Privacy
This notice explains how personal data is processed when you use the Chiselbase website, the desktop app, a trial or a paid license, and when you contact us.
1. Controller
Leon Hornig, trading as Chiselbase, Körnerstr. 3, 33818 Leopoldshöhe, Germany. Email: support@chiselbase.com.
2. Visiting the website
When you open a page or download a file, your browser sends technical data: IP address, date and time, requested address, response status, referrer and browser or device information. We use this data to deliver the website and downloads, to find errors and to protect against abuse.
The website is delivered by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Downloads may also be served from Cloudflare storage. Server logs are deleted after 30 days unless needed to investigate a specific security incident.
Legal basis: Article 6(1)(f) GDPR (our legitimate interest in a secure, working website). Analytics and advertising tools run only with your consent (next section). Fonts are served from our own domain.
3. Analytics and advertising with your consent
With your consent (“Accept all”, or a purpose under “Privacy settings”), we use Google Analytics to measure visits and Google Ads to measure ad results, show our ads to past visitors and let Google personalise ads. Without consent, no Google script is loaded. The tags and their measurement data pass through our own tagging server (t.chiselbase.com, operated on our server at OVH GmbH, Oskar Jäger Straße 173/K6, 50825 Köln, Germany), which forwards them to Google only for the purposes you allowed.
Data processed: cookies and similar identifiers, IP address, browser and device information, pages visited and ad click IDs. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework. Google Analytics keeps event and user data for 2 months. Cookies: _ga and _ga_<ID> (Google Analytics, 400 days), _gcl_au (Google Ads, 90 days).
Legal basis: Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time under “Privacy settings” at the bottom of every page.
Storing your choice in your browser is strictly necessary (Section 25(2) no. 2 TDDDG). To prove consent, we keep a record of each choice without your IP address for three years (Article 6(1)(c) and Article 7(1) GDPR).
4. YouTube videos
The home page shows a video from YouTube. Until you consent, you only see a preview image from our own server, and your browser makes no connection to YouTube. With your consent, the video loads from youtube-nocookie.com. Google then receives your IP address, the address of our page and browser or device information, and may store cookies or similar identifiers in your browser. Google is responsible for how it uses this data for its own purposes.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework.
Legal basis: your consent (Section 25(1) TDDDG and Article 6(1)(a) GDPR). You give it either for one playback, with “Play video” in the notice that opens over the preview image, or for all visits, with “YouTube videos” or “Accept all” in the consent dialog. A consent for one playback is not stored. A consent in the dialog is stored and recorded like your other choices there, and you can withdraw it under “Privacy settings” at the bottom of every page. Cookies Google has set can be deleted in your browser.
5. Trial registration
To start a trial you enter your email address in the app. Our license service sends a verification code to that address and, after verification, issues a trial license. We store the email address to deliver the trial and to allow only one trial per address.
Legal basis: Article 6(1)(b) GDPR (providing the trial you requested) and Article 6(1)(f) GDPR (preventing repeated trials). Verification emails are sent through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Trial emails are service messages, not a newsletter.
6. License checks and device identification
To activate and check a license, the app sends the license key and a device fingerprint to our license service. The fingerprint is calculated on your computer from processor information, a network adapter's MAC address, the computer name and the rounded memory size; on Linux also the machine ID and whether a virtual machine is used. These values are transmitted only as hashes, together with a generic label of operating system and architecture. Hashed values are pseudonymous, not anonymous, because they are linked to a license.
We use these records to validate the license, to enforce the device limit, to process deactivations and to resolve activation problems. The app checks the license at startup, about every 24 hours while running and when you request it.
Legal basis: Article 6(1)(b) GDPR (providing the license) and Article 6(1)(f) GDPR (preventing license misuse). Reading the device information is strictly necessary to provide the license you requested (Section 25(2) no. 2 TDDDG).
7. Updates
The app checks for updates at startup and about every 24 hours while running, and can download an available update in the background. It is installed only when you choose to. Update requests contain the app version, operating system, architecture, update channel and product identifier. If a license key is stored on the device, they also contain the key and the device fingerprint, so that updates for your license reach only your activated devices.
Legal basis: Article 6(1)(b) GDPR (providing the software and necessary updates) and Article 6(1)(f) GDPR (securing the update service).
8. The desktop app and your Firebase projects
The app stores settings, connections, saved queries, audit and undo records, job information and chat history on your computer. These records can contain personal data from your projects. Credentials, the license key and API keys are kept in your operating system's credential store. This data is not sent to us.
When you connect a Firebase or Google Cloud project, the app talks directly to Google's APIs with the credentials you choose. We have no access to your project data. Google processes this data under your agreement with Google. Make sure you are authorised to access the projects you connect.
Removing a connection or uninstalling the app does not delete every local file, export or stored credential. Check these locations if you want to remove all data.
9. Google sign-in and Google user data
If you connect a project with “Sign in with Google”, the app opens Google’s sign-in page in your browser. Google asks you to approve the following access. The app uses it only for the purposes given here.
openid and email: your Google account’s email address. The app shows it so you can see which account a connection uses and which roles to grant it. It is not stored. If you allow the AI chat or an external agent to read a connection’s permission report, the address is part of it.
cloud-platform: access to your Google Cloud and Firebase projects. The app uses it to read and change the data, security rules, indexes, users, files, backups and Remote Config templates you work with, and to read your projects, functions, logs, metrics and your own permissions.
firebase.database: access to your Firebase Realtime Database instances, to read and write their data and security rules.
