potluckdb Privacy Policy

Effective date: 2026-10-10

1. Who we are

1.1 This policy describes how Leastsquare Inc., a Delaware corporation with its business address at 169 Madison Avenue, STE 2613, New York, NY 10016, United States, which provides potluckdb ("Company", "we", "us"), processes personal data. Company is the controller of the personal data described here, except where Section 6 states that another party is responsible.

1.2 Contact for privacy matters: licensing@potluckdb.com, which is also our license administration address.

2. What this policy covers

2.1 This policy covers:
(a) the website at https://potluckdb.com;
(b) the documentation at https://docs.potluckdb.com;
(c) the download host at https://downloads.potluckdb.com;
(d) the account service at https://account.potluckdb.com, including the order and confirmation pages, sign-in, license administration, seat keys and the public key check page;
(e) the emails we send;
(f) purchases of subscriptions, which are processed by Sold through Link, LLC ("Link"), an affiliate of Stripe, Inc.;
(g) correspondence with us; and
(h) the potluckdb library (the "Library").

2.2 This policy does not cover the applications that our customers build with the Library. The Library sends us no data from those applications (Section 4.8). Questions about how an application processes your data should go to the company that provides that application.

2.3 This policy also does not cover the processing that Link and Stripe carry out as the merchant of record and payment provider. That processing is governed by their own privacy policies (Section 4.6).

3. Laws that apply

3.1 We are established in the United States. Our services are offered to businesses worldwide.

3.2 European Union and United Kingdom. Where we offer our services to individuals in the European Economic Area or the United Kingdom, the General Data Protection Regulation (EU) 2016/679 ("GDPR") or the UK GDPR applies to that processing under Article 3(2). This includes, for example, developers who claim seats and the representatives of business customers. Sections 5 and 10 describe our legal bases and your rights under those laws.

3.3 Switzerland. Where our processing has an effect in Switzerland, the Swiss Federal Act on Data Protection applies to it. Section 10 applies in the same way, and the competent authority is the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch).

3.4 United States. Section 11 describes the US state privacy laws, including those of California.

4. What we process, for what purpose, and on what basis

4.1 Website (potluckdb.com)

4.1.1 Hosting. When you visit the website, your browser sends technical request data to our hosting provider, Cloudflare. This includes your IP address, the requested address, the date and time, your browser's user agent and the referring page. Cloudflare uses this data to deliver the pages and to protect the website against attacks. We have not enabled request logging or analytics for the website.
Purpose: delivering and securing the website.
Legal basis: our legitimate interests in operating a secure website (Article 6(1)(f) GDPR).

4.1.2 No cookies, no tracking. The website sets no cookies and uses no analytics, advertising or social media tools. It loads no content from third parties.

4.1.3 Demonstrations. The website contains interactive demonstrations of the Library. They run entirely in your browser and send no data to us. When you start a demonstration, your browser stores its working data in the website's origin-private file system (OPFS), a storage area that only this website can access. The demonstration deletes that data when you reset it, when you run it again or when it fails. If you leave the page while a demonstration holds data, that data remains in the OPFS until you clear the website's data in your browser. The Library also stores its trial record there: a file named first-use holding the time when you first ran a demonstration. Thirty days after that time, the Library's trial ends in that browser, and the demonstrations show that they are unavailable. Neither the working data nor the trial record leaves your browser (Section 9).

4.2 Documentation (docs.potluckdb.com)

4.2.1 Hosting. The documentation is hosted by Cloudflare (Cloudflare Pages). Section 4.1.1 applies in the same way.

4.2.2 Browser storage. The documentation stores two items in your browser:

• your color theme preference, in local storage under the name starlight-theme. The item is written when a page loads, even before you choose a theme, and is then empty, meaning "automatic";
• the open or closed state of the navigation sidebar, in session storage under the name sl-sidebar-state, which your browser deletes when you close the tab.

Neither item is sent to us.

4.2.3 Search. The documentation search runs in your browser. Your search terms are not sent to us. The browser downloads the search index from the documentation host.

