GitHub sets out its own safeguards in its privacy statement.

Your rights

Under the GDPR you may ask us for access to your personal data, or for its correction or erasure; you may ask us to restrict how we use it; you may object to processing based on legitimate interests; and you may ask for a portable copy. Write to contact@klarluft.com and we will answer within a month.

One honest caveat: because the statistics hold no identifier, we usually cannot find your data in them, and so cannot hand it over or delete it on request. That is a consequence of collecting so little rather than an evasion — there is no key that would let us look you up, by design.

If you think we have got this wrong, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority where you live.

Changes

If this policy changes, the date at the top of the page changes with it. The app itself is GPL-3.0, so if you would rather verify the claims above than take them on trust, the source is there to read.