Privacy
What the current Aperveil application handles, and what remains to be confirmed before launch.
Draft policy — purchasing is not available. Seller details, support contact and final legal terms will be published before checkout opens. This draft does not replace the license notices supplied with existing downloads.
Account and security data
When you create an account, the application handles your name, email address, verification status and authentication records. Password-based login uses the authentication service; Google sign-in is optional when configured. Sessions, device authorizations and CLI tokens are used to manage access. Orders and access grants will be used for purchases when payments open.
Product analytics
The current application records public page views, shader views, studio openings and export outcomes. Events can include a random visitor ID, session ID, public page path, shader identifier, export format, outcome, browser, operating system, device type and country. The visitor ID is stored in localStorage and the session ID in sessionStorage; these are pseudonymous identifiers, not a promise of complete anonymity.
Account, sign-in, dashboard and other private paths are excluded from page analytics. Query strings are not included in the page path. Telemetry respects the browser’s Do Not Track signal and can be disabled for the deployment. A consent preference interface and the final privacy choices remain to be assessed before launch.
Why data is used
Account data supports sign-in, verification and licensed access. Export and security records support delivery, rate limiting and abuse prevention. Product events help diagnose failed exports and understand which public pages and tools are used. Request IP addresses are processed for security rate limits; the application uses hashed rate-limit identifiers. Hosting and email providers may process request or delivery information separately.
Payments and service providers
Lemon Squeezy is the planned payment provider; checkout is currently closed. Hosting, database, email and identity providers, their locations and any international data transfers must be listed after the production deployment is confirmed. No final processor list or legal basis is asserted by this draft.
Retention and your choices
Retention periods, the legal data controller and the support contact for data requests are not finalized. They will be published before launch. Where applicable, privacy rights include access, correction, deletion, restriction, objection and withdrawal of consent. Account and purchase records may need to be retained for legal or security obligations; exact periods must be stated in the final policy.