Privacy Policy

Last updated: 2026-10-11 · Datenschutzerklärung gemäß Art. 13 DSGVO

1. Who is the data controller

The full postal address of the data controller is published in our Impressum as required under § 5 DDG.

We are responsible for the processing of personal data in connection with this website (trello-attachment-downloader.com) and the Trello Attachment Downloader browser extension.

2. Data processed when you visit trello-attachment-downloader.com

This website is hosted on Cloudflare Pages. When you load a page, Cloudflare automatically processes certain connection metadata to deliver the site and protect against abuse:

• IP address of your device
• User-agent string (browser and operating system)
• Referrer URL, if any
• Requested URL and HTTP status
• Timestamp of the request

Legal basis: Art. 6(1)(f) GDPR - legitimate interest in operating and securing the website.
Retention: handled by Cloudflare under their own policies (typically rolling logs of a few days). See cloudflare.com/privacypolicy.

In addition, this website uses Cloudflare Web Analytics to measure aggregate page views and referrers. Cloudflare Web Analytics is cookieless, does not use browser fingerprinting, does not track you across other websites, and does not build a user profile. The beacon (static.cloudflareinsights.com) is injected automatically by Cloudflare when serving the page; no personal data such as your IP address is retained for analytics purposes (Cloudflare drops it after deriving the aggregate counters).
Legal basis: Art. 6(1)(f) GDPR - legitimate interest in understanding aggregate website usage. Because Web Analytics neither stores nor reads information on your device, no consent under § 25 TTDSG is required.
See cloudflare.com/web-analytics for details.

In addition, the website sends a small technical signal to our own server when a page is viewed or a button is clicked (for example a checkout or install button). This signal contains the page address including any campaign tags in the link you followed, but no cookies, no fingerprint and no identifier of any kind, and nothing is stored on or read from your device. We keep it only as aggregate counts, for example how many visitors a forum post brought us.
Legal basis: Art. 6(1)(f) GDPR - legitimate interest in understanding which pages and links are used. Because no information is stored on or read from your device, no consent under § 25 TTDSG is required.

Apart from this, no cookies and no third-party tracking scripts are served from this website. Fonts are not loaded from any third party.

3. Data processed when you use the extension

3.1 Pseudonymous user ID and download count

To enforce the free-tier limit of ten downloads per calendar month, the extension generates a random UUID on first use and stores it via browser.storage.sync. This means the UUID may be synchronized across your browser installations by your browser vendor's sync service (Google Chrome Sync, Microsoft Edge sync or Firefox Sync), under those services' own terms and privacy policies. We never receive your Google, Microsoft or Mozilla account details - only the opaque UUID once it is sent to us. On each download, the extension sends to our Cloudflare Worker backend:

• your UUID (a random identifier, not linked to your Trello account)
• the current calendar month (e.g. 2026-04)
• an increment request
• the extension version (e.g. 2.3.0)

The backend stores a counter in Cloudflare KV keyed by this UUID, together with your browser family (Chrome, Edge or Firefox, derived from the request), the extension version and the month you were last active. The UUID is a pseudonymous ID, not an anonymous one. For free users we hold no other data that identifies you. For Pro users the UUID can be linked to the person who bought the license (see 3.2). The extension additionally stores a small local flag via browser.storage.sync remembering that it already asked you for a store review, so it only asks once; this flag is never sent to us.

Legal basis: Art. 6(1)(b) GDPR - necessary to enforce the terms of the free tier.
Retention: the download count starts again at zero each calendar month. We delete the record (UUID, download count, browser family, extension version and timestamps) automatically 13 months after the extension last contacted our server. For Pro users see 3.2.

3.2 License key and subscription status (Pro users only)

If you upgrade to Pro, Polar.sh issues a license key. When you enter the key in the extension, we send it to our backend, which validates it against Polar.sh's API and caches the result (isPro: true) in Cloudflare KV. We do not receive or store payment card details - Polar.sh handles the full payment flow.

The payment must be assigned to the extension in which you use Pro. For this, the backend stores your license key next to your UUID. When you activate the key, we send your UUID to Polar.sh, which stores it as the label of that activation. Polar.sh knows the buyer's email address and billing data. This means that for Pro users, the UUID can be linked to the person who bought the license.