The app uses this access only to provide the features you use in it. Requests go directly from your computer to Google’s APIs and do not pass through our servers. We never receive your Google tokens. We receive Google data only if you include it in a feedback report.
Google returns a refresh token. The app keeps it in your operating system’s credential store and holds short-lived access tokens in memory only. Removing a connection deletes its stored token. To revoke the app’s access at Google, use the “Third-party apps & services” page of your Google Account.
We do not sell Google user data, use it for advertising or share it with anyone. Data leaves your computer only in these cases: the optional AI chat and external agents you connect, which can keep accessing data while the agent bridge you enabled is running; feedback reports with content you choose; and profile photos of Authentication users, which the app loads without credentials from the address stored in the user record when you select that user.
Chiselbase’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
10. AI chat and external agents
The optional AI chat connects from your computer to the provider you configure (for example Anthropic, OpenAI, Google Gemini, OpenRouter or a local model), using your own API key. Prompts, conversation history and tool results can contain data from your projects and are sent to that provider when you use the chat.
External agents connected via MCP receive the data your permissions allow and may pass it to their model provider. These connections do not run through our servers. The provider's own terms and privacy policy apply.
11. Purchases
Payments are processed by Sold through Link, LLC, a Stripe company acting as merchant of record. You enter your payment and billing details directly in its checkout. Sold through Link, LLC is responsible for its own processing of these details.
To deliver your license, we receive your email address, your name if provided, customer and subscription references, the purchased product, payment and subscription status and the relevant dates. We do not receive your full card details. If you upgrade a trial from within the app, the checkout link contains a reference to your trial license and may prefill your email address.
Legal basis: Article 6(1)(b) GDPR (delivering the license) and Article 6(1)(c) GDPR (statutory record-keeping).
If you cancel or withdraw using the forms on this website, we process what you enter there (type of declaration, your name, email address, license key or order reference, reason and end date if given) and the time we received it. Your declaration is stored by our website service on Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA in Cloudflare's EU data location. For an ordinary cancellation we look up the subscriptions of your email address with Sold through Link, LLC and end them. The confirmation is sent to the email address you enter, through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. We keep the record as proof for four years and then delete it. The IP address is only used to limit how many declarations can be sent per minute and is not stored. Legal basis: Article 6(1)(c) GDPR (Section 312k BGB, confirming your declaration) and Article 6(1)(b) GDPR (ending the contract).
12. Contacting us
If you contact us by email, we process your contact details and your message to answer it. Please do not send credentials or production data that we do not need. Emails are handled by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
Legal basis: Article 6(1)(b) GDPR for enquiries about a contract, otherwise Article 6(1)(f) GDPR (our interest in answering enquiries).
13. Feedback from the app
You can send a bug report or an idea from the app. The report is sent only when you click Send, and the dialog lists beforehand what it contains: your text, your email address if you enter one, an error message and its code if you keep it in the report, the name of the app screen you were on, the app version, the operating system, the app language and any images you attach. Images and error messages can show project names or other data from your screen. Check them before sending.
Reports are received by our website service, run on Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and stored in Cloudflare's EU data location. We do not store your IP address, browser or device details with the report. The IP address is only used to limit how many reports can be sent per minute. Reports and their images are deleted after 365 days.
We use reports to find and fix errors and to improve the app, and your email address only to reply to you. Legal basis: Article 6(1)(f) GDPR (our interest in a working, improving app) and, where a report concerns your license, Article 6(1)(b) GDPR.
14. Recipients and transfers outside the EU
We use the following service providers: Cloudflare (website, downloads, consent records, feedback reports and cancellation records), Google (analytics and advertising, only with your consent), Google (YouTube videos, only when you press play), OVH GmbH, Oskar Jäger Straße 173/K6, 50825 Köln, Germany (license and update server, located in Frankfurt am Main, Germany), Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (email) and Sold through Link, LLC (payments). Providers that process data on our behalf do so under a data processing agreement.
Some providers can process data outside the EU/EEA, in particular in the United States. Such transfers are based on an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework where the recipient is certified, or on standard contractual clauses. You can request a copy of the safeguards from us.
15. Storage periods
We keep personal data only as long as needed for the purpose for which it was collected. License, customer and device records are kept for the duration of the license and then for as long as claims can be raised, usually three years. Records we must keep under tax and commercial law are kept for the statutory period of up to ten years. Support emails are deleted when the enquiry is resolved, unless they must be kept for these reasons.
Deactivating a device does not delete the license record. To have your data deleted, contact us.
16. Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability (Articles 15 to 20 GDPR). Where processing is based on Article 6(1)(f) GDPR, you can object to it on grounds relating to your particular situation (Article 21 GDPR).
Send requests to support@chiselbase.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.
The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), P.O. Box 20 04 44, 40102 Düsseldorf, Germany, email: poststelle@ldi.nrw.de.
17. Is providing data required?
You can use Chiselbase Free without an account. A trial requires an email address; a paid license requires the purchase details and the license checks described above. Without them we cannot provide the trial or license.