Privacy Policy

1. Privacy at a Glance

This privacy policy refers to the Macro Deck website (macro-deck.app) and the Macro Deck documentation (docs.macro-deck.app), as well as the Macro Deck link service (open.macro-deck.app). The website serves to provide information about the Macro Deck software and to offer it for download; the documentation explains how to install and use Macro Deck and how to develop plugins for it; the link service opens a shared link in the Macro Deck desktop app (see section 3.4). The Store pages of the website (macro-deck.app/store) show the plugins and icon packs from the Macro Deck Store (see section 3.5), and the blog of the website (macro-deck.app/blog) has news and articles about Macro Deck (see section 3.6). Personal data is processed only to a minimal extent.

All of these sites contain no analytics or tracking services. The only cookie is set by the website, and only when you choose a language in its menu, to remember that choice (see section 3.2). Only the Store pages use your browser's local storage, and only when you dismiss a notice there yourself (see section 3.2). Your browser only connects to our own domains; content from other services, such as the GitHub and Discord figures on the website, is fetched by our servers and does not reveal your IP address to those services. The Macro Deck accounts, the Creator Portal and the Store in the desktop app (such as installing, rating and reporting entries), the desktop app itself and the companion app are covered by their own privacy policies, which you can open with the tabs above.

2. Controller

Responsible for data processing:

Macro Deck, Owner Manuel Mayer
Porzer Straße 142A
53859 Niederkassel
Germany

Email: legal@macro-deck.app

3. Data Collection on the Website

3.1 Hosting by Cloudflare

The website, the documentation and the link service are hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages from its worldwide network and protects them against attacks and misuse. For every request, Cloudflare processes:

• IP address of the requesting device
• Date and time of the request
• Requested address
• Browser type and version and the operating system used
• Referrer URL (the previously visited page)

Cloudflare acts as our processor under a data processing agreement (Art. 28 GDPR). Browsers may also send reports about failed connections to Cloudflare (Network Error Logging), which contain the same kind of technical data. We use these data solely for technical purposes, in particular to ensure the stability and security of the sites, and do not merge them with other data sources. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in the technical provision and security of the website).

Requests to the few website addresses under /api/ are handled by a program on Cloudflare's network (a Cloudflare Worker), which provides the brand assets list, the GitHub figures, the Discord member count and the Store data (see sections 3.5 and 4). The same Worker serves the Store page of an entry under its address (/store/…) and writes the entry's name, short description and preview image into the page, and it creates the pages of the blog and the newest posts on the home page (see section 3.6). When you open an English page that is also available in other languages without coming from another page of this website, the Worker forwards you to the page in the language you last chose in the website's menu (the cookie described in section 3.2) or, if you have not chosen one, in the language your browser asks for in the language settings it sends (Accept-Language), if there is such a page. It does not store this information, and the Worker does not keep logs.

3.2 Cookies and Local Storage

The documentation and the link service do not set any cookies. This website sets a single cookie, and only when you choose a language in its menu: the cookie site-language with the code of that language (for examplede) as its value; the page also sends the chosen language to our Worker (see section 3.1), which sets the same cookie. With it, the website opens in that language on your next visits (see section 3.1). The cookie contains no information about you, is sent only to macro-deck.app, expires one year after your last choice and is replaced whenever you choose another language. Nothing is stored unless you choose a language. None of these sites use your browser's session storage.

Only the Store pages use your browser's local storage, for a single entry: when you dismiss the "Made by the community" notice with "Got it", the page stores the value 1 under the keystore-community-notice-dismissed, so that the notice does not appear again on your next visits. The entry contains no information about you, is not transmitted to us or anyone else and stays until you delete the site data of macro-deck.app in your browser. Nothing is stored unless you click.

This cookie and this storage are strictly necessary to provide the functions you explicitly asked for, keeping your language and keeping the notice hidden (§ 25 para. 2 no. 2 TDDDG). They do not require consent, and there is therefore no consent banner.

3.3 Web Analytics

This website, the documentation and the link service do not use any web analytics or tracking services. Your usage behaviour is not analysed and no usage profiles are created.

