Privacy

What TheFile.Ninja and this site send, what is kept and why.

Who we are

Kodar.Ninja (Joakim Sandeberger), Södra bangatan 20, 593 50 Västervik, Sweden, is responsible for your data (the controller). Questions about it: joakim@kodar.ninja.

The app and the license server

On its first start, and about once a week after that, TheFile.Ninja asks the license server which license the computer has. It sends:

• Three checksums that recognise the computer: of Windows' installation id (MachineGuid), the motherboard's id (SMBIOS UUID) and the system disk's serial number. The values themselves never leave the computer — only SHA-256 of them. The server in turn keeps them only as an HMAC under a secret key.
• The computer's name (DESKTOP-ABC, say), so you can tell it apart in your account.
• The app's version, a random install secret the server gave it, and the ids of the license documents it holds.

The server also sees the IP address the request comes from. It is used to limit how often anyone can ask, and to compare networks when a code is opened on this site. It is kept with the code and in the limits' counters until those are deleted (below), never with the computer.

The server keeps the computer (the checksums, its name, when it was first and last seen, its trial and registration dates), the licenses it is on and a log of events (trial started, registered, put on or taken off a license). That is what lets a reinstall find the same trial and a license follow the right computer. License documents carry no email address and no name.

Codes from the app last 15 minutes and are deleted a day after they run out. Counters for the limits are deleted when their window has passed.

This site

• Account: your email address, when you sign in. You sign in with a code or a link mailed to you; there are no passwords.
• Cookies: only the ones needed — the sign-in, the address waiting for its code, and a message for the next page. No cookies for statistics, no ads, nothing from other sites.
• Statistics: when you open a page or download the app, the site's server notes which page or file it was, the site you came from (its name only), a campaign name in the address, the country your IP address belongs to, the kind of system (Windows, Mac…) and the language. No IP address is kept and no cookie is set. To count visitors, a checksum of the address and the browser is made with a key that is deleted when the day is over (UTC), so it cannot be traced back afterwards. Programs that crawl the web are not counted.
• Payments are handled by Stripe, which gets what you fill in on their page (card, name, address, VAT ID). We keep Stripe's customer id and what each payment was for.
• Mail: sign-in codes, and a message when a computer is put on your license, sent through Resend.

Why we may

• The contract: your account, your licenses and their computers, your payments.
• A legitimate interest in stopping abuse: the computers’ checksums, so that a computer gets its trial once, and IP addresses in the limits’ counters.
• A legitimate interest in knowing how the site is used: the statistics above, without cookies and without IP addresses.
• The accounting law: payments and invoices.

How long

The account, the licenses and the computers as long as the account exists; payments and invoices as long as Swedish accounting law requires (up to seven years). A computer’s checksums and trial dates are kept so that it gets its trial once. The site's statistics are kept for 13 months, the day's key only until the day is over. What we need not keep, we delete when you ask.

Where it is

The license server and the accounts are at Supabase in the EU (Ireland). The site runs on Vercel. Payments and invoices are at Stripe, mail goes through Resend. Stripe, Vercel and Resend may handle data outside the EU/EEA, under the EU’s standard contractual clauses.

Your rights

Your account shows your licenses and computers; you can rename and remove computers there. You have the right to a copy of your data, to have it corrected or deleted, to restrict or object to how it is used, and to get it in a form you can take elsewhere: write to joakim@kodar.ninja. You can also complain to Sweden’s data protection authority, IMY (imy.se).

Last changed November 12, 2026. Changes are shown here.