Privacy Policy

1. Scope and Summary

This privacy policy covers the Macro Deck desktop app for Windows, macOS and Linux, including its web client that devices on your network open in a browser.

Macro Deck runs on your own computer. Your profiles, buttons, variables, devices, integration settings, logs and backups are stored locally on your computer and are not transmitted to us. The app contains no analytics, telemetry, crash reporting or advertising. It only connects to Macro Deck services and third parties for the functions described below.

For data that stays on your computer, you decide yourself what is stored; we have no access to it and are not the controller for it.

3. Macro Deck Account

Signing in with a Macro Deck account is optional. When you choose to sign in, the app starts a sign-in with our identity service at auth.macro-deck.app and opens the sign-in page in your browser. After you confirm there, the identity service returns tokens to the app.

The app stores the following on your computer: an encrypted refresh token, your account ID, display name, username, profile picture and roles. The encryption key is protected by the credential store of your operating system (Windows Credential Manager, macOS Keychain or the Secret Service on Linux). The profile picture is refreshed from the identity service about once an hour while you are signed in. The account is not included in backups.

When you sign out, the app revokes the token at the identity service and deletes the stored account data from your computer. To change or delete your account itself, use "Manage account", which opens the account console.

How the identity service processes your account data is described in the tab Accounts, Store & Creator Portal. The legal basis for the sign-in is Art. 6 para. 1 lit. b GDPR. Storing the sign-in data on your computer is strictly necessary for the function you requested (§ 25 para. 2 no. 2 TDDDG).

4. Macro Deck Store

4.1 Package list

To show which plugins, icon packs and other packages are available, the app downloads the signed Store registry from GitHub (raw.githubusercontent.com) shortly after it starts and then about once an hour. Images and package files are downloaded from store-assets.macro-deck.app, which is delivered by Cloudflare, when you open a Store page or install a package. These requests contain no account data or information about your installed packages; the providers receive your IP address and the technical details of the request. GitHub, Inc. and Cloudflare, Inc. are based in the USA. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is showing an up-to-date and verified Store.

4.2 Ratings and reviews

If you are signed in with your Macro Deck account, you can rate and review Store packages in the app. The app sends your rating, title and text to the Store together with your account token, and loads the reviews of other users. Your review is public and is shown with the display name and profile picture of your account. You can change or withdraw it at any time. Details, including moderation, are described in the tab Accounts, Store & Creator Portal. The legal basis is Art. 6 para. 1 lit. b GDPR.

5. Updates

Installed versions of the app check updater.macro-deck.app for new versions at start, when your computer wakes up and about every six hours, and download updates from there. The request contains the operating system, processor architecture and update channel as part of the address, and your IP address. You can turn automatic update checks off in the settings. On Linux systems that use the Macro Deck package repository, updates are handled by your package manager and packages.macro-deck.app. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is providing security fixes and new versions.

6. Features That Contact Third Parties

The following features contact third parties only when you set them up or use them. The providers process your data under their own responsibility.

• Weather: the location you search for and the coordinates of the locations you add are sent to Open-Meteo (open-meteo.com) to find the location and load forecasts. No personal account is used.
• USB connection for Android: when you click the download button in the ADB settings, the Android platform tools are downloaded from Google (dl.google.com).
• Integrations: integrations such as OBS Studio, Home Assistant or Streamer.bot connect to the program or device you configure. Integrations for online services connect to that service, see section 7.
• Plugins: plugins you install, including plugins from the Store, are made by third parties and can connect to other services. Please check the information of the respective creator.
• Links: links to our documentation, Discord, GitHub or donation pages open in your browser.

The legal basis for requests made on your instruction is Art. 6 para. 1 lit. b GDPR.

7. Setting Up Integrations With Online Services

Some integrations connect Macro Deck to an account of yours at an online service. To set them up, Macro Deck opens the service's website in your browser:

• Twitch: Macro Deck opens the Twitch activation page (twitch.tv), where you sign in and allow Macro Deck access to your Twitch account. Macro Deck uses its own registered Twitch application for this, unless you enter your own. Twitch then gives the access tokens directly to Macro Deck on your computer. Twitch is operated by Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA.
• Spotify and Discord: Macro Deck links to the developer dashboards of Spotify (developer.spotify.com) and Discord (discord.com/developers), where you create your own application, and then opens the sign-in page of the service, which returns you to Macro Deck on your computer. Spotify is operated by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden; Discord by Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands.

On these pages you deal directly with the respective service, which processes your data, for example your sign-in, IP address and browser data, under its own responsibility and privacy policy. The access you grant determines which data of your account Macro Deck can read and change, for example your channel information, chat, currently playing music or voice status. Macro Deck exchanges this data directly between your computer and the service, without passing it through our servers, and stores access tokens and the details of your own applications encrypted on your computer. We do not receive your account data at these services.

You can remove the access at any time by removing the integration in Macro Deck and by revoking the connection in the account settings of the service, for example under "Connections" at Twitch or "Manage apps" at Spotify. The legal basis for the connection you request is Art. 6 para. 1 lit. b GDPR.

8. Local Network and Connected Devices

Macro Deck