Privacy policy

Last updated: [OWNER: the date this policy takes effect]

Who we are

Malbec is made by [OWNER: legal name of the person or company that makes Malbec] (“we”, “us”). We decide what Malbec does with data, so we are the data controller under the GDPR. Our full trader details are on the company page.

Contact for anything in this policy: support@malbec.app, or by post to [OWNER: geographic address].

The short version

• No account, no analytics, no ads, no tracking. The app sends us only what your license and trial need, listed below.
• The app talks to a short, fixed list of servers. Each one is in the table below, with what it receives.
• To activate your license and keep the free trial to one per Mac, Malbec sends a one-way code made from your Mac’s hardware ID. It can’t be turned back into the ID, and we use it only for your license and trial.
• Diagnostics and game reports leave your Mac only when you send them to us yourself.
• When you buy Malbec, Stripe sells it to you as the merchant of record, through its checkout, Link, and handles the payment. We never see your card.
• Our license server keeps licenses, orders, activated Macs and trials in the EU, for the periods in What our license server keeps.

What stays on your Mac

Malbec keeps its own files in ~/Library/Application Support/Malbec: your settings, your library, how long you played each game, launch timelines (a step-by-step record of each Play, used for troubleshooting), logs, game artwork it downloaded, and the Windows environments your stores and games run in. Store sign-ins (Steam, Battle.net) are kept by those stores inside their Windows environment, in that folder.

Your license is kept in your Mac’s Keychain: the license key, and the activation our license server signed for this Mac. The activation names your license, this Mac’s one-way code and the public key below, and the e-mail address the key was bought with, partly hidden; Settings › License shows it that way. A copy of the signed activation, never the key itself, is kept in Malbec’s folder, so a damaged Keychain doesn’t cost you your license.

When Malbec first activates a license or starts the free trial on a Mac, it makes a private key for that Mac. It is kept in the Mac’s Secure Enclave where the Mac allows it, and in a Keychain item that is never synced to iCloud and never restored or migrated to another Mac. Only its public key leaves the Mac.

The trial’s times (when you started it, and the latest time Malbec has seen, so that setting the clock back doesn’t extend it) and the trial’s registration from our license server are kept in the Keychain, with a copy in Malbec’s folder.

None of this is sent to us or to anyone else, except as described below.

What the app connects to

Every request below carries your IP address and a standard User-Agent header that names Malbec and its version, and usually your Mac’s system version, as most Mac apps’ requests do. Requests to our license server carry what the table says. Nothing else in any request identifies you: no account and no serial number.

To activate your license and keep the free trial to one per Mac, Malbec sends a one-way code made from your Mac’s hardware ID. It can’t be turned back into the ID, and we use it only for your license and trial. (The code is a SHA-256 hash of the Mac’s hardware UUID, IOPlatformUUID; our server stores it only as a second keyed hash.)

Test builds that we give our own testers can use our test license server, license-staging.malbec.app, instead. Released versions never contact it.

You can turn some of these off:

• Artwork: Settings › Games › Show game artwork from Steam. When it’s off, Malbec shows its own text covers and requests no artwork.
• Update checks: Settings › Check for updates automatically. When it’s off, Malbec checks only when you choose Check for Updates.
• License checks, and the list of keys and Macs that no longer work, happen only when Malbec is licensed and online. Starting the free trial registers this Mac once. Once activated, your license keeps working offline with no time limit; Malbec checks again the next time it is online.

Links that open in your browser or mail app

Some buttons open a page in your web browser or a message in your mail app. Malbec itself doesn’t send anything when you press them; your browser or mail app does, under its own settings.

• Our website, malbec.app: the help page behind every “?” in Malbec, Support, the games list, these legal pages, and the source code for Malbec’s engine. Buy Malbec opens our checkout page on malbec.app, which sends you on to Stripe’s checkout (see Buying Malbec). “Lost your key?” opens our lost-key page (see Our website).
• GitHub, github.com: the Licenses and Source Code window links to the projects Malbec’s engine is built from, including Recall’s project page.
• Report a Game and Contact Support open a new e-mail to support@malbec.app in your mail app, filled in with the game’s name, its label in Malbec, the engine version, your macOS version and your Mac’s model. You can read and change it, and nothing is sent until you press Send.
• How did it run answers are saved in Malbec’s folder on your Mac. Send by Email and Open on GitHub open your mail app or browser, filled in with your answer, the game, your Mac’s chip and memory, macOS, the engine and the settings you changed. A GitHub issue is public. Reports we receive can appear on malbec.app/community without your name: the game, your answer, your Mac’s chip and memory, macOS, the engine and Malbec versions, and your note, shortened when it’s long.