3.4 Link Service (open.macro-deck.app)

Macro Deck can be opened with links that start with macrodeck://. Many apps, such as Discord, do not turn these into clickable links, so such links are shared as normal web links on open.macro-deck.app. The link service turns the address back into the matching macrodeck:// link and offers it to your device, so that the Macro Deck desktop app opens the corresponding page. For example,https://open.macro-deck.app/settings opens macrodeck://settings.

When you open such a link, your browser requests the page from a Cloudflare Worker on Cloudflare's network (see section 3.1). The address you open, including its path and parameters (for example the ID of a Store package), is part of that request, and Cloudflare processes it together with the data listed in section 3.1. The Worker builds the page from this address only. It does not store the address, does not keep logs, does not contact other services and does not set cookies. A small script on the page runs in your browser and tries to open themacrodeck:// link; the address is not sent anywhere by it. Whether and how the Macro Deck app opens is decided on your own device, and your browser may ask you first. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in providing links that open Macro Deck).

If you share such a link in Discord or another messaging service, that service may retrieve the page itself, for example to show a preview. This happens under that provider's own responsibility, and we have no influence on it.

3.5 Store (macro-deck.app/store)

The Store pages show the plugins and icon packs published in the Macro Deck Store. Our Cloudflare Worker (see section 3.1) fetches these data regularly, about every 30 minutes and independently of page requests: the entries themselves from the public Macro-Deck-Store-Registry repository on GitHub (codeload.github.com), and the average rating, the number of ratings and the number of installs per entry from the Macro Deck Platform (api.macro-deck.app). It keeps them in a Cloudflare data store (Workers KV) and creates preview images for link previews from icons in SVG format. These requests contain no data about you; the pages only read from this store.

The entries contain the information their publishers released through the Creator Portal, including the publisher's name, descriptions, images and links. How we process this information is described in the platform privacy policy.

Your browser loads icons, screenshots and package files directly from store-assets.macro-deck.app, which is also delivered by Cloudflare (see section 3.1). A package file is only downloaded when you choose "Download". Such a download is counted for the creators' statistics, at most once per day and package version using a salted hash of the IP address, package version and day; the details are in section 4.1 of the platform privacy policy. Images that publishers embed in their descriptions and that are stored on other servers are not loaded by the page.

Search, filters and sorting are processed by your browser itself. They are part of the page's address, so they are only transmitted to Cloudflare when you reload the page or share the address (see section 3.1). "Open in Macro Deck" passes a macrodeck:// link to your device without sending any data; if you open the link in a new tab or share it instead, section 3.4 applies. "Copy link" only places the entry's address on your clipboard.

If you share the address of an entry in Discord, a social network or another messaging service, that service may retrieve the page and its preview image itself to show a preview. This happens under that provider's own responsibility, and we have no influence on it. The legal basis for the processing on the Store pages is Art. 6 para. 1 lit. f GDPR (legitimate interest in making the content of the Macro Deck Store accessible outside the app as well).

3.6 Blog (macro-deck.app/blog)

The blog shows the posts we publish, and the home page shows the newest of them. Our Cloudflare Worker (see section 3.1) creates these pages on Cloudflare's network from the posts published on the Macro Deck Platform (api.macro-deck.app). It asks the Platform for them only when a page has to be created anew, and these requests contain no data about you. To deliver the pages quickly and while the Platform cannot be reached, the Worker keeps the created pages in Cloudflare's cache and the last posts it received in a Cloudflare data store (Workers KV). Neither contains data about visitors.

Your browser loads the images of the posts from store-assets.macro-deck.app, which is also delivered by Cloudflare (see section 3.1). Each post names its author with the username and profile picture of their Macro Deck account; the Worker fetches the picture from our sign-in service (auth.macro-deck.app) and your browser loads it from macro-deck.app, so it does not connect to the sign-in service. The blog shows no images from other servers. Apart from the language cookie (see section 3.2), the blog sets no cookies, uses no local storage and contains no comments, reactions or other functions that would require your data. Links in the posts to other websites open in a new tab and do not tell those websites from which page you came (see section 4.2). The blog can also be read as an RSS feed (macro-deck.app/blog/rss.xml); a feed reader you use for it retrieves the feed under its own responsibility.