Legal basis: Art. 6(1)(b) GDPR - necessary to provide Pro features.
Retention: we keep your record, including the license key, while your subscription is active. The key is re-validated with Polar.sh monthly; once your subscription has ended, the next re-validation removes the key and the Pro status. After the subscription ends, we delete the record 13 months after the extension last contacted our server. Polar.sh keeps purchase and invoice records as Merchant of Record under its own legal retention duties. Our server keeps no invoices.

3.3 Attachment files

We do not process or store your files. When you trigger a download, attachments are fetched directly from Trello's servers to your browser. Our servers never see the file contents.

3.4 Product usage statistics

To understand which features are used and to improve the extension, we also count coarse product events, for example that an upgrade hint was shown or clicked. These counts include your browser family (Chrome, Edge or Firefox) and the extension version, but no page contents, no Trello data and no information about who you are. They are stored as aggregate statistics only and are not linked to your UUID.
Legal basis: Art. 6(1)(f) GDPR - legitimate interest in improving the product.
Retention: raw event counts are kept for about 90 days; only monthly aggregate totals are kept longer.

3.5 Connection data of extension requests

Every request from the extension to our backend (registration, download count, usage check, license activation and usage statistics) reaches our Cloudflare Worker with your IP address and user-agent string, as any web request does. The Worker derives your browser family (Chrome, Edge or Firefox) from the user agent. Our code does not store your IP address or the full user-agent string. Cloudflare processes both to deliver and protect the request.
Legal basis: Art. 6(1)(b) GDPR for requests that provide the service, Art. 6(1)(f) GDPR for usage statistics.
Retention: handled by Cloudflare under their own policies. See cloudflare.com/privacypolicy.

4. Recipients and third-party processors

We use the following service providers. Data transfers to US-based providers are covered by the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) or by Standard Contractual Clauses where applicable.

• Cloudflare, Inc. (USA, DPF-certified) - hosts this website, the backend Worker, and the KV store. Processes your IP address and user-agent string on every website visit and every request from the extension to our backend. Privacy policy.
• Polar Software Inc. (USA) - payment processor and Merchant of Record for Pro subscriptions. Receives your license key and, as the label of the license activation, your install UUID. Privacy policy.
• Google LLC (Chrome Web Store, Chrome Sync) (USA, DPF-certified) - distributes the extension for Chrome. If you use Chrome Sync, it synchronizes the data the extension keeps in browser.storage.sync (your UUID and the review flag). We have no direct data exchange with Google beyond what the Chrome Web Store itself collects on install.
• Microsoft Corporation (Edge Add-ons, Edge sync) (USA, DPF-certified) - distributes the extension for Microsoft Edge. If you use Edge sync, it synchronizes the data the extension keeps in browser.storage.sync. We have no direct data exchange with Microsoft beyond what the Edge Add-ons store itself collects on install.
• Mozilla Corporation (Firefox Add-ons, Firefox Sync) (USA) - distributes the extension for Firefox. If you use Firefox Sync, it synchronizes the data the extension keeps in browser.storage.sync. We have no direct data exchange with Mozilla beyond what Firefox Add-ons itself collects on install. Privacy policy.

5. Your rights

Under the GDPR you have the right to:

• request a copy of the personal data we hold about you (Art. 15)
• request correction of inaccurate data (Art. 16)
• request deletion of your data (Art. 17)
• request restriction of processing (Art. 18)
• receive your data in a portable format (Art. 20)
• object to processing based on legitimate interest (Art. 21)
• lodge a complaint with a data protection supervisory authority

To exercise any of these rights, email support@trello-attachment-downloader.com. Uninstalling the extension erases the UUID stored in your browser (your browser's sync service may keep a copy). It does not delete the record on our server, which is deleted as described in 3.1 and 3.2, or earlier on request.

6. Supervisory authority

You have the right to lodge a complaint with the data protection supervisory authority of your country of residence. For users in Germany, this is the data protection authority of the federal state in which the controller is established:

7. Changes to this policy

We may update this policy to reflect changes in the service or legal requirements. The "Last updated" date above will reflect any revision. Material changes will be announced in-extension or by email to Pro subscribers.