Stores and games you run in Malbec

Steam, Battle.net and your games run inside Malbec’s Windows environments, and they connect to their own servers under their own privacy policies (Valve’s, Blizzard’s and each game publisher’s). Malbec doesn’t read their traffic or what you type into them. You sign in on the store’s own window; Malbec never sees or stores your store password.

Windows programs you run in Malbec can read and write files your Mac user account can reach, the same as in other Windows compatibility apps on the Mac. Run only programs you trust.

If a game uses voice chat, macOS asks you once whether it may use the microphone. Malbec doesn’t record or send audio itself; the game sends your voice to its own servers. Some games and stores also look up your Mac’s address on your local network when they start; macOS may ask you about that too.

Diagnostics you choose to send

Settings › Support › Export Diagnostics saves a zip file wherever you choose. It contains Malbec’s logs, your Malbec settings, its graphics settings file, its record of store sessions, recent launch timelines, recent crash reports from Malbec and its engine, and a summary of your Mac: model, chip, memory, macOS version, displays, free space, whether Rosetta is installed, and which stores and catalog games are installed or running.

Before the zip is written, Malbec masks your home folder’s path and your user name, and removes e-mail addresses, Steam account IDs, IP addresses, license keys, the license server’s signed messages, download links and anything that looks like a password or token. Nothing from your Steam or Battle.net account and none of your game files go into it.

The zip leaves your Mac only if you attach it to an e-mail or post it yourself. Please send it by e-mail, not in public channels.

Buying Malbec

Malbec is sold through Stripe Managed Payments. Stripe ([OWNER: the Stripe legal entity that is merchant of record for buyers, from Stripe’s Managed Payments buyer terms]) sells Malbec to you as the merchant of record. Its checkout, Link, takes the payment, charges and pays sales tax or VAT, and sends your receipt; checkout shows “Sold through Link”, and your card statement says LINK.COM* MALBEC. Stripe and Link collect what they need for the sale, such as your e-mail address, billing details and payment details, and are independent controllers for that data under their own privacy policies: [OWNER: links to Link’s and Stripe’s current privacy policies].

From Stripe we receive: your e-mail address, the order and payment ids, the receipt number, the amount and currency, and whether the payment was refunded or disputed. We don’t receive your card details. We use the e-mail address to send your license key, to find your license when you ask for help, and for the messages about your license described in E-mail and support. We keep nothing else about you from the purchase.

If you ask Link to delete your data, Stripe tells us. We then ask you whether you want the data we hold deleted too (see Your rights).

What our license server keeps, and for how long

Our license server runs on Cloudflare Workers. It keeps licenses, orders, activated Macs and trials in a Cloudflare D1 database created with the EU jurisdiction, so that data is stored in the EU. The Cloudflare servers that receive a request can be anywhere in the world; they pass it to the database in the EU.

E-mail addresses are kept with your license, and with each link to manage your Macs, which works for 30 minutes and is deleted within a day after that. Every other lookup by e-mail address or IP address uses a keyed one-way code, and the one-way code from your Mac is stored only as a second keyed code, so a copy of the database can’t be matched against known Mac IDs. To stop abuse, the server counts requests per IP address and per e-mail address, from a minute to a day, under those codes. To keep a key that was shared publicly from feeding updates to many people, it also notes from which networks each license and trial is used (a keyed code of the network, never your full IP address, and the network operator’s number); this can pause update downloads for that key, never playing.

Backups: Cloudflare keeps a 30-day point-in-time history of the database, and we keep an encrypted copy made once a month for [OWNER: how long the monthly copies are kept].

E-mail and support

E-mails about your license. Your key, the key again when you use “Lost your key?”, links to manage your Macs, notices about your license (a refund, a key we have to turn off, a key replaced at your request) and, for testers, beta keys come from license@malbec.app. Postmark sends them for us, as our processor. Open and click tracking are off, so links in our e-mails go straight to their address and Postmark doesn’t record that you opened or clicked them. Postmark keeps a copy of each message, which contains your key, for [OWNER: 7 or 45] days, then deletes it. Replies go to support@malbec.app.

