Privacy Policy

1. Privacy at a Glance

This privacy policy refers to the Macro Deck website (macro-deck.app) and the Macro Deck documentation (docs.macro-deck.app), as well as the Macro Deck link service (open.macro-deck.app). The website serves to provide information about the Macro Deck software and to offer it for download; the documentation explains how to install and use Macro Deck and how to develop plugins for it; the link service opens a shared link in the Macro Deck desktop app (see section 3.4). The Store pages of the website (macro-deck.app/store) show the plugins and icon packs from the Macro Deck Store (see section 3.5), and the blog of the website (macro-deck.app/blog) has news and articles about Macro Deck (see section 3.6). Personal data is processed only to a minimal extent.

All of these sites contain no tracking services. Only the pages of individual blog posts count their page views with Cloudflare Web Analytics, and only if you have consented, without cookies and without recognising you (see section 3.3). The only cookie is set by the website, and only when you choose a language in its menu, to remember that choice (see section 3.2). Only the Store pages, when you dismiss a notice there yourself, and the blog posts, to keep your choice about web analytics, use your browser's local storage (see section 3.2). Apart from Cloudflare's analytics script, which blog posts load only after your consent, your browser only connects to our own domains; content from other services, such as the GitHub and Discord figures on the website, is fetched by our servers and does not reveal your IP address to those services. The Macro Deck accounts, the Creator Portal and the Store in the desktop app (such as installing, rating and reporting entries), the desktop app itself and the companion app are covered by their own privacy policies, which you can open with the tabs above.

2. Controller

Responsible for data processing:

Macro Deck, Owner Manuel Mayer
Porzer Straße 142A
53859 Niederkassel
Germany

Email: legal@macro-deck.app

We are not required to appoint a data protection officer. For all data protection questions, please contact us at the address above.

3. Data Collection on the Website

3.1 Hosting by Cloudflare

The website, the documentation and the link service are hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages from its worldwide network and protects them against attacks and misuse. For every request, Cloudflare processes:

• IP address of the requesting device
• Date and time of the request
• Requested address
• Browser type and version and the operating system used
• Referrer URL (the previously visited page)

Cloudflare acts as our processor under a data processing agreement (Art. 28 GDPR). Browsers may also send reports about failed connections to Cloudflare (Network Error Logging), which contain the same kind of technical data. We use these data solely for technical purposes, in particular to ensure the stability and security of the sites, and do not merge them with other data sources. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in the technical provision and security of the website).

Requests to the few website addresses under /api/ are handled by a program on Cloudflare's network (a Cloudflare Worker), which provides the brand assets list, the GitHub figures, the roadmap, the Discord member count and the Store data (see sections 3.5 and 4); when it serves the roadmap page (/roadmap), it writes the roadmap into the page. The same Worker serves the Store page of an entry under its address (/store/…) and writes the entry's name, short description and preview image into the page, and it creates the pages of the blog and the newest posts on the home page (see section 3.6). When you open an English page that is also available in other languages without coming from another page of this website, the Worker forwards you to the page in the language you last chose in the website's menu (the cookie described in section 3.2) or, if you have not chosen one, in the language your browser asks for in the language settings it sends (Accept-Language), if there is such a page. It does not store this information, and the Worker does not keep logs.

3.2 Cookies and Local Storage

The documentation and the link service do not set any cookies. This website sets a single cookie, and only when you choose a language in its menu: the cookie site-language with the code of that language (for examplede) as its value; the page also sends the chosen language to our Worker (see section 3.1), which sets the same cookie. With it, the website opens in that language on your next visits (see section 3.1). The cookie contains no information about you, is sent only to macro-deck.app, expires one year after your last choice and is replaced whenever you choose another language. Nothing is stored unless you choose a language. None of these sites use your browser's session storage.

Only the Store pages and the blog posts use your browser's local storage, for one entry each. When you dismiss the "Made by the community" notice with "Got it", the page stores the value 1 under the keystore-community-notice-dismissed, so that the notice does not appear again on your next visits. The entry contains no information about you, is not transmitted to us or anyone else and stays until you delete the site data of macro-deck.app in your browser. Nothing is stored unless you click. When you allow or decline web analytics on a blog post (see section 3.3), the page stores the value granted or denied under the key blog-analytics-consent, so that your choice applies to all blog posts. This entry, too, contains no information about you, is not transmitted and stays until you change it or delete the site data.

This cookie and this storage are strictly necessary to provide the functions you explicitly asked for, keeping your language, keeping the notice hidden and respecting your choice about web analytics (§ 25 para. 2 no. 2 TDDDG). They do not require consent. We ask for your consent only for web analytics on blog posts (see section 3.3).

