MyData Privacy Policy

I Own Software LLC · Effective 26 October 2026 · Version 2026.10

1. Who we are, and in what capacity

I Own Software LLC operates MyData. For the hosted service we process your account data as a controller and your synced file content on your behalf. If you run MyData self-hosted, your files never reach us at all — we only hold your purchase and license records, and this policy applies to those and to this website.

2. What we process

• Account data: your email address, organization name, and a hash of your password (we never store the password itself). Guests you invite: their email address and the folder access you granted them.
• File content (hosted only): the files you sync, their version history, and the folder structure — because storing and syncing them is the product. Content is encrypted at rest in our storage layer; the service holds the keys so it can restore versions, serve downloads, and render previews. MyData is not a zero-knowledge system, and we won't pretend otherwise.
• Device records: each machine you add gets its own certificate; we store the device name, platform, app version, and when it last synced — that's what the Machines page shows you.
• Sharing records: folder memberships, guest invitations, and share links you create (we store only a digest of link tokens, so a database leak exposes no working links).
• Purchase data: handled by Stripe — we receive the order details and a payment reference, never your full card number. At checkout we record that you accepted the Agreement: the version you accepted, the time, and the IP address it came from (a legal record we keep with the order).
• Service logs: standard request logs (timestamps, endpoints, status) kept for operating and securing the service.

We do not sell your personal data for money, and we do not use your synced files or your hosted-account data for advertising or to train machine-learning models. There is one advertising use we do make, and we'd rather be plain about it than bury it: when you download a trial or complete a purchase on our marketing websites, we share a limited, cookieless conversion signal with Meta Platforms, Inc. (Facebook) through its Conversions API to measure and improve our advertising. It is sent from our servers — no advertising cookie or pixel is placed in your browser — and consists of a one-way hashed (SHA-256) version of your email address, your IP address and browser user-agent, the purchase amount where applicable, and, if you arrived from a Meta ad, the ad click identifier from the page web address. We also note advertising click identifiers from Google and Microsoft ads when you arrive from one, but we use these only for our own measurement and do not transmit them to Google, Microsoft, or any other party.

Our marketing websites may also load a streaming-TV advertising measurement script from Vibe (vibe.co), unless you have opted out. Unlike the Meta signal, it runs in your browser rather than on our servers: it sends Vibe your IP address, basic browser information and the page you visited, which Vibe uses to tell whether a household that saw one of our TV ads later visited our website. Vibe may set a cookie or similar identifier in your browser for this purpose. We do not send Vibe your email address, your name, or your payment details. It never receives your synced files or hosted-account data. Vibe’s use of this information is governed by Vibe’s own privacy policy.

You can opt out of this advertising sharing (with Meta and Vibe) at any time: we honor the Global Privacy Control (GPC) signal, so a browser set to send GPC is automatically excluded (and Vibe’s script is not loaded), you can opt out on your browser from our Your Privacy Choices page, and you can also opt out by emailing support@iownsoftware.com.

3. Where your data is stored

The hosted service runs on servers operated for us by Hetzner Online GmbH in Germany (EU); your synced content and its version history are stored there. Where a subprocessor operates outside the EU/EEA (see below), transfers rely on appropriate safeguards such as the Standard Contractual Clauses.

4. Subprocessors

5. How long we keep it

• File versions: kept for your plan's retention window, then pruned automatically; current files stay as long as your account does.
• Deleted files: drop out of your live folders immediately; their historical versions age out with the same retention window.
• Closed accounts: stored content and account data are deleted within 30 days of closure, except records we must keep (e.g. invoices, the checkout consent record) for as long as tax and commercial law require.
• Service logs: kept briefly for operations and security, then discarded.

6. Your rights

Depending on where you live (including under the GDPR), you can ask for access to, correction of, export of, or deletion of your personal data, and you can object to or restrict certain processing. Your synced files are always yours to download through the product; for anything else — including account closure and deletion — email support@iownsoftware.com and we'll act on it promptly. You can also complain to your local data-protection authority.

7. Security

Every device authenticates with its own certificate (no shared secrets in downloads); transport is TLS everywhere; content is encrypted at rest in the hosted storage layer; passwords are stored only as bcrypt hashes; share-link and invite tokens are stored only as digests. Tell us about a suspected vulnerability at support@iownsoftware.com and we'll respond quickly.

8. Cookies and this website

The app uses a single essential session cookie to keep you signed in — no advertising or cross-site tracking cookies. This marketing site sets no cookies of its own and loads no advertising pixels or browser-side trackers; the checkout page talks to our payment API and shows Cloudflare's Turnstile bot check, which may set its own strictly-functional cookie. Our advertising measurement runs server-side rather than through your browser: as described under "What we process" above, a trial download or purchase sends a cookieless conversion signal to Meta, and you can exclude yourself with the Global Privacy Control (GPC) signal or by contacting us.

9. Children

MyData is not directed at children under 16, and we don't knowingly collect their data. If you believe a child has an account, contact us and we'll remove it.

10. Changes

We'll update this policy as the product evolves; the current version (with its version number and effective date) always lives at this address, and material changes will be announced to account holders with reasonable notice.