Privacy Policy

Last updated: 4 July 2026 · Applies to the Hutchlet app, this website, and e-mail correspondence.

1. Data controller

The controller of personal data within the meaning of Regulation (EU) 2016/679 (GDPR) is:

Actuna Sp. z o.o.
ul. Mściwoja II 28A, 83-300 Kartuzy, Poland
KRS 0000522912 · NIP 5892014912 · REGON 222160269

Contact in all matters concerning personal data: rodo@actuna.pl. A Data Protection Officer has not been appointed; the contact point is the management board via the address above.

2. Scope of this policy

This policy covers three separate contexts, described in turn below:

the Hutchlet app — installed and running on your Mac;
this website (hutchlet.actuna.com);
e-mail correspondence with us.

3. The Hutchlet app — no data reaches Actuna

Hutchlet processes everything locally, on your Mac. The app has no servers, no user accounts and no sign-in, contains no analytics, telemetry, advertising or tracking components, and the Mac App Store build ships without any networking entitlement, so it cannot make network connections at all. Clipboard history, snippets and secrets are stored only on your device; secrets are additionally encrypted (AES-256-GCM) with a key protected by the Secure Enclave / Keychain and unlocked with Touch ID.

Actuna does not receive, and has no access to, any data processed by the app. With respect to the contents of your clipboard, Actuna is not a data controller — this data never leaves your device. The app is not directed at children and collects no personal data from anyone.

If you purchase Hutchlet in the Mac App Store, or opt in to sharing diagnostics and crash reports with Apple in macOS settings, that data is processed by Apple (Apple Distribution International Ltd. / Apple Inc.) as an independent data controller, under Apple's privacy policy. Actuna does not receive that data.

A technical, app-focused summary of the above (with implementation details) is maintained in the source repository as PRIVACY.md; the app is source-available so these statements can be independently audited.

4. This website

The website hutchlet.actuna.com is a static site. It uses no cookies, no analytics and no trackers, and it loads no third-party scripts, fonts or embeds.

The website runs on Actuna's own server located in Poland (EEA). The server automatically records server logs, including the visitor's IP address, request time, requested URL and browser identification (user agent). This data is processed by Actuna as the controller for the purpose of delivering the site and ensuring its security and stability — the legal basis is legitimate interest (Art. 6(1)(f) GDPR). Server logs are kept for 12 months and are not used to identify visitors.

The site stores up to two values in your browser's localStorage: hutchlet-theme (your light/dark theme preference) and hutchlet-lang (your chosen interface language, saved when you pick one so the site does not override your choice). Both are functional only, never leave your browser and are not transmitted to Actuna; you can remove them at any time by clearing site data in your browser.

5. E-mail correspondence

When you write to us, we process your e-mail address, the contents of your message and any data you include in it:

rodo@actuna.pl — data-subject requests and privacy matters; legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR);
security@actuna.pl — vulnerability reports (coordinated disclosure); legal basis: legitimate interest in the security of our products (Art. 6(1)(f) GDPR);
tech@actuna.pl — support, licensing and general enquiries; legal basis: performance of a contract or steps prior to entering one (Art. 6(1)(b) GDPR) or legitimate interest in handling enquiries (Art. 6(1)(f) GDPR).

Providing your data is voluntary and is not a statutory or contractual requirement; however, without an e-mail address we will not be able to reply to your message.

6. Recipients of data

The website runs on Actuna's own infrastructure, so website server logs are not disclosed to any external hosting provider. The only external recipient of personal data is our e-mail service provider (correspondence). Apple acts as an independent controller as described in section 3. We do not sell personal data and do not share it for marketing purposes.

7. Transfers outside the EEA

The website is hosted on our own server in Poland, so website server logs are not transferred outside the EEA. If our e-mail service provider processes correspondence outside the European Economic Area, such transfer takes place under safeguards provided for by the GDPR — an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework, where the provider is certified) or standard contractual clauses. Details are available on request at rodo@actuna.pl.

8. Data retention

App data — stored solely on your device and entirely under your control; deleting entries or uninstalling the app removes it. Actuna holds nothing.
Website server logs — retained on Actuna's own server for 12 months, then deleted.
Correspondence — kept for as long as needed to handle the matter and afterwards for as long as claims may be raised, no longer than the statutory limitation periods.

9. Your rights

With regard to personal data we process (website logs, correspondence), you have the right to: access your data and obtain a copy (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise these rights, write to rodo@actuna.pl. We respond within one month of receiving the request.

Right to object (Art. 21 GDPR). Where we process personal data on the basis of legitimate interest — website server logs and correspondence sent to security@actuna.pl or tech@actuna.pl — you have the right to object at any time, on grounds relating to your particular situation, by writing to rodo@actuna.pl. We will then no longer process that data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims.

10. Complaint to the supervisory authority

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland — uodo.gov.pl.

11. No automated decision-making or profiling

We do not make automated decisions producing legal effects and we do not profile users. The app's on-device classification of sensitive clipboard entries is performed with deterministic rules, locally, and its results are never visible to Actuna. Neither the app nor the website uses artificial-intelligence systems.

12. Changes to this policy

Material changes to this policy will be published on this page with an updated date at the top.