Privacy Policy

Last updated: 2026-08-16 · Datenschutzerklärung gemäß Art. 13 DSGVO

1. Who is the data controller

The full postal address of the data controller is published in our Impressum as required under § 5 DDG.

We are responsible for the processing of personal data in connection with this website (trello-attachment-downloader.com) and the Trello Attachment Downloader browser extension.

2. Data processed when you visit trello-attachment-downloader.com

This website is hosted on Cloudflare Pages. When you load a page, Cloudflare automatically processes certain connection metadata to deliver the site and protect against abuse:

• IP address of your device
• User-agent string (browser and operating system)
• Referrer URL, if any
• Requested URL and HTTP status
• Timestamp of the request

Legal basis: Art. 6(1)(f) GDPR - legitimate interest in operating and securing the website.
Retention: handled by Cloudflare under their own policies (typically rolling logs of a few days). See cloudflare.com/privacypolicy.

In addition, this website uses Cloudflare Web Analytics to measure aggregate page views and referrers. Cloudflare Web Analytics is cookieless, does not use browser fingerprinting, does not track you across other websites, and does not build a user profile. The beacon (static.cloudflareinsights.com) is injected automatically by Cloudflare when serving the page; no personal data such as your IP address is retained for analytics purposes (Cloudflare drops it after deriving the aggregate counters).
Legal basis: Art. 6(1)(f) GDPR - legitimate interest in understanding aggregate website usage. Because Web Analytics neither stores nor reads information on your device, no consent under § 25 TTDSG is required.
See cloudflare.com/web-analytics for details.

In addition, the website sends a small technical signal to our own server when a page is viewed or a button is clicked (for example a checkout or install button). This signal contains the page address including any campaign tags in the link you followed, but no cookies, no fingerprint and no identifier of any kind, and nothing is stored on or read from your device. We keep it only as aggregate counts, for example how many visitors a forum post brought us.
Legal basis: Art. 6(1)(f) GDPR - legitimate interest in understanding which pages and links are used. Because no information is stored on or read from your device, no consent under § 25 TTDSG is required.

Apart from this, no cookies and no third-party tracking scripts are served from this website. Fonts are not loaded from any third party.

3. Data processed when you use the extension

3.1 Anonymous user ID and download count

To enforce the free-tier limit of ten downloads per calendar month, the extension generates a random UUID on first use and stores it via browser.storage.sync. This means the UUID may be synchronized across your browser installations by your browser vendor's sync service (Google Chrome Sync or Firefox Sync), under those services' own terms and privacy policies. We never receive your Google or Mozilla account details - only the opaque UUID once it is sent to us. On each download, the extension sends to our Cloudflare Worker backend:

• your anonymous UUID (a random identifier - not linked to your Trello account or identity)
• the current calendar month (e.g. 2026-04)
• an increment request
• the extension version (e.g. 2.3.0)

The backend stores a counter in Cloudflare KV keyed by this UUID, together with your browser family (Chrome, Edge or Firefox, derived from the request), the extension version and the month you were last active. We cannot link the UUID back to any individual person. The extension additionally stores a small local flag via browser.storage.sync remembering that it already asked you for a store review, so it only asks once; this flag is never sent to us.

Legal basis: Art. 6(1)(b) GDPR - necessary to enforce the terms of the free tier.
Retention: counter entries are reset each calendar month. If you do not use the extension for 12 months, we may delete your data entirely.

3.2 License key and subscription status (Pro users only)

If you upgrade to Pro, Polar.sh issues a license key. When you enter the key in the extension, we send it to our backend, which validates it against Polar.sh's API and caches the result (isPro: true) in Cloudflare KV. We do not receive or store payment card details - Polar.sh handles the full payment flow.

Legal basis: Art. 6(1)(b) GDPR - necessary to provide Pro features.
Retention: license status is re-validated monthly. It is purged when your subscription ends or when you clear the extension's storage, whichever comes first.

3.3 Attachment files

We do not process or store your files. When you trigger a download, attachments are fetched directly from Trello's servers to your browser. Our servers never see the file contents.

3.4 Product usage statistics

To understand which features are used and to improve the extension, we also count coarse product events, for example that an upgrade hint was shown or clicked. These counts include your browser family (Chrome, Edge or Firefox) and the extension version, but no page contents, no Trello data and no information about who you are. They are stored as aggregate statistics only and are not linked to your anonymous ID.
Legal basis: Art. 6(1)(f) GDPR - legitimate interest in improving the product.
Retention: raw event counts are kept for about 90 days; only monthly aggregate totals are kept longer.

4. Recipients and third-party processors

We use the following service providers. Data transfers to US-based providers are covered by the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) or by Standard Contractual Clauses where applicable.

• Cloudflare, Inc. (USA, DPF-certified) - hosts this website, the backend Worker, and the KV store. Privacy policy.
• Polar Software Inc. (USA) - payment processor and Merchant of Record for Pro subscriptions. Privacy policy.
• Google LLC (Chrome Web Store) (USA, DPF-certified) - distributes the extension. We have no direct data exchange with Google beyond what the Chrome Web Store itself collects on install.

5. Your rights

Under the GDPR you have the right to:

• request a copy of the personal data we hold about you (Art. 15)
• request correction of inaccurate data (Art. 16)
• request deletion of your data (Art. 17)
• request restriction of processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• lodge a complaint with a data protection supervisory authority

To exercise any of these rights, email support@trello-attachment-downloader.com. You can also trigger deletion yourself by uninstalling the extension - this erases the locally stored UUID; the backend counter expires automatically at month-end.

6. Supervisory authority

You have the right to lodge a complaint with the data protection supervisory authority of your country of residence. For users in Germany, this is the data protection authority of the federal state in which the controller is established:

7. Changes to this policy

We may update this policy to reflect changes in the service or legal requirements. The "Last updated" date above will reflect any revision. Material changes will be announced in-extension or by email to Pro subscribers.