English

Privacy Policy

Effective Nov 12, 2026.

Space keeps your files on your Mac. This page lists what Space and this site send over the network, what our server keeps and for how long, and who handles it.

Who we are

Space and this site are run by Jie Zhang, trading as Chord Ink. We decide how the data on this page is used, which makes us its controller under data protection law. You can reach us at support@chord.ink.

Your key and your Mac

To activate a key, Space sends our server the key and a device ID. The device ID is a hash of your Mac’s hardware ID: it names your Mac without revealing the hardware ID, so if you reinstall macOS on the same Mac and enter your key again, it takes the same place as before. In return the server gives Space a signed token, which holds the order, the key’s number, the device ID, an activation ID and dates. To check the key later, or to deactivate it, Space sends only that token. Space sends no name, account or cookies with these requests.

Space checks the key with our server when you activate it, and then at least every 14 days. If 14 days pass without a successful check, Space stops opening files and answering the space bar, and plugins and languages can’t be installed or updated, until it can check again. Your key stays saved, and Space still installs its own updates.

For each activated key, the server keeps the device ID, the activation ID, when the key was activated and when it was last checked. Deactivating the key, or support freeing it, removes that record. The server also keeps:

  • the device ID of each Mac a key was deactivated on or freed from, with the time, so that Mac’s old token stops working;
  • a keyed hash of the device ID of every Mac that ever used a key from your order, to apply the refund policy.

Updates and plugins

Space checks for updates with Sparkle, and for plugins in its catalog, at dl.chord.ink. Sparkle’s system profile is off, so the update check sends no profile of your Mac. Like any web server, dl.chord.ink sees your IP address when Space connects. Space downloads a plugin only when you ask for it.

No tracking

Space has no analytics, cookies, tracking or advertising identifiers. It talks only to our license server, with the key, the device ID and the token described above, and to dl.chord.ink for updates, plugins and languages.

Buying

When you press Continue in the Buy panel, this site sends our server the number of keys, the email address you typed, that you selected the box agreeing to the EULA and the Refund Policy, the result of the security check, whether the page is light or dark, and the page’s language. Then the server opens your checkout with Waffo Pancake. It passes Waffo your email address, so Waffo’s page opens with it filled in, the page’s language, when Waffo’s page has it, and your order link, the page Waffo sends you to after you pay.

Before checkout, the Buy panel runs a security check. Our server picks it from the country of your IP address, which the network that carries your request tells it; it doesn’t keep the country. Usually it’s Cloudflare Turnstile, which checks that you are not a bot; our server checks its token with Cloudflare, which receives your IP address for that check. In some regions, and when Turnstile can’t load, our server instead gives your browser a one-time pass, which it sends back with your order. The pass holds no personal data and involves no other service.

Until you pay, the server keeps the order with the email address you typed and the page’s language, which your emails and links from us use. If you don’t pay, that unpaid order is deleted about a week after the checkout ends.

Waffo Pancake handles your payment as the merchant of record, under its own privacy policy. It asks for your email address and payment details, and sends you the receipt. When you pay, Waffo tells our server the email address you paid with, your billing country, Waffo’s IDs for the order and payment, and your card’s brand and last four digits. With your order, the server keeps the email address, the billing country and Waffo’s IDs, and a keyed hash of the card’s brand and last four digits, not the values themselves. We use the card hash to apply the refund policy.

Your keys are never stored. The server works them out from your order when it needs them.

To limit abuse, the server counts checkouts per email address and per IP address, using keyed hashes, and deletes each count within 3 days. It refuses a checkout for an email address that had refunds, finished or under way, on 2 or more orders in the last 12 months; you can write to support instead.

After you buy, Waffo sends you to the thank-you page. Its address is your order link: it holds your order number and a signature that opens your keys. Waffo receives this link when your checkout opens, so it can send you there. The page shows your keys and the email address on the order. It and the refund page tell your browser not to pass their address on to other sites.

If you ask this site to send your order link again, it sends our server the email address you typed, the result of the security check and the page’s language. The server runs the same check as for a checkout, finds your paid orders by a keyed hash of the address, and emails their links to the address on each order, in that language. It doesn’t keep the address you typed. Until the email is sent, the request waits in our server’s queue with the keyed hash and the language. The keyed hash is kept in the server’s counts for up to 3 days. If the email can’t be sent after every retry, the hash is also kept with that failed email for up to 8 days.

Refunds

To ask for a refund, the refund page sends our server a key from your order, or the order number and signature from your order link, and your note if you write one. The server uses the key or the link only to find your order, and never stores keys or signatures.

Each refund, and each request for one, keeps a record with your order: its status, how many keys it covers, the amount, the dates, and Waffo’s IDs for it. These records stay with the order, for our accounts. How long we keep it says what is cleared, and when.

