Privacy Policy

Last updated: 2026-10-11 · Datenschutzerklärung gemäß Art. 13 DSGVO

Summary: we do not store your files. Attachments are downloaded directly from Airtable's servers to your browser - they never touch our servers. We store a randomly generated pseudonymous ID and your monthly download count to enforce the free-tier limit, plus your Pro license key and status if you upgrade. For Pro customers this ID can be linked to the buyer through the license key and Polar, our payment provider. We also count anonymous usage statistics, such as how often an upgrade hint is shown, with your browser family and extension version; in Firefox you can switch this off. Our server deletes the record of an installation 13 months after the extension last contacted it; for Pro customers it is kept while the subscription is active. The website uses Cloudflare Web Analytics (cookieless, no fingerprinting, no cross-site tracking) for aggregate page-view stats; no advertising cookies, no third-party tracking scripts.

1. Who is the data controller

Alexander Kagoshima
Email: info@trello-attachment-downloader.com

The full postal address of the data controller is published in our Impressum as required under § 5 DDG.

We are responsible for the processing of personal data in connection with this website (airtable-attachment-downloader.pages.dev) and the Airtable Attachment Downloader browser extension.

2. Data processed when you visit airtable-attachment-downloader.pages.dev

This website is hosted on Cloudflare Pages. When you load a page, Cloudflare automatically processes certain connection metadata to deliver the site and protect against abuse:

IP address of your device
User-agent string (browser and operating system)
Referrer URL, if any
Requested URL and HTTP status
Timestamp of the request

Legal basis: Art. 6(1)(f) GDPR - legitimate interest in operating and securing the website.
Retention: handled by Cloudflare under their own policies (typically rolling logs of a few days). See cloudflare.com/privacypolicy.

In addition, this website uses Cloudflare Web Analytics to measure aggregate page views and referrers. Cloudflare Web Analytics is cookieless, does not use browser fingerprinting, does not track you across other websites, and does not build a user profile. The beacon (static.cloudflareinsights.com) is injected automatically by Cloudflare when serving the page; no personal data such as your IP address is retained for analytics purposes (Cloudflare drops it after deriving the aggregate counters).
Legal basis: Art. 6(1)(f) GDPR - legitimate interest in understanding aggregate website usage. Because Web Analytics neither stores nor reads information on your device, no consent under § 25 TTDSG is required.
See cloudflare.com/web-analytics for details.

In addition, the website sends a small technical signal to our own server when a page is viewed, when the pricing section or the checkout page is opened, and when a checkout or install button is clicked. This signal contains the page path, the campaign tags (utm_source, utm_medium, utm_campaign) of the link you followed, the hostname of the site that linked to us (for example www.reddit.com, not the full address) and, for a button, which plan or store it leads to. Our server adds your browser family (Chrome, Edge, Firefox or other), derived from the User-Agent header; the User-Agent itself and your IP address are not stored. The signal carries no cookies, no fingerprint and no identifier of any kind, and nothing is stored on or read from your device. We use it only as aggregate counts, for example how many visitors a forum post brought us.
Legal basis: Art. 6(1)(f) GDPR - legitimate interest in understanding which pages and links are used. Because no information is stored on or read from your device, no consent under § 25 TTDSG is required.
Retention: the individual signals are kept for about 90 days; daily totals derived from them contain nothing about individual visitors and are kept without a fixed limit.

Apart from this, no cookies and no third-party tracking scripts are served from this website. Fonts are not loaded from any third party.

3. Data processed when you use the extension

3.1 Pseudonymous user ID and download count

To enforce the free-tier limit of ten downloads per calendar month, on first use the extension asks our backend for a random UUID and stores it via browser.storage.sync. This means the UUID may be synchronized across your browser installations by your browser's sync service (for example Chrome Sync or Firefox Sync), under that service's own terms and privacy policy. We never receive your browser account details - only the opaque UUID once it is sent to us. When you open the download panel or the extension popup, and on each download, the extension sends to our Cloudflare Worker backend:

your UUID (a random identifier, not derived from your Airtable account)
on a download, an increment request and, unless you switched off data collection in Firefox (see 3.4), the extension version

Every request to our backend also carries your IP address and your browser's User-Agent header. Cloudflare processes both to deliver the request. Our backend derives your browser family from the User-Agent (see 3.4) and does not store the IP address or the User-Agent.

The backend stores a counter in Cloudflare KV keyed by this UUID, together with the calendar month it counts (e.g. 2026-04) and the date and time the UUID was first registered.

The UUID is a pseudonymous identifier: it contains no name, email address or account data. For free users we store nothing else that links it to a person. For Pro customers a link to the person is possible, because the payment must be assigned to the extension: our backend stores the license key next to the UUID, and Polar.sh, which knows the buyer's email address and billing data, receives the UUID as the label of the license key's activation (see 3.2).

The extension additionally stores a small local flag via browser.storage.sync remembering that it already asked you for a store review, so it only asks once; this flag is never sent to us.

