Katsumii.Legal
How the katsumii.com website and the Katsumii desktop app process your data — information pursuant to Art. 13, 14 GDPR, including notices for users in the United States.
The controller within the meaning of the EU General Data Protection Regulation (GDPR) is: Frederik Morbe, Schillerstraße 16, 51503 Rösrath, Germany. Email: info@katsumii.com. Website: katsumii.com.
This privacy policy applies to the website katsumii.com, including all subpages, and to the Katsumii desktop application (the app). No data protection officer has been appointed, as the legal requirements for a mandatory appointment are not met.
Katsumii is deliberately built around data minimization. The key points up front:
This website is hosted as a static site via GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (a subsidiary of Microsoft Corporation).
When you visit the website, GitHub processes technically necessary connection data in server logs, in particular your IP address, date and time of access, requested resource, browser type (user agent), and referrer URL. This processing serves to deliver the website and to ensure its security and stability.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of the website). GitHub is certified under the EU-U.S. Data Privacy Framework. For details, see the GitHub Privacy Statement at docs.github.com/privacy.
This website does not set any cookies — neither its own nor third-party cookies. The notice you see on your first visit is therefore not a cookie banner but a consent prompt for the cookie-free web analytics described in Section 5.
To remember your display preferences, the website uses your browser's local storage. Only functional entries are stored there — such as your selected color scheme, language, background style, and your web analytics decision (entry "katsumii-consent"), so that we do not have to ask you again on every visit.
These values remain in your browser, are never transmitted to us or to third parties, and can be deleted at any time via your browser settings. Storing them is strictly necessary for the functionality you request (remembering your preferences and your consent decision); under EU ePrivacy rules (Section 25(2) No. 2 of the German TDDDG), no consent is required.
For audience measurement we use Umami Cloud, a privacy-friendly analytics service provided by Umami Software, Inc. (USA). Umami is configured so that no personal usage profiles are created:
The legal basis is your consent (Art. 6(1)(a) GDPR), which you give via the analytics notice when you visit the website. Without your consent, Umami is not loaded. You may withdraw your consent at any time with effect for the future by clicking "Analytics settings" in the footer and declining. Insofar as data is transferred to the USA, this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
You can send bug reports to us by email at bugs@katsumii.com. We process the information you provide exclusively to analyze and fix the reported issue (Art. 6(1)(f) GDPR, legitimate interest in product quality, or Art. 6(1)(b) GDPR for existing customers). The data is deleted once the report has been resolved.
Katsumii licenses are sold through Lemon Squeezy, LLC (USA) acting as Merchant of Record. Lemon Squeezy is your contractual partner for the purchase and acts as an independent controller for payment processing.
During checkout, Lemon Squeezy processes in particular your name, email address, billing and tax data, and payment data. Lemon Squeezy's own privacy policy (lemonsqueezy.com/privacy) additionally applies to this processing.
From Lemon Squeezy we receive only the information required for license management and support (in particular name, email address, order and license data) — never full payment data. The legal basis is Art. 6(1)(b) GDPR (performance of a contract); invoicing and accounting records are additionally retained to comply with statutory obligations (Art. 6(1)(c) GDPR).
The Katsumii app follows a local and offline storage model: all content you create in the app — trades, journal entries, screenshots, account and challenge data, settings, and automatic backups — is stored exclusively on your device in a local database.
There is no cloud synchronization. We have no access to this data, cannot view it, and cannot restore it. Storage, backup, and deletion are entirely under your control (e.g. via the app's features, by deleting the data files, or by uninstalling the app).
License activation: When you activate the app, your license key is validated online against the Lemon Squeezy license API. This involves processing the license key, the activation status, an instance identifier, and technical connection data (IP address, timestamp). The purpose is managing your license and preventing abuse. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (protection against misuse).
Update check: The app may check whether a new version is available. This transmits the installed version number and technical connection data (IP address, timestamp) to the update server. No usage or trading data is transmitted, and no profiles are created. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, up-to-date product).
Beyond this, the app does not send any telemetry, usage, or crash data to us or to third parties.
If you contact us by email, we process your email address, the content you provide, and, where applicable, your name solely to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).
We do not share this data without your consent and delete it once your request has been fully handled, unless statutory retention obligations require otherwise.
We use service providers only as described in this policy: GitHub (hosting) and Umami Software (web analytics) process data as processors or under corresponding data protection agreements; Lemon Squeezy acts as an independent controller.
Beyond this, personal data is not disclosed to third parties unless we are legally obliged to do so (e.g. to authorities) or disclosure is necessary to establish, exercise, or defend legal claims.
Some of the service providers named above are based in the USA. Where personal data is transferred to the USA or other third countries, we rely on an adequacy decision of the EU Commission — in particular the EU-U.S. Data Privacy Framework for certified providers such as GitHub — or on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, supplemented by additional safeguards where necessary.
We process personal data only for as long as necessary for the purposes stated or as required by statutory retention obligations (in Germany, for example, six or ten years for records relevant under commercial and tax law). After that, the data is deleted or anonymized.
As a data subject, you have the following rights under the GDPR:
To exercise your rights, an informal email to info@katsumii.com is sufficient.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR (legitimate interest). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to establish, exercise, or defend legal claims.
For users in the United States, in particular in California (CCPA/CPRA) and other states with privacy laws, the following applies in addition:
We do not sell personal information and do not share it for cross-context behavioral advertising (no sale and no sharing within the meaning of the CCPA/CPRA). We do not use sensitive personal information and do not make automated decisions with legal effect.
Categories processed: identifiers (name, email address), commercial information (purchase history via Lemon Squeezy), and internet activity (exclusively aggregated, anonymized website statistics). Sources are the information you provide and your automatic website visit; purposes and recipients are described in this policy.
Depending on your state, you have the right to know, delete, and correct your personal information, and the right not to be discriminated against for exercising these rights. We honor such requests sent to info@katsumii.com even where statutory thresholds may not apply to us.
Because we do not sell or share data and do not use tracking, browser signals such as Global Privacy Control or Do Not Track do not result in any different processing — the opt-outs they represent are already our default.
Our website and the app are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us at info@katsumii.com — we will delete the data promptly.
The website is delivered exclusively over an encrypted TLS connection (HTTPS). Fonts are self-hosted; visiting the website does not establish any connection to Google servers. Thanks to the app's local and offline architecture, your trading data remains on your device and is not exposed to any server-side access risk on our part.
This privacy policy is effective as of July 3, 2026. We will update it if our services, the providers we use, or legal requirements change. The current version is always available at katsumii.com/privacy.