Privacy Policy

As of: 19 September 2026

1. Controller

YARX GmbH
Wolfgrubenstrasse 56, 5742 Kölliken
Switzerland
Email: support@opura.app

2. Principle

Opura is built to use as little data as possible: the apps process photos and videos locally on your Mac. Your media are not automatically uploaded to Opura. Files you voluntarily send to support and external AI assistants you choose are separate cases. There are no advertising trackers, no analytics cookies and no disclosure of data for advertising. Fonts are loaded from our own servers (no Google Fonts request).

3. Data we process

3.1 Opura account

• Email address, name, optional company name
• Purpose: account, licence management, downloads, update entitlement
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR)

3.2 Licences and device activation

To limit new trials to once per account and Mac per app, we also store a purpose-bound device-consumption record. It contains the product code, a further SHA-256 hash of the existing device fingerprint, hashed references of entitled trial licences, and the time of first use. This separate record contains no email address, account ID or raw hardware ID. It is pseudonymous and not a hardware attestation. It remains after account deletion for as long as the trial offer and protection against repeated trial use need this record; if that purpose ends, it is deleted. Trial licences already issued keep their expiry date.

• Licence key, licence status, update period
• Per activated device: a salted, one-way device fingerprint (hash), device name, model, macOS and app version, activation / last-seen time
• Purpose: enforcing the seat limit (3 devices), abuse prevention
• Legal basis: performance of a contract; legitimate interest

3.3 Purchase and payment

Purchases are handled entirely by our payment partner Polar Software Inc. as merchant of record. Polar is an independent controller for the transactions. Card data (card numbers and similar) never reach our application.

When a checkout starts we send Polar: account email, account ID, IP address, product identifier, the internal checkout reference and, for a renewal, the licence ID.

Polar webhooks may contain further fields, including a customer email. For licensing and accounting we retain from them order, checkout and Polar customer IDs, product identifier, amounts, currency, tax, invoice number and refund status, plus a hash used to recognise the message, not its full contents. A customer email that arrives in the webhook is not stored on this path. Polar's privacy policy: https://polar.sh/legal/privacy-policy

If you delete your Opura account, we instruct Polar to anonymise your customer record there: name, email address, billing address and the link to your Opura account are removed. Invoices issued by Polar remain unaffected.

Account deletion deletes the data linked to your account on our side and ends the related entitlements (licences and device seats). Invoice records we keep by law are detached from your account. Polar, as an independent controller, keeps its own transaction and invoice records.

3.4 Server logs

Visiting the website and using our interfaces produces technically necessary log data (IP address, time, requested resource, user agent). We use these for operation, security and fault diagnosis. The legal basis is our legitimate interest in secure and available services (Art. 6(1)(f) GDPR). Retention follows the criteria in section 6.

3.5 In the apps

The apps send no telemetry. They connect to Opura online services to sign in to your Opura account, activate and check licences, and use the authenticated update channel (checking and downloading new versions). If you enable the optional MCP interface and grant access, an AI assistant you choose can communicate with the app. The connection to the app remains local. Any further processing by your AI assistant is governed by its settings and privacy terms.

3.6 Support

If you contact us, we process your email address, any other contact details you provide, subject, message content, attachments you voluntarily send, and technical email headers. Inbound messages including attachments are stored in our support inbox and forwarded to our business email mailbox for handling. The purpose is to address your enquiry and resolve reported problems. The legal basis is performance of a contract or steps at your request before a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

4. Recipients

Scroll horizontally for further columns.

The services we use may process personal data outside Switzerland and the European Economic Area. The published data processing agreements of Supabase and Resend provide for EU standard contractual clauses with adaptations for Switzerland.

Cloudflare’s data processing agreement refers to the EU–US or Swiss–US Data Privacy Framework for covered transfers to the USA. It provides for standard contractual clauses for other relevant third-country transfers and as a fallback. The linked agreements describe these safeguards in more detail. You can request information about the safeguards used for your data via support@opura.app.

Polar processes purchase and transaction data as an independent controller. Polar describes its international transfers and the safeguards it provides in its privacy policy.

Proton’s data processing agreement describes processing on behalf of customers and the conditions for international transfers.

5. Cookies and local storage

The website does not set tracking cookies. For the account area the session is stored locally in your browser (strictly necessary). The website also stores your choice of language, currency and reduced motion locally to remember these settings.

6. Retention

Retention depends on the purpose of processing and legal duties. Where no fixed period is given, the following criteria apply:

• Server and CDN logs: for as long as needed for secure operation; for a specific fault analysis or security investigation until it is completed. Thereafter, further retention is necessary only to the extent justified by specific outstanding claims or legal duties.
• Account data: deleted after confirmed account deletion.
• Device and licence activation data: to provide and verify your entitlements and handle related claims; deleted after confirmed account deletion. Excepted is the purpose-bound device-consumption record for trials under section 3.2.
• Backups serve recovery after an outage. Deletion from the active system does not simultaneously remove residual copies from existing backups; their persistence depends on the backup and replacement cycle of the service concerned.
• Purchase and invoice records are subject to the ten-year retention duty from the end of the financial year (CO Art. 958f(1) and (2)); account deletion does not shorten this, the account link is removed, the invoice itself still contains the details required for invoicing and bookkeeping (Art. 17(3)(b) in conjunction with Art. 6(1)(c) GDPR) and is not visible in the Opura account.
• Support messages and attachments: to handle and follow up on your enquiry and, where necessary, defend or enforce related claims. The relevant criteria are completion of the enquiry, outstanding follow-up questions and applicable limitation or retention duties. This covers the support inbox and forwarded email copies.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Requests to: support@opura.app. You may also lodge a complaint with a supervisory authority (CH: FDPIC; EU: your national data-protection authority).

8. Changes

We update this policy when services or the law change. The version published here applies.