To apply the refund policy, a refund record also holds keyed hashes of your email address, of the device IDs that used the order, and of your card’s brand and last four digits. We use them to check a new request against refunds from the last 12 months, and to refuse a checkout as described above. They are cleared from the record 12 months after the request.

If you add a note and your request is approved at once, the note’s first 200 characters go to Waffo as the reason for the refund. The record keeps them for 12 months, or until Waffo has finished the refund, if that takes longer.

If your request needs review, we email support your email address, your note, your billing country, the order with its language and its payment, and any matching refunds. The request holds a copy of that email until it is sent, usually within seconds and at most 31 days. Once sent, it stays in our support mailbox.

Emails

Resend sends the emails our server writes: your keys, your order links, refund confirmations, a note if a refund we approved can’t go through or is taking longer, and the emails to support described here. It doesn’t track opens or clicks.

Our support mailbox is hosted by our email provider, and support’s replies to you come from it. It receives:

  • what you write to us;
  • the review emails above;
  • alerts about orders and refunds that need a look, with order numbers, amounts, the IDs of payments, refunds, requests, tickets and events, and Waffo’s messages about them;
  • a daily report. It counts what happened that day, and names the email address on each order refunded that day, of anyone who paid for 3 or more orders that day, and on each order from that day whose charge Waffo hasn’t confirmed yet.

Payment and refund events

Waffo tells our server about each payment and refund in an event, which can include your email address, billing country, your card’s brand and last four digits, and the reason given for a refund. The server keeps an event’s contents only while it processes it. An event that can’t be processed yet, such as a refund that arrives before its payment, is kept without the refund’s reason until the server can process it or support resolves it.

IP addresses, logs and statistics

Our own server and code never store your IP address. To limit abuse, our server counts some requests per IP address (for IPv6, per network block), such as checkouts, activations and refund requests, using a keyed hash, and deletes each count within 3 days.

Our server and dl.chord.ink keep logs of errors and events, and Cloudflare deletes them after 7 days at most. These logs hold IDs, keyed hashes, counts and error codes, never email addresses, keys, tokens or signatures, and Cloudflare’s per-request logs for them are off.

The networks that carry this site, our server and downloads see your IP address and the address you ask for, and keep some of it under their own terms:

  • Cloudflare keeps traffic and security statistics for 31 days. They are based on a sample of requests and can include IP addresses and the pages asked for.
  • A second content delivery network, which serves visitors in some regions, keeps traffic and security statistics for as long as its plan sets, up to 6 months. Its access logs, which would hold your IP address and the full address you asked for, are off.
  • Netlify, which only redirects chord.ink to www.chord.ink, keeps access logs with IP addresses and the addresses asked for. We can’t turn them off.

The server keeps daily statistics, such as how many checkouts there were. They hold counts only, and are deleted after 400 days.

This website

This site sets no cookies and loads no analytics. It remembers whether you chose the light or dark look in your browser’s own storage. It sends that choice only at checkout, as described under Buying, so Waffo’s page opens in the same look. It is hosted on Cloudflare, as described above. The only third-party script is Cloudflare Turnstile, which checks that you are not a bot. It loads only on the Buy panel and on the pages that send your order link again, and only when the page uses it.

Since this site doesn’t track you, it works the same whether or not your browser sends a Do Not Track signal.

Decisions our server makes on its own

Our server makes two kinds of decision without a person:

  • It refuses a checkout for an email address that had refunds, finished or under way, on 2 or more orders in the last 12 months.
  • It approves a refund request at once, or sends it to support for review, by the rules in the refund policy. It also turns down a request for an order that was already refunded or revoked, or that has no payment.

These decisions use your order, its refunds and the keyed hashes above. If you disagree with one, write to support, and a person will look at it.

Who handles your data

  • Waffo Pancake sells Space as the merchant of record: it takes your payment, collects the tax and sends your receipt. It handles your payment as a separate controller, under its own privacy policy.
  • Cloudflare hosts this site, our server, its database and its queues, serves downloads, and runs Turnstile.
  • A second content delivery network carries this site, downloads and requests to our server for visitors in some regions, and tells our server the country of your IP address.
  • Netlify only redirects chord.ink to www.chord.ink.
  • Resend sends our emails, from the United States.
  • Our email provider hosts our support mailbox.

