Privacy policy

This policy explains what happens to personal data when you use Abstractica, the desktop application published by Elsewares, doing business as Elsewares, LLC, of 7010 N Sheridan Road, Chicago, Illinois (“Elsewares,” “we,” “us”), and when you visit its website, abstractica.io. It forms part of the End User License Agreement.

The short version

• The Abstractica application has no accounts, no analytics, and no telemetry. It does not report what you do with it.
• Your campaigns, journals, characters, and notes never leave your computer through the Software. We have no copy of them and no way to obtain one.
• The Software sends only two things anywhere: a license check — your license key and a random identifier — only if you choose to enter a license key; and an update check, which sends nothing about you.
• The website counts visits without cookies. It uses Plausible, an analytics service that never stores your IP address, keeps nothing on your device, and cannot follow you to other sites.
• We do not sell or share personal data, and we do not use it for advertising or profiling.

The rest of this policy is the detail behind those five statements.

1. Who is responsible

Elsewares, LLC (Elsewares) is the controller of the personal data described here. Contact: [email protected], or 7010 N Sheridan Road, Chicago, Illinois.

2. What Abstractica does not do

To be explicit, the Software contains:

• no analytics or usage tracking of any kind;
• no crash or error reporting to us;
• no advertising, advertising identifiers, or third-party trackers;
• no user accounts, sign-in, or profile;
• no cloud sync, backup, or upload of your work;
• no access to your files beyond the data directory you use it with.

Except for the license checks described in Section 4 and the update check described in Section 6, the Software makes no network requests to us or to anyone else.

3. Data stored on your own device

Abstractica keeps everything locally, and this data is never transmitted:

This data is under your control. You can move it, back it up, or delete it, and uninstalling the application and deleting these directories removes it. We cannot access it, and we cannot recover it for you if it is lost.

4. License activation and validation

If — and only if — you enter a license key, the Software contacts two services to activate and periodically re-check it.

What is sent:

• the license key you entered;
• our Polar organisation identifier (a fixed value compiled into the Software, not personal data);
• an installation identifier: a random UUID generated once by your copy of the Software and stored locally. It is not derived from your hardware, your operating system, your network, or anything about you. Its only purpose is to let the license system count how many devices a key is active on; and
• the fixed text label Abstractica.

What is never sent: your name, your email address, your campaign or journal content, file names, file paths, computer name, IP-derived location, or any record of what you do in the application.

As with any internet request, the receiving services necessarily observe the IP address the request came from.

Who receives it:

• Polar Software Inc. (“Polar”) — api.polar.sh — which issues and validates license keys and enforces the device-activation limit.
• A function we operate on DigitalOcean — *.doserverless.co — which re-checks the key with Polar and issues a short-lived signed entitlement so the Software keeps working offline. This function does not log the request.

How often: once when you activate, and thereafter roughly every 30 days when a connection is available. If it cannot reach the services, the Software continues to work offline during a grace period. Deactivating a device sends one further request to release that activation.

Legal basis (UK/EU): performance of the contract between us (Article 6(1)(b) UK/EU GDPR) — we cannot supply a licensed copy without checking the license.

If you never enter a license key, none of this happens, and the only request the Software makes is the update check described in Section 6.

5. Data we receive when you buy a license

License keys are sold through Polar, which acts as merchant of record. Polar — not us — collects and processes your name, email address, billing address, tax location, and payment details. Polar is the controller for that processing; see Polar’s own privacy notice at https://polar.sh/legal/privacy-policy. We never see your payment card or bank details.

Polar notifies us of purchase events (orders, license-key grants, cancellations, refunds, and revocations) by webhook. We store the record of each such event — which typically includes your name, email address, country, the product bought, the amount, and the license key issued — in a private, access-controlled bucket on DigitalOcean Spaces.

• Why: to answer support questions (“I never received my key”), to honour refunds and revocations, and to keep the accounting and tax records we are required to keep.
• Legal basis: performance of the contract (Article 6(1)(b)), our legitimate interest in supporting and administering the product (Article 6(1)(f)), and compliance with legal obligations such as tax record-keeping (Article 6(1)(c)).
• Retention: seven years for records with a tax or accounting purpose; other webhook records are deleted after 24 months.

6. Update checks

Each time Abstractica starts, and whenever you ask it to check for updates, it requests a small version file from the public elsewares/abstractica-releases repository on GitHub to see whether a newer version exists.

What is sent: nothing about you. The request carries no license key, no installation identifier, and nothing from your campaigns. GitHub, as the host, sees the requesting IP address and ordinary request details.

If an update is available, the Software asks before downloading it from the same repository, and every download is cryptographically signature-verified before it is installed. If the check cannot connect, the Software carries on as normal.

Legal basis (UK/EU): our legitimate interest in keeping your copy secure and up to date (Article 6(1)(f)).