3.3 Web Analytics (blog posts only, only with your consent)

To know how often our blog posts are read, the pages of individual blog posts (macro-deck.app/blog/… and their translations) can use Cloudflare Web Analytics, a service of Cloudflare (see section 3.1), but only if you have consented beforehand. No other page of the website, the documentation or the link service uses web analytics, and no page uses any other analytics or tracking service.

Consent. When you open a blog post and have not made a choice yet, a notice at the edge of the page asks whether this view may be counted; "Allow" and "Decline" are equally prominent, and the post can be read in full without answering. Until you choose "Allow", the page loads no script from Cloudflare and no measurements are taken. The page stores your choice in your browser's local storage (see section 3.2), so that it applies to all blog posts and you are not asked again on every post.

What happens after you consent. Your browser loads a small script from Cloudflare (static.cloudflareinsights.com). The script reads technical figures about how quickly the page loaded from your browser and sends them, together with the address of the page (without its query string) and the address of the page you came from (referrer), to macro-deck.app, where Cloudflare receives them. Cloudflare evaluates them together with the request data listed in section 3.1, such as the browser, the operating system and the country derived from the IP address, and shows us only aggregated figures: page views and visits per page and day, and how they are distributed over countries, browsers, operating systems and device types. A visit means that the page was opened from another website or directly; it is determined from the referrer, not by recognising you. Known bots are left out of the figures we look at.

Cloudflare Web Analytics sets no cookies, uses neither the local nor the session storage of your browser, does not create a fingerprint of your browser and does not use your IP address to recognise you. It does not follow you across pages or websites and creates no usage profiles. We cannot tell individual visitors apart in the figures and do not combine them with other data. They are shown only to the administrators of the Macro Deck Platform, as page views per post.

Legal basis. Reading the measurements from your browser is based on your consent under § 25 para. 1 TDDDG, and the subsequent processing of the data on your consent under Art. 6 para. 1 lit. a GDPR. Consent is voluntary; declining has no disadvantages for you.

Withdrawal. You can withdraw your consent at any time with effect for the future (Art. 7 para. 3 GDPR), as easily as you gave it: with "Analytics Settings" below any blog post and then "Decline", with the button below, or by clearing the site data of macro-deck.app in your browser. This does not affect the lawfulness of the processing carried out before the withdrawal.

3.4 Link Service (open.macro-deck.app)

Macro Deck can be opened with links that start with macrodeck://. Many apps, such as Discord, do not turn these into clickable links, so such links are shared as normal web links on open.macro-deck.app. The link service turns the address back into the matching macrodeck:// link and offers it to your device, so that the Macro Deck desktop app opens the corresponding page. For example,https://open.macro-deck.app/settings opens macrodeck://settings.

When you open such a link, your browser requests the page from a Cloudflare Worker on Cloudflare's network (see section 3.1). The address you open, including its path and parameters (for example the ID of a Store package), is part of that request, and Cloudflare processes it together with the data listed in section 3.1. The Worker builds the page from this address only. It does not store the address, does not keep logs, does not contact other services and does not set cookies. A small script on the page runs in your browser and tries to open themacrodeck:// link; the address is not sent anywhere by it. Whether and how the Macro Deck app opens is decided on your own device, and your browser may ask you first. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in providing links that open Macro Deck).

If you share such a link in Discord or another messaging service, that service may retrieve the page itself, for example to show a preview. This happens under that provider's own responsibility, and we have no influence on it.

3.5 Store (macro-deck.app/store)

The Store pages show the plugins and icon packs published in the Macro Deck Store. Our Cloudflare Worker (see section 3.1) fetches these data regularly, about every 30 minutes and independently of page requests: the entries themselves from the public Macro-Deck-Store-Registry repository on GitHub (codeload.github.com), and the average rating, the number of ratings and the number of installs per entry from the Macro Deck Platform (api.macro-deck.app). It keeps them in a Cloudflare data store (Workers KV) and creates preview images for link previews from icons in SVG format. These requests contain no data about you; the pages only read from this store.

The entries contain the information their publishers released through the Creator Portal, including the publisher's name, descriptions, images and links. How we process this information is described in the platform privacy policy.

Your browser loads icons, screenshots and package files directly from store-assets.macro-deck.app, which is also delivered by Cloudflare (see section 3.1). A package file is only downloaded when you choose "Download". Such a download is counted for the creators' statistics, at most once per day and package version using a salted hash of the IP address, package version and day; the details are in section 4.1 of the platform privacy policy.