4.3 Downloads and package registries

4.3.1 When you, or your build system, download a Library file from https://downloads.potluckdb.com, Cloudflare processes the request data described in Section 4.1.1. Some language packages of the Library download their native engine files from this host automatically when an application is built. This includes the Rust and Dart packages, and Swift and Maven builds that fetch binaries from this host; optional mobile engine files are downloaded from this host by hand. For automatic downloads, the request comes from the build machine.
Purpose: delivering the files and protecting the host.
Legal basis: Article 6(1)(f) GDPR.

4.3.2 Package registries and repositories (for example npm, PyPI, crates.io, NuGet, pub.dev and GitHub) are operated by third parties. Their own privacy policies govern what they process when you download the Library from them. We receive no personal data from them about who downloads the Library.

4.4 Account service (account.potluckdb.com)

The account service lets business customers manage their licenses and lets developers claim seats and obtain license keys.

4.4.1 Sign-in. You sign in with your email address and a one-time code that we email to you.

• What we store: when you request a code, we store a sign-in record containing your email address, a hash of the code, the purpose of the sign-in, any invitation link you used, and the time of the request. The code is valid for 10 minutes, and five attempts are allowed. A cookie (Section 9) links your browser to the sign-in record.
• Addresses not entitled to sign in: if the address you enter is not entitled to sign in, we send no email. We still store a sign-in record for it, which can never be used, so that the service responds in the same way for every address. This prevents others from finding out which addresses hold licenses.
• Deletion: all sign-in records are deleted by a daily cleanup once they have expired.
• Purpose and legal basis: authenticating you (Article 6(1)(b) GDPR where you are our customer, Article 6(1)(f) GDPR otherwise; see Section 5) and preventing account enumeration (Article 6(1)(f) GDPR).

4.4.2 Sessions. After a successful sign-in, we create a session that lasts 12 hours. We store a hash of the session token, your email address, any invitation link you used, and the creation and expiry times. A cookie holds the session token. Signing out deletes the session. Expired sessions are deleted by the daily cleanup.
Purpose and legal basis: keeping you signed in, as in Section 4.4.1.

4.4.3 Abuse prevention. To limit sign-in requests and other actions, we record rate-limit events consisting of:

• the type of event;
• the time; and
• a keyed hash (HMAC) of your IP address, with IPv6 addresses shortened to their /64 network before hashing; or, for limits per email address, a keyed hash (HMAC) of your email address.

We use these records only to apply limits. They are deleted by the daily cleanup once they are older than 24 hours.
Purpose: protecting the service and its users against abuse.
Legal basis: Article 6(1)(f) GDPR.

4.4.4 Verified addresses. When you sign in successfully, we record your email address and the time of the verification.

• What the record is used for: confirming that a person has shown control of an address, for example before that person is added as an administrator.
• Deletion: the daily cleanup deletes this record 30 days after the last verification, unless the address is an administrator of a license or holds a current seat that is not blocked.
• Purpose and legal basis: as in Section 4.4.1.

4.4.5 Licenses, administrators and email domains. For each license we store:

• the customer's company or team name;
• the number of seats;
• the dates that limit the license;
• an invitation token;
• a reference to the purchase;
• internal notes; and
• the times of creation and last change.

We also store the email addresses of the license's administrators and the email domains whose addresses may claim seats. For licenses bought online, we also store:

• the Stripe customer and subscription references;
• the billing status;
• any scheduled end date of the subscription;
• the time of the last billing update from Stripe; and
• whether the license has been blocked.

Purpose: providing the license to the customer, administering it and billing for it.
Legal basis: Article 6(1)(b) GDPR for the customer's representatives where the customer is the person concerned. For administrators acting for a business customer, Article 6(1)(f) GDPR applies, our legitimate interest being to perform our contract with that customer.

4.4.6 The customer name in keys. The company or team name entered at purchase is written into every license key of that license. Anyone who submits a key on our public key check page sees the name. Because customers embed keys in the applications they distribute, the name can be read by anyone who obtains such an application. We therefore ask customers to enter a business name and not the name of a private individual. A name contained in keys that have already been distributed cannot be changed or erased.