7. Support and correspondence

If you email us or open an issue on our public tracker, we hold what you send — your email address or GitHub username and the content of your message — for as long as needed to deal with it and to keep a record of the exchange, on the basis of our legitimate interest in providing support. Please remember that issues on a public tracker are visible to everyone; do not post your license key or anything you would not want public.

8. The Abstractica website

Hosting and delivery. The abstractica.io website runs on DigitalOcean and is delivered through Cloudflare, which sits in front of it to speed it up and protect it from abuse. Both necessarily see your IP address and ordinary request details. Our hosting provider keeps standard server access logs, including IP addresses, for 30 days for security and operations. Cloudflare may set short-lived, strictly necessary security cookies (such as __cf_bm, which expires after 30 minutes) to tell people from automated traffic; they are not used for analytics or advertising. The website itself sets no cookies.

Analytics. We count visits with Plausible Analytics, run by Plausible Insights OÜ of Tartu, Estonia, so that we can see which pages are read and how people find the site. Plausible uses no cookies, stores nothing on your device, and does not follow you across other websites. When a page loads, your browser sends Plausible:

• the address of the page. Plausible keeps the page’s path and discards anything after a ? except campaign and referral tags such as utm_source or ref;
• the address of the page that linked you there, if your browser shares it; and
• your IP address and your browser’s User-Agent string.

From these, Plausible records the page you visited, the site or campaign that sent you, your browser, operating system and device type, and an approximate location (country, region and city) worked out from your IP address. It also records how far down the page you scroll, how long you spend on it, and which links to other sites you follow, such as the Buy and download links.

Your IP address and User-Agent are never stored. Plausible combines them with the site’s name and a random value that is deleted every 24 hours, to count each visitor once per day. It cannot recognise you on a later day or work out who you are. Plausible processes this data on our behalf under its data processing agreement and stores it in the European Union. We see only totals, and we keep them for as long as we use the service.

Legal basis (UK/EU): our legitimate interest in understanding how the site is used, so that we can improve it (Article 6(1)(f)).

If you would rather not be counted, block plausible.io with your browser’s tracking protection or a content blocker. The site works the same without it.

Buying and the email list. Clicking “Buy” takes you to a checkout page hosted by Polar, which is governed by Polar’s own privacy notice. Signing up for the email list on the abstractica.io website transmits your email address, the page you signed up from, and, for spam screening, your IP address to Buttondown (https://buttondown.com), use of which is governed by Buttondown’s own privacy notice.

9. Service providers

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we use no advertising providers. Our only analytics provider is Plausible, for the website, as described in Section 8.

10. International transfers

We are based in the United States, and the providers above process data in the United States and other countries; Plausible stores website analytics in the European Union. Where personal data of people in the UK, EEA, or Switzerland is transferred outside those areas, the transfer relies on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable) as incorporated in our agreements with those providers.

11. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to our processing of it, to receive it in a portable format, and to withdraw consent where processing is based on consent.

To exercise any of these, email [email protected]. We will respond within one month. We will not discriminate against you for making a request. Note that we identify purchase records by email address, so a request will normally need to come from — or reference — the address used at checkout.

Website analytics (Section 8) cannot be tied to you, so we cannot find, export, or delete your share of it on request. Section 8 explains how to stop it being collected.

If you are in the UK or EEA, you may also complain to your national data protection authority (in the UK, the Information Commissioner’s Office, ico.org.uk).

If you are a California resident, we do not sell or share your personal information as those terms are defined in the CCPA/CPRA, and we do not process sensitive personal information for the purpose of inferring characteristics. The categories we collect are identifiers and commercial information, as described in Section 5. Website analytics is deidentified, and we do not attempt to re-identify it.

12. Children

Abstractica is not directed at children under 13 (or under 16 in the EEA/UK), and we do not knowingly collect their personal data. Because the Software collects nothing about its users, the only relevant data is purchase data, which is supplied by the purchaser at checkout. If you believe a child has purchased a license, contact us and we will delete the record.

13. Security

Purchase records are stored in a private bucket with access restricted to us. The license-signing key is held only in server-side configuration and is never included in the application. The Software’s offline entitlement is cryptographically signed and verified, so a license status cannot be forged in transit. No system is perfectly secure, but we hold very little data to begin with — which is the strongest protection available.

14. Changes to this policy

We may update this policy. The version number and effective date at the top will change, and the current version is always published at https://abstractica.io/privacy. Where a change materially affects how we handle data already collected, we will say so prominently and, where required, seek consent.

Version 1.1 (October 14, 2026) added the website’s analytics (Plausible) and Cloudflare to Section 8, and replaced Section 6, which said Abstractica did not yet check for updates; it has done so since version 0.9.16.

15. Contact

Privacy questions and rights requests: [email protected] Elsewares, LLC (Elsewares), 7010 N Sheridan Road, Chicago, Illinois 60626.