Legal basis: Art. 6(1)(b) GDPR - necessary to enforce the terms of the free tier.
Retention: the download count starts again at zero each calendar month. The record under your UUID (the UUID, the counter, browser family, extension version and timestamps) is deleted automatically 13 months after the extension last contacted our server. For Pro customers see 3.2.

3.2 License key and subscription status (Pro users only)

If you upgrade to Pro, Polar.sh issues a license key. When you enter the key in the extension, we send it to our backend, which activates it with Polar.sh's API and stores the key, the result (isPro: true) and the month the key was last validated in Cloudflare KV under your UUID. The activation request sends Polar.sh the key and your UUID, which Polar.sh records as the label of the activation; the monthly re-validation sends only the key. We do not receive or store payment card details - Polar.sh handles the full payment flow.

Legal basis: Art. 6(1)(b) GDPR - necessary to provide Pro features.
Retention: the record under your UUID, including the license key, is kept while your subscription is active. The license key is re-validated with Polar.sh monthly; once your subscription has ended, the next re-validation removes the key and the Pro status, and the record is deleted 13 months after the extension last contacted our server. Purchase and invoice records are kept by Polar.sh as Merchant of Record under its legal retention duties; our server keeps no invoices.

3.3 Attachment files

We do not process or store your files. When you trigger a download, attachments are fetched directly from Airtable's servers to your browser. Our servers never see the file contents.

3.4 Product usage statistics

To understand which features are used and to improve the extension, we also count coarse product events: that you registered, opened the panel or popup, downloaded (and whether the free limit allowed it), activated a license key, or that an upgrade hint or the review request was shown or clicked. Each event includes your browser family (Chrome, Edge, Firefox or other, derived from the User-Agent header, which itself is not stored) and the extension version, but no page contents, no Airtable data and no information about who you are. Events are not linked to your UUID.

In addition, the record under your UUID (see 3.1) holds your browser family, the extension version and the month you were last active, so that we can count active users per browser and version.

Once a day we also compute totals across all records: how many IDs were registered, how many downloaded this month and how often, and how many are Pro. These totals contain nothing about individual users.

Legal basis: Art. 6(1)(f) GDPR - legitimate interest in improving the product. You can object at any time (see section 5).
Retention: individual events are kept for about 90 days; daily totals derived from them contain nothing about individual users and are kept without a fixed limit. The fields on your record are kept as long as the record (see 3.1).
Switching it off in Firefox: Firefox lets you turn off the extension's "technical and interaction data" collection, when installing or later in the Add-ons Manager (about:addons). With it off, the extension sends no product events and no version, and our backend writes no events for your requests and removes the browser family, version and last-active month from your record the next time the extension checks your usage or counts a download. The free-tier counter and the license check work the same either way, and your record still counts towards the daily totals above.

4. Recipients and third-party processors

We use the following service providers. Data transfers to US-based providers are covered by the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) or by Standard Contractual Clauses where applicable.

Cloudflare, Inc. (USA, DPF-certified) - hosts this website, the backend Worker, the KV store and the usage statistics (Workers Analytics Engine), and processes the IP address and User-Agent of every request to the website and the backend. Privacy policy.
Polar Software Inc. (USA) - payment processor and Merchant of Record for Pro subscriptions. Polar.sh knows the buyer's email address and billing data and receives the license key and the UUID of each activation (see 3.2). Privacy policy.
Google LLC (Chrome Web Store) (USA, DPF-certified) - distributes the extension. We have no direct data exchange with Google beyond what the Chrome Web Store itself collects on install. If you use Chrome Sync, Google synchronizes the UUID (see 3.1).
Mozilla Corporation (Firefox Add-ons, Firefox Sync) (USA) - distributes the extension for Firefox. If you use Firefox Sync, Mozilla synchronizes the UUID (see 3.1). Privacy policy.

5. Your rights

Under the GDPR you have the right to:

request a copy of the personal data we hold about you (Art. 15)
request correction of inaccurate data (Art. 16)
request deletion of your data (Art. 17)
request restriction of processing (Art. 18)
receive your data in a portable format (Art. 20)
object to processing based on legitimate interest (Art. 21)
lodge a complaint with a data protection supervisory authority

To exercise any of these rights, email info@trello-attachment-downloader.com. You can also uninstall the extension, which erases the locally stored UUID (unless your browser's sync service keeps a copy); the record on our backend can then no longer be linked to your browser. For Pro customers the license key and Polar's activation label still link it to the buyer. The record is deleted as described in 3.1 and 3.2.

6. Supervisory authority

You have the right to lodge a complaint with the data protection supervisory authority of your country of residence. For users in Germany, this is the data protection authority of the federal state in which the controller is established:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

7. Changes to this policy

We may update this policy to reflect changes in the service or legal requirements. The "Last updated" date above will reflect any revision. Material changes will be announced in-extension or by email to Pro subscribers.