Data that leaves the EU and the UK

Some of these providers handle your data outside the EU and the UK. These are the safeguards for each:

  • Cloudflare: its certification under the EU-U.S. Data Privacy Framework and its UK Extension, with the European Commission’s standard contractual clauses and the UK addendum in Cloudflare’s data processing addendum as a fallback.
  • The second content delivery network: the standard contractual clauses and the UK addendum in its data processing agreement. You can ask us for a copy.
  • Netlify: its certification under the EU-U.S. Data Privacy Framework and its UK Extension, with the standard contractual clauses in its data processing agreement as a fallback.
  • Resend: its certification under the EU-U.S. Data Privacy Framework and its UK Extension, and the standard contractual clauses with the UK addendum in its data processing agreement.
  • Waffo Pancake receives your data as a separate controller. Its privacy policy names the safeguards it uses when it moves data, such as the standard contractual clauses.
  • Our email provider hosts our support mailbox outside the EU and the UK. Its terms include data protection clauses for transfers out of the EU that meet EU standards. You can ask us for a copy.

You can read the other agreements at their links, or ask us for a copy.

Where your data is kept

  • Our server’s database is stored in the European Union. It holds everything this page says our server keeps, apart from the queues and logs below. Your requests reach it through the Cloudflare data center nearest you.
  • Queued work, such as payment and refund events and order-link emails, waits in Cloudflare Queues until our server has done it, usually for seconds and at most 14 days. Cloudflare doesn’t let us choose where queues keep it.
  • Our logs are kept by Cloudflare where it chooses, for 7 days at most.
  • Turnstile checks are handled by Cloudflare, with no fixed region.
  • Waffo Pancake, Resend and our email provider keep what they receive under their own terms.

Why we use your data

  • To sell you Space and run your license: your order, your keys, the activation records, the emails about your order, and answering support. We need these to keep our agreement with you.
  • To prevent abuse and apply the refund policy: the counts, the security checks, the keyed hashes and the checkout check. This is our legitimate interest in keeping the service safe and fair.
  • To keep accurate accounts: the records of orders and refunds, including what stays after an order’s personal details are cleared. This is our legitimate interest in knowing what happened to each order and in answering chargebacks.

How long we keep it

  • Orders, with their activation and device records: as long as the order’s keys can be used.
  • A refunded or revoked order: 12 months after the refund or the revocation, we clear its personal details: the email address, the billing country, the card hash, and the activation and device records with your Macs’ device IDs. The order number, its language, amounts, dates and Waffo’s IDs stay, for our accounts and for chargebacks.
  • Unpaid orders: about a week after the checkout ends.
  • Counts per email address or IP address: up to 3 days.
  • A failed order-link email’s hash: up to 8 days.
  • Refund records: their status, number of keys, amount, dates and Waffo’s IDs stay with the order. Their hashes are cleared 12 months after the request, and their note then too, or once Waffo has finished the refund, if that takes longer.
  • A review email’s copy on our server: until it is sent, at most 31 days.
  • Payment and refund events: until processed, or until support resolves them.
  • Our logs: 7 days at most.
  • Deleted data in our database’s restore history: 30 days.
  • Daily statistics: 400 days.
  • Emails to and from support: 2 years.

Your rights

You can ask us for any of these:

  • Access: what data we hold about you, and how we use it.
  • Correction: fixing data that is wrong, such as the email address on your order.
  • Deletion: removing your data. Read below what this means for your keys.
  • A copy: your data in a file you can keep.
  • Restriction: pausing a use of your data while we look into a question about it.
  • Objection: stopping a use of your data. We stop unless we have a strong reason to go on, such as preventing abuse.

Your keys are tied to your order record: Space checks each key against it on our server. If you ask us to delete your data, we clear your order’s personal details at once, as listed above for a refunded order, and that ends every key in the order: the keys stop working at Space’s next online check, and your order link stops working. The order number, its language, amounts, dates and Waffo’s IDs stay, for our accounts and for chargebacks. Waffo Pancake keeps its own records of your payment under its own privacy policy, so ask Waffo about those.

To ask, write to support@chord.ink. So we know the data is yours, we may ask for a key from your order or your order link. We answer within 30 days.

If you think we handle your data wrongly, you can also complain to a data protection authority, such as the one in the country where you live.

We don’t sell your data

We don’t sell your personal data, and we don’t share it for advertising. It goes only to the providers above, to run Space and this site, and to others only when the law requires it.

Keeping your data safe

This site, Space and our server talk over encrypted connections (HTTPS). Our server keeps a keyed hash of your card’s brand and last four digits instead of the digits, never stores keys or the signatures in order links, and counts requests by keyed hashes, not by email or IP address. Only we can reach the server’s database and the support mailbox. If a breach puts your personal data at risk, we tell the data protection authority and you, as the law requires.

Children

Space and this site are not meant for children under 16, and we don’t knowingly collect their data. If you think we have, write to us and we will delete it.

Changes to this policy

We may update this policy. Changes that reduce your rights are posted on this page 30 days before they take effect. Other changes take effect when they are posted. The effective date at the top of this page shows when the current policy took effect.

Questions

support@chord.ink