If you share the address of a post in Discord, a social network or another messaging service, that service may retrieve the page and its preview image itself to show a preview. This happens under that provider's own responsibility, and we have no influence on it. The legal basis for the processing on the blog pages is Art. 6 para. 1 lit. f GDPR (legitimate interest in informing about Macro Deck).

4. External Services and Content

Some parts of the website show information from other services. Our Cloudflare Worker (see section 3.1) fetches this information itself and passes it on to your browser, so these services only receive requests from Cloudflare and never your IP address or other data about you:

• GitHub: the star count of the Macro Deck repository and the download link and version of the latest Macro Deck 2 release, from the GitHub API (api.github.com), and the entries of the Macro Deck Store from the Macro-Deck-Store-Registry repository (codeload.github.com, see section 3.5).
• Macro Deck Platform: ratings and install counts of the Store entries, without information about individual people, and the published blog posts (api.macro-deck.app, see sections 3.5 and 3.6).
• Discord: the member count of our Discord server, from the public Discord invite API (discord.com).
• Macro Deck assets: the list of brand assets on the branding page, from assets.macro-deck.app. The logo previews on that page are loaded by your browser from assets.macro-deck.app directly, which is also delivered by Cloudflare (see section 3.1).

4.1 Twitch (only on the Twitch authentication page)

The page /twitchauth is used exclusively to connect a Twitch account with the Macro Deck Twitch plugin. When this page is called up, connections are established to services of Twitch (Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA, a subsidiary of Amazon). The authorisation is carried out via the official Twitch OAuth procedure; the resulting access token is processed in your browser and is not stored by us. This page is only called up when you actively start the connection process. Further information: Twitch Privacy Notice

4.2 External Links

This website contains links to external third-party websites (e.g. GitHub, GitHub Sponsors, Discord, Google Play, the App Store and Ko-fi). The Store pages also contain links given by publishers (for example to their source code, their website or in their descriptions) and a link to the Creator Portal (creators.macro-deck.app), and blog posts may link to other websites. We have no influence on the data processing of those providers. Data is only transmitted to them when you actively click on the respective link. Please refer to the privacy policies of the linked sites.

4.3 Third Country Transfers

Cloudflare (section 3.1) and Twitch (section 4.1) are based in the USA, and Cloudflare may process data in data centres outside the European Union. Cloudflare is certified under the EU-U.S. Data Privacy Framework, so the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR); in addition, our data processing agreement with Cloudflare contains the standard contractual clauses of the European Commission (Art. 46 para. 2 lit. c GDPR). Twitch processes your data under its own responsibility when you use the Twitch authentication page.

5. Data Security

All data is transmitted in encrypted form (HTTPS/TLS) to prevent unauthorised access. Cloudflare protects the sites against attacks and misuse.

6. Storage Duration

We do not keep our own logs of page requests. Cloudflare processes request data only as long as necessary to deliver the pages and to protect its network. The Store data store (section 3.5) contains no data about visitors; an entry is removed as soon as it is no longer in the Store. The blog's cached pages and its data store (section 3.6) contain no data about visitors either; cached pages are replaced as soon as the posts change, and the copies in the data store expire after 30 days. The entry in your browser's local storage (section 3.2) stays until you delete it.

7. Legal Basis for Processing

The processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR). The relevant legal basis is:

• Art. 6 para. 1 lit. f GDPR – Legitimate interest (hosting and protection of the sites by Cloudflare, section 3.1; link service, section 3.4; Store pages, section 3.5; blog, section 3.6; Twitch authentication page, section 4.1)

Storing in your browser's local storage (section 3.2) is governed by § 25 para. 2 no. 2 TDDDG.

8. Rights of Data Subjects

You have the right to:

• Request information about the stored personal data (Art. 15 GDPR).
• Request correction of inaccurate data (Art. 16 GDPR).
• Request deletion of your data (Art. 17 GDPR).
• Request restriction of processing (Art. 18 GDPR).
• Object to data processing (Art. 21 GDPR).
• Lodge a complaint with a data protection supervisory authority.

To exercise these rights, please contact us using the contact details given under 2.

9. Contacting the Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you can contact the competent data protection authority:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestraße 2-4
40213 Düsseldorf
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de/

10. Changes to This Privacy Policy

We reserve the right to update this privacy policy if necessary. The current version is always available on this website. Last updated: 17 October 2026.