4.4.7 Seats and keys. When you claim a seat, we store:

• your email address;
• the seat number;
• the time of the claim;
• if the seat is released, the time and the person who released it; and
• if the key is blocked, the time of the block.

We also store a cryptographic digest of each key shown to you, the date up to which it covers releases, and the time it was first shown. For blocked keys, we store the digest, the time of the block and a note. When a seat is released, we keep the record of the seat assignment as a history of the license.
Purpose: issuing and managing keys, enforcing the number of seats, blocking misused keys.
Legal basis: Article 6(1)(b) GDPR where you are the customer. Otherwise Article 6(1)(f) GDPR (performing the contract with your organization, which is the customer).

4.4.8 Change log. Every change to a license is recorded in a change log, together with the actor and the time. This includes seat claims, releases and blocks; barring and allowing an address again; changes to administrators, domains and the invitation link; that invitations were sent, without the addresses; changes of the number of seats and of the billing status; and renewals. The actor and the details may include email addresses.
Purpose: accountability, security, resolving disputes about seats.
Legal basis: Article 6(1)(f) GDPR.

4.4.9 Visibility within your organization.
(a) While you hold a seat, the license's administrators can see in the account service your email address, your seat number and the time of your claim. When you claim a seat, up to 20 administrators also receive an email stating your address, your seat number and the number of seats in use. If your key is blocked, your address appears on the license's list of barred addresses, which administrators can see, until an administrator allows you again.
(b) If you sign in through a permitted email domain or an invitation link of a license and cannot claim a seat, for example because all seats are in use or the license has expired, the account service shows you the email addresses of the license's administrators so that you can contact them.
Administrators are appointed by the customer, which is usually your employer or client.

4.4.10 Key check page. Anyone can submit a key on the public key check page. We check the key and display whether it is genuine, the customer name and whether it is blocked. We do not store submitted keys.

4.4.11 Service logs. The account service runs on Cloudflare Workers. It writes a log entry only for errors and selected events; each entry contains a fixed event identifier and, where relevant, an HTTP status code. Request addresses, email addresses, tokens and keys are not logged, and Cloudflare's per-request invocation logs are switched off. Cloudflare keeps these entries for 7 days. Cloudflare's processing of request data for delivery and security is described in Section 4.1.1.
Purpose: operating the service, finding faults and investigating abuse.
Legal basis: Article 6(1)(f) GDPR.

4.4.12 Backups. Once a week, an automated job copies the durable account data to backup storage in Cloudflare R2. The data copied is:

• licenses;
• administrators;
• domains;
• seat assignments;
• key digests;
• blocked keys;
• the change log;
• owner access-token records;
• billing notification records received from Stripe;
• pending seat-change requests; and
• the mail queue, which contains the recipient address, subject and full text of each queued or recently sent email, including invitation links.

Sign-in records, sessions, rate-limit records, verified addresses and purchase records are not copied. Data deleted from the account service remains in the backups until they are deleted. The job runs on a GitHub-hosted runner, which processes the copy in transit. The backups are deleted after 90 days. In addition, Cloudflare's database service keeps a point-in-time history of the database for restoration for 30 days.
Purpose: restoring the service after a failure.
Legal basis: Article 6(1)(f) GDPR.

4.5 Emails we send

4.5.1 We send these emails from licensing@potluckdb.com:

• sign-in codes, to the address that requests them;
• claim notices, to the license's administrators;
• to the purchaser, a welcome email with the sign-in address and the license's invitation link;
• invitations, to the addresses that an administrator enters (Section 4.5.2);
• to administrators, notices that a subscription has renewed, is scheduled to end, has ended, or has more seats in use than paid; and
• to developers who hold a seat, a notice that an updated key is available after a renewal.

Sign-in codes and claim notices are sent directly. The other emails are first placed in a mail queue in the account service, which stores the recipient address, the subject and the full text of each message. A sent message is deleted from the queue 30 days after sending. A message that could not be delivered after eight attempts is deleted 30 days after it was queued. We send these emails through Google Workspace, which keeps a copy of each sent message in our mailbox. We delete those copies 30 days after sending.

