WinBuild Privacy Notice
Last updated: 20 October 2026. This notice applies from its publication on winbuild.dev.
1. Controller
The controller of your personal data is Claudio Dall'Ara, a private individual resident in Italy, who develops WinBuild. Contact for anything about your data: hello@winbuild.dev.
2. What WinBuild itself does not collect
WinBuild runs on your PC. It does not send your source code, keystores, passwords, environment variables or build artifacts to us. Some commands download official tools and packages directly from their publishers (for example npm packages, Gradle and Google's bundletool); those requests go to those publishers, not to us. Licence checks are not active yet (see section 5).
3. What we process today, why, and for how long
| Activity | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Visiting winbuild.dev | IP address, browser and request data, processed by Cloudflare to serve and protect the site. The site sets no cookies, uses no analytics or tracking and serves its fonts itself, so loading a page contacts no third party | Delivering and securing the site; legitimate interest (Art. 6(1)(f) GDPR) | Cloudflare's operational logs; we do not keep our own visitor logs |
| Waiting list | Email address, date and source page of sign-up, version of the consent text, date of confirmation; short-lived keyed hashes of your IP address and email address to stop abuse; after you unsubscribe, only a keyed hash of your email address, so we do not add you again by mistake. Stored on Cloudflare in a database located in the EU | Telling you about the beta and the launch; your consent (Art. 6(1)(a)) | Until you unsubscribe, or 12 months after the public launch if you have not bought or confirmed again; sign-ups not confirmed within 30 days are deleted; anti-abuse hashes after 24 hours; the hash kept after unsubscribing until the list is closed, 12 months after the public launch |
| Emails to hello@winbuild.dev | Your email address and what you write | Answering you (Art. 6(1)(b) or (f)) | 24 months after the last message |
How the waiting list works today. Our first email after you sign up asks you to confirm. For now no email is sent automatically: that first email is written by hand from our Gmail mailbox, with a personal confirmation link; until you click it we do not write again, and without confirmation your sign-up is deleted after 30 days. Every email has a link to unsubscribe. If we start sending these emails automatically through an email service, we will update this notice before doing so.
We do not sell your data, use it for advertising or make automated decisions with legal effects about you.
4. Who else processes your data
- Cloudflare, Inc. (USA), processor: hosting of the site and of the waiting list (database located in the EU), and forwarding of emails sent to hello@winbuild.dev, under the Cloudflare Customer DPA.
- Google (Gmail), where emails to hello@winbuild.dev are delivered and answered and from where waiting list confirmations are sent, under Google's privacy policy.
Cloudflare and Google are based in the United States. Transfers rely on the EU–US Data Privacy Framework, under which both are certified, or on the European Commission's standard contractual clauses.
5. When licences go on sale (not active yet)
WinBuild is a private alpha: nothing is sold and the licence server has no customers. When WinBuild Pro goes on sale we will update this notice with a new date. We plan to process:
- Purchase, through Gumroad, Inc. (USA), merchant of record: name, email, country, order details and payment data, collected by Gumroad as an independent controller under its own privacy policy. We would receive the order details, your email and name, and the licence key, to sell and deliver the licence (Art. 6(1)(b)) and keep accounting records for as long as Italian law requires (10 years, Art. 6(1)(c)).
- Licence activation: hashed licence key, Gumroad sale ID, dates and status, a hashed device identifier, a hashed activation secret, WinBuild version and short-lived keyed hashes of your IP address for rate limiting. No email, name or plain IP address would be stored on the licence server. Kept for the life of the licence plus 12 months; rate-limit records for 24 hours.
- Licence portal: a strictly necessary session cookie (30 minutes) after you sign in with your licence key.
6. Your rights
You can ask us to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format (Articles 15–21 GDPR). Where we rely on consent, for example for the waiting list, you can withdraw it at any time with the unsubscribe link in every email or by writing to us; this does not affect what we did before. Write to hello@winbuild.dev; we answer within one month.
You also have the right to lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali, or the authority where you live or work.
7. Is providing data required?
No. Joining the waiting list or writing to us is optional.
8. Security
Secrets live in Cloudflare's secret storage, never in the source code. IP addresses are never stored in plain text. Access to the dashboards is limited to the controller and protected by two-factor authentication.
9. Changes
We will publish any change on this page with a new date. If a change affects how we use data you have already given us, we will tell you by email when we have your address.