Images that publishers embed in their descriptions or release notes, such as badges, are loaded by your browser directly from the server the publisher chose, only over HTTPS and without telling it which page you came from. The operator of that server receives your IP address, the time of the request and your browser's identification and processes them under its own responsibility, possibly also with its own cookies; it may be located in a third country, and we have no influence on which server a publisher uses.

Search, filters and sorting are processed by your browser itself. They are part of the page's address, so they are only transmitted to Cloudflare when you reload the page or share the address (see section 3.1). "Open in Macro Deck" passes a macrodeck:// link to your device without sending any data; if you open the link in a new tab or share it instead, section 3.4 applies. "Copy link" only places the entry's address on your clipboard.

If you share the address of an entry in Discord, a social network or another messaging service, that service may retrieve the page and its preview image itself to show a preview. This happens under that provider's own responsibility, and we have no influence on it. The legal basis for the processing on the Store pages is Art. 6 para. 1 lit. f GDPR (legitimate interest in making the content of the Macro Deck Store accessible outside the app as well).

3.6 Blog (macro-deck.app/blog)

The blog shows the posts we publish, and the home page shows the newest of them. Our Cloudflare Worker (see section 3.1) creates these pages on Cloudflare's network from the posts published on the Macro Deck Platform (api.macro-deck.app). It asks the Platform for them only when a page has to be created anew, and these requests contain no data about you. To deliver the pages quickly and while the Platform cannot be reached, the Worker keeps the created pages in Cloudflare's cache and the last posts it received in a Cloudflare data store (Workers KV). Neither contains data about visitors.

Your browser loads the images of the posts from store-assets.macro-deck.app, which is also delivered by Cloudflare (see section 3.1). Each post names its author with the username and profile picture of their Macro Deck account; the Worker fetches the picture from our sign-in service (auth.macro-deck.app) and your browser loads it from macro-deck.app, so it does not connect to the sign-in service. The blog shows no images from other servers. The pages of individual posts count their page views with Cloudflare Web Analytics (see section 3.3). Apart from the language cookie and the entry with your choice about web analytics (see section 3.2), the blog sets no cookies, uses no local storage and contains no comments, reactions or other functions that would require your data. Links in the posts to other websites open in a new tab and do not tell those websites from which page you came (see section 4.2). The blog can also be read as an RSS feed (macro-deck.app/blog/rss.xml); a feed reader you use for it retrieves the feed under its own responsibility.

If you share the address of a post in Discord, a social network or another messaging service, that service may retrieve the page and its preview image itself to show a preview. This happens under that provider's own responsibility, and we have no influence on it. The legal basis for the processing on the blog pages is Art. 6 para. 1 lit. f GDPR (legitimate interest in informing about Macro Deck).

4. External Services and Content

Some parts of the website show information from other services. Our Cloudflare Worker (see section 3.1) fetches this information itself and passes it on to your browser, so these services only receive requests from Cloudflare and never your IP address or other data about you:

• GitHub: the star count of the Macro Deck repository and the download link and version of the latest Macro Deck 2 release, the open milestones of the Macro Deck repository with their open and closed issues, and open feature requests, for the roadmap page, and the open issues of a Store entry's repository for the Issues tab of its Store page, each from the GitHub API (api.github.com), and the entries of the Macro Deck Store from the Macro-Deck-Store-Registry repository (codeload.github.com, see section 3.5).
• Macro Deck Platform: ratings and install counts of the Store entries, without information about individual people, and the published blog posts (api.macro-deck.app, see sections 3.5 and 3.6).
• Discord: the member count of our Discord server, from the public Discord invite API (discord.com).
• Macro Deck assets: the list of brand assets on the branding page, from assets.macro-deck.app. The logo previews on that page are loaded by your browser from assets.macro-deck.app directly, which is also delivered by Cloudflare (see section 3.1).

The roadmap page (/roadmap) and the Issues tab of the Store pages show public issues from GitHub repositories: their title, number, creation date, labels, state, the number of comments and reactions, and the GitHub username of the person who opened the issue. In doing so we process personal data of these people, namely their username and the details of their issue, and any personal data mentioned in an issue's title. The data comes from publicly accessible sources, the issues on GitHub that these people published themselves. We show it to inform openly about what is being worked on in Macro Deck and the extensions in the Store, and to involve users in feature requests. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in this information and involvement). The interests of the people concerned do not override ours, as they published this information publicly in the respective project themselves and we show only the username without further profile data. As we cannot notify these people individually, we inform them in this way (Art. 14 para. 5 lit. b GDPR). We do not store the data permanently: Cloudflare keeps GitHub's responses for at most 10 minutes, after which they are fetched again. An issue that is changed, hidden or deleted on GitHub therefore usually appears changed or disappears here after about 10, at most about 20 minutes. If you do not want your username to appear here, you can object at any time (Art. 21 GDPR) by writing to us at the address given in section 2. Alternatively, you can edit or delete your issue on GitHub yourself at any time.