Support. support@malbec.app is an iCloud+ mailbox: Apple handles our support mail, as our processor. When you write to us we keep the conversation, and any diagnostics you attach, for [OWNER: retention period; suggested 24 months] after the last message, so we can help with the same problem later. Then we delete it.

If you join our Discord server, Discord’s own privacy policy applies to what you post there. Please don’t post diagnostics in public channels.

Our website

The website malbec.app loads nothing from other companies’ servers. It is hosted by Cloudflare, which records standard access logs (IP address, the page requested, the browser’s user agent and the time) for security and operation. [OWNER: say “We don’t use website analytics.” or “We use Cloudflare Web Analytics, which counts visits without cookies.” (brand §8 decision 13)] Downloads from downloads.malbec.app are served by Cloudflare in the same way.

The website sets one cookie of its own, and only when you press Buy: malbec_order, a random order number. It lets the page you see after paying show your key to the browser that bought it, and to no other. Only our checkout addresses on malbec.app (under /api/) receive it, the page’s scripts can’t read it, and it expires after 48 hours.

Three pages talk to our license server through malbec.app:

• Buy creates a checkout at Stripe for a new order number and sends you to it.
• The page after paying asks for your key with the reference Stripe gave the checkout. It shows the key for 24 hours, only in the browser that bought it; anyone else with the address sees only where the key was e-mailed, with the address partly hidden.
• Lost your key? sends the e-mail address you type. We use it only to look up your licenses and e-mail them to that address, and the page shows the same answer for every address, so it can’t be used to find out who bought Malbec.

Stripe’s checkout pages set their own cookies under Stripe’s policy.

Why we may process data (legal basis)

• To sell you Malbec and keep your license working (activation, license checks, deactivation, links to manage your Macs, download links, the e-mails with your key): performing our contract with you (GDPR Article 6(1)(b)).
• To register the free trial on our server, so there is one free trial per Mac: our legitimate interest in offering a free trial that can’t be restarted again and again (Article 6(1)(f)). We weighed it against your interests: the code can’t be turned back into your Mac’s ID, it is used only for the trial, stored as a keyed code and deleted 12 months after the trial ended, and the trial needs no account. You can object at any time by writing to us with the support code from Settings › License; we then delete your trial’s registration. A trial started again later is registered again.
• To protect the service and our paying customers (rate limits, the network note for shared keys, our server’s records): our legitimate interest in running it safely (Article 6(1)(f)).
• To answer support requests and keep diagnostics you sent: performing our contract, and our legitimate interest in fixing problems (Article 6(1)(b) and (f)).
• Website and download logs: our legitimate interest in running the service safely (Article 6(1)(f)).
• Keeping order records: our legal obligations for bookkeeping (Article 6(1)(c)).
• Beta testers: the address you gave us, to send and keep your beta license: performing our agreement with you (Article 6(1)(b)).

Who else receives data

• Valve, Blizzard Entertainment, and Stripe with Link receive what is described above, as independent controllers.
• Cloudflare hosts our website, downloads and license server, Postmark sends our e-mails, and Apple (iCloud+) handles our support mailbox, as our processors.
• We don’t sell data, and we don’t share it with advertisers.

Licenses, orders, activated Macs and trials are stored in the EU. Some of these companies are in the United States. [OWNER: transfer safeguards, for example the EU-US Data Privacy Framework or standard contractual clauses, per provider.]

Your rights

You can ask us for a copy of the data we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Write to support@malbec.app. We answer within one month.

If you ask us to delete your data, we blank your e-mail address and keep your license working on the Macs that use it. Before we do, we tell you that we then can’t send your key again or e-mail you a link to manage your Macs.

You can also complain to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk, or to the authority in your own country.

Most data about you is on your own Mac, where you control it. To remove Malbec and its data, see Uninstall Malbec.

Children

Malbec isn’t directed at children under [OWNER: age, for example 13 or 16].

Changes to this policy

If Malbec starts sending anything new, we update this page before the release that does it, and the release notes say so. The date at the top shows the last change.