4.5.2 Invitations. When an administrator invites developers, we send an invitation email to each address the administrator enters. The email contains the license's invitation link and a link to the key page. The invited address and the message are kept in the mail queue until 30 days after sending (Section 4.5.1). The change log records that invitations were sent, but not the addresses. Unless the invited person signs in, we store nothing else about an invited address.

4.5.3 We send no marketing emails.
Legal basis for the emails in this section: Article 6(1)(b) GDPR or Article 6(1)(f) GDPR, as for the underlying service in Section 4.4.

4.6 Purchases through Link (Stripe Managed Payments)

4.6.1 Who processes what. Subscriptions are sold through Link, the merchant of record, using Stripe's checkout. When you buy, you give your contact, billing and payment details to Link and Stripe, which process them as independent controllers under their own privacy policies. This covers checkout, payment processing, fraud prevention, tax calculation, receipts, refunds, disputes and the management of the subscription in your Link account or in Stripe's billing portal, which administrators can open from the account service. See https://link.com/privacy and https://stripe.com/privacy. We do not receive or store full payment card numbers.

4.6.2 What we receive. Under Link's terms, Link shares with us the data of each order. That data includes:

• your contact information;
• your billing address;
• limited payment information;
• your tax identification number if you entered one; and
• the details of the order.

This data is held in our Stripe account, and we can access it. Stripe holds it on our behalf as our processor. In the account service we store:

• the company or team name;
• the purchaser's email address, who becomes the first administrator;
• the number of seats;
• the subscription and customer references;
• the billing status; and
• the subscription dates.

We also keep a record of each billing notification received from Stripe: its identifier, type, related object reference, times and processing outcome. These records are deleted 400 days after receipt. For each purchase started on the order page, we keep a hash of the purchase cookie (Section 9), the Checkout session reference and the payment state; records of purchases that were not paid are deleted after 30 days, and records of paid purchases 400 days after the purchase. A requested change of the number of seats is kept until Stripe confirms it.
Purpose: creating and administering the license, billing, accounting, tax compliance and handling disputes.
Legal basis: Article 6(1)(b) GDPR. For accounting and tax records required by US law, Article 6(1)(f) GDPR, because Article 6(1)(c) GDPR covers only obligations under EU or Member State law (or, for the UK GDPR, UK law).

4.6.3 Deletion through Link. If you ask Link or Stripe to delete your data, Stripe deletes the data it holds in our Stripe account and informs us. We then delete or anonymize the related data in our own systems, except to the extent that we must keep it under Section 8.

4.7 Correspondence

4.7.1 When you write to us, we process your name, email address, the content of your message and any data that you include in it.

• Purpose: answering you.
• Legal basis: Article 6(1)(b) GDPR where your message concerns a contract or its preparation. Otherwise Article 6(1)(f) GDPR.
• Storage: messages are kept in our Google Workspace mailbox.
• Retention: correspondence about a license, a seat or an order is kept for as long as the records of that license (Section 8). Other correspondence is deleted 2 years after the last message.

4.8 The Library

4.8.1 The Library sends no data to us. It contains no telemetry, no usage reporting and no license server connection. It checks license keys offline on the device. Its only network connections go to the storage services and credential sources that the developer or the customer configures.

4.8.2 The Library reads the license key from the configuration, an environment variable or a key file that the developer provides. It writes only its trial record: a file named first-use, holding the time of the first authorization without an accepted key, in its configuration directory or, in a browser, in the origin-private file system. It also prints license and trial notices locally. None of this is transmitted to us.

4.8.3 Data that applications store with the Library is under the control of the company that provides the application. We have no access to it.

5. Legal bases (GDPR and UK GDPR)

5.1 We rely on the following legal bases:
(a) Article 6(1)(b), performance of a contract or steps before entering into one: where you are our customer, or act as a sole trader, and the processing is necessary for the license, the subscription or the account service;
(b) Article 6(1)(f), legitimate interests:

• for administrators and developers acting for a business customer, where our interest is to perform our contract with that customer;
• for security, abuse prevention, logs and backups;
• for the change log;
• for the establishment, exercise or defense of legal claims; and
• for compliance with legal obligations under US law. We have weighed our interests against yours and concluded that they are not overridden, because the data is limited to what the service needs and you would reasonably expect this processing. You may request details of this assessment; and

(c) Article 6(1)(c), legal obligation: where an obligation under EU or Member State law (or UK law) applies to us, for example an order of a supervisory authority.

5.2 We do not rely on consent for any processing described in this policy.

5.3 Providing your email address is necessary to sign in and to claim a seat. Without it, we cannot issue a key to you.

6. Who receives personal data

6.1 Service providers (processors). The following providers process personal data on our behalf, under contracts that bind them to our instructions:

• Cloudflare, Inc., USA: hosting of the website, documentation, download host and account service; database; backup storage; logs; network security; access control for our administration console.
• Google LLC, USA: email sending and our mailbox (Google Workspace).
• GitHub, Inc., USA: the weekly backup job (Section 4.4.12) and our source code hosting.
• Stripe, Inc., USA: holding the order data in our Stripe account (Section 4.6.2).

6.2 Independent controllers.

• Link and Stripe, for the purchase and payment processing described in Section 4.6.1.
• Package registries, for downloads made from them (Section 4.3.2).

6.3 Your organization. The administrators of a license see the data described in Section 4.4.9.

6.4 The public. Anyone who submits a key on the key check page sees the customer name and the key's status. Anyone who obtains an application that contains a key can read the key's content (Section 4.4.6).

6.5 Others, where necessary. Others receive personal data only where this is necessary:

• our professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality;
• authorities and courts, where we are required by law or where this is necessary to establish, exercise or defend legal claims; and
• a successor, in the event of a merger, acquisition or sale of all or part of our business, which would be bound by this policy.

6.6 We do not sell personal data, and we do not share it for advertising.

7. Where your data is processed

7.1 We are located in the United States, and our service providers process data mainly in the United States. Cloudflare also processes requests in the data center closest to you, which may be in your own country or in another country.

7.2 If you are in the EEA, the UK or Switzerland and use our services, you provide your data directly to us in the United States. According to the European Data Protection Board, that direct collection by a controller subject to the GDPR under Article 3(2) is not in itself a transfer under Chapter V of the GDPR. Our disclosure of that data to our service providers outside the EEA is a transfer, and we protect it as follows:

• Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework. Its data processing addendum also includes the European Commission's standard contractual clauses, the UK Addendum and Swiss amendments.
• Google LLC is certified under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework. Google's data processing terms rely on this certification and otherwise on standard contractual clauses.
• GitHub, Inc. is certified under the Data Privacy Framework, and its data protection agreement includes standard contractual clauses.
• Stripe, Inc. is certified under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework, and also uses standard contractual clauses and the UK International Data Transfer Agreement.

7.3 You may request information about these safeguards, and a copy of them, by contacting us (Section 16).

8. How long we keep data

8.1 Where we must keep data to establish, exercise or defend legal claims, we keep it until the matter is resolved, even if the period above has ended.

9. Cookies and browser storage

9.1 The cookies are strictly necessary for signing in and for completing a purchase. We use no analytics, advertising or tracking cookies.

10. Your rights under the GDPR and the UK GDPR

10.1 If the GDPR or the UK GDPR applies to the processing of your data, you have the right:
(a) to obtain confirmation of whether we process your personal data, to access it and to receive a copy of it (Article 15);
(b) to have inaccurate data corrected (Article 16);
(c) to have your data erased, where the conditions of Article 17 are met;
(d) to restrict processing, where the conditions of Article 18 are met;
(e) to receive data that you provided to us, where we process it on the basis of a contract, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller (Article 20);
(f) to object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) (Article 21). We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims; and
(g) to lodge a complaint with a supervisory authority, in particular in the EU or EEA Member State of your habitual residence, place of work or place of the alleged infringement (Article 77). In the United Kingdom, this is the Information Commissioner's Office (https://ico.org.uk).

10.2 Article 22 is addressed in Section 12.

10.3 To exercise your rights, write to licensing@potluckdb.com. We may ask you to confirm your identity, for example by signing in to the account service with the address concerned. We respond within one month. This period may be extended by two further months where necessary, in which case we will inform you of the extension and its reasons within the first month.

10.4 Some data cannot be erased, or can be erased only in part:

• a customer name in keys that have already been distributed (Section 4.4.6);
• data that we need to establish, exercise or defend legal claims; and
• data that we are required by law to keep.

If you are a developer and your organization's license is active, we act on an erasure request by releasing your seat. The record of the assignment is kept as part of the license history for the period in Section 8, unless Article 17 requires its erasure.

11. United States: state privacy rights

11.1 Comprehensive state laws. Several US states, including California (California Consumer Privacy Act, as amended by the California Privacy Rights Act), Colorado, Connecticut, Virginia, Texas and others, have comprehensive privacy laws. Each applies only to businesses that meet its thresholds, such as annual revenue or the number of residents whose data is processed.

11.2 What we do not do. We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that would require offering a right to limit, and we do not engage in profiling that produces legal or similarly significant effects.

11.3 Categories of personal information. Section 4 lists the personal information we collect, the sources of it and the purposes of processing. In summary, the categories are:

• identifiers, such as email address, IP address and account references;
• commercial information, such as orders and subscriptions;
• internet or other electronic network activity information, such as request data and logs; and
• professional information, such as your organization and its license.

Section 6 lists the categories of third parties to which we disclose personal information.

11.4 Your choices. Depending on the state where you live, you may have rights to know, access, correct or delete your personal information, to obtain a portable copy, and to opt out of sale, targeted advertising and certain profiling. Even where these laws do not apply to us, you may make any of these requests to licensing@potluckdb.com, and we will answer it under Section 10. We will not discriminate against you for exercising your rights. You may use an authorized agent where state law permits. You may appeal a refusal by replying to our answer, and we will respond to the appeal within 45 days of receiving it.

11.5 Do Not Track and Global Privacy Control. We do not track you across websites, and our websites contain no third-party tracking. Our services therefore behave in the same way whether or not your browser sends a "Do Not Track" or "Global Privacy Control" signal.

11.6 Review and correction. By signing in to the account service, you can review your seat and key data, and administrators can review the data of their license. Administrators can add and remove administrators and email domains and release seats. To correct any other data, including an email address or the customer name, write to licensing@potluckdb.com.

12. No automated decision-making

12.1 We do not make decisions that produce legal effects for you or similarly significantly affect you based solely on automated processing, including profiling (Article 22 GDPR). Whether an address may sign in or claim a seat follows from the settings that the customer's administrators make, such as permitted domains and invitations. Rate limits temporarily restrict repeated requests to protect the service. If a rate limit or refusal affects you, you may contact us for a review by a person.

13. Children

13.1 Our services are intended for businesses and their personnel. They are not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe that a child has provided personal data to us, contact us and we will delete it.

14. Security

14.1 We protect personal data with technical and organizational measures appropriate to the risk, including:

• encrypted connections (HTTPS with HTTP Strict Transport Security);
• a restrictive content security policy;
• cookies restricted to our account domain and inaccessible to scripts;
• storage of sign-in codes and session tokens only as hashes;
• storage of IP addresses and email addresses in rate-limit records only as keyed hashes;
• limits on sign-in attempts;
• access to our administration console only through an additional access control; and
• regular backups.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the competent authorities and affected persons where the law requires it.

15. Changes to this policy

15.1 We may change this policy. The version published at https://potluckdb.com/privacy, with its effective date, applies. We will inform license administrators by email of material changes at least 30 days before they take effect, unless a change is required sooner by law. We review this policy at least once a year.

16. Contact

Leastsquare Inc.
169 Madison Avenue, STE 2613
New York, NY 10016
United States
Email: licensing@potluckdb.com