4.1 Twitch (only on the Twitch authentication page)

The page /twitchauth is used exclusively to connect a Twitch account with the Macro Deck Twitch plugin. When this page is called up, connections are established to services of Twitch (Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA, a subsidiary of Amazon). The authorisation is carried out via the official Twitch OAuth procedure; the resulting access token is processed in your browser and is not stored by us. This page is only called up when you actively start the connection process. Further information: Twitch Privacy Notice

4.2 External Links

This website contains links to external third-party websites (e.g. GitHub, GitHub Sponsors, Discord, Google Play, the App Store and Ko-fi). The Store pages also contain links given by publishers (for example to their source code, their website or in their descriptions) and a link to the Creator Portal (creators.macro-deck.app), and blog posts may link to other websites. We have no influence on the data processing of those providers. Data is only transmitted to them when you actively click on the respective link. Please refer to the privacy policies of the linked sites.

4.3 Third Country Transfers

Cloudflare (section 3.1) and Twitch (section 4.1) are based in the USA, and Cloudflare may process data in data centres outside the European Union. Cloudflare is certified under the EU-U.S. Data Privacy Framework, so the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR); in addition, our data processing agreement with Cloudflare contains the standard contractual clauses of the European Commission (Art. 46 para. 2 lit. c GDPR). Twitch processes your data under its own responsibility when you use the Twitch authentication page. Servers from which a Store page loads images embedded by publishers may also be located in a third country (see section 3.5).

5. Data Security

All data is transmitted in encrypted form (HTTPS/TLS) to prevent unauthorised access. Cloudflare protects the sites against attacks and misuse.

6. Storage Duration

We do not keep our own logs of page requests. Cloudflare processes request data only as long as necessary to deliver the pages and to protect its network. The Store data store (section 3.5) contains no data about visitors; an entry is removed as soon as it is no longer in the Store. The blog's cached pages and its data store (section 3.6) contain no data about visitors either; cached pages are replaced as soon as the posts change, and the copies in the data store expire after 30 days. Cloudflare keeps the measurements of Web Analytics (section 3.3), which are only taken after your consent, complete for seven days and afterwards a sample of about one in ten for up to six months. The language cookie (section 3.2) expires one year after you last chose a language; the entries in your browser's local storage (section 3.2) stay until you change or delete them. You can delete both at any time by clearing the site data of macro-deck.app in your browser.

7. Legal Basis for Processing

The processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR). The relevant legal basis is:

• Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG – Consent (web analytics on blog posts, section 3.3)
• Art. 6 para. 1 lit. f GDPR – Legitimate interest (hosting and protection of the sites by Cloudflare, section 3.1; link service, section 3.4; Store pages, section 3.5; blog, section 3.6; Twitch authentication page, section 4.1)

The language cookie and the entries in your browser's local storage (section 3.2) are governed by § 25 para. 2 no. 2 TDDDG.

8. Obligation to Provide Data

You are not legally or contractually obliged to provide us with personal data. Without the request data your browser sends with every request (section 3.1), however, the pages cannot be delivered. Without the language cookie and the entry in local storage (section 3.2), the website opens in your browser's language and the notice in the Store appears again. Whether you consent to web analytics (section 3.3) is your free choice; without consent you can read every post without restriction.

9. Your Rights

You have the following rights with regard to your personal data:

• Access to the personal data we hold about you (Art. 15 GDPR).
• Correction of inaccurate data (Art. 16 GDPR).
• Deletion of your data (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Objection to processing based on our legitimate interests (Art. 21 GDPR), on grounds relating to your particular situation.
• Withdrawal of any consent you have given, with effect for the future (Art. 7 para. 3 GDPR).

Right to object: Where we process your data on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 para. 1 GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise these rights, contact us at legal@macro-deck.app. We may ask you to confirm your identity, for example by writing from the email address of your account or by giving your licence ID.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de/

11. Changes to This Privacy Policy

We update this privacy policy when our services or the legal requirements change. The current version is always available at macro-deck.app/privacy. Last updated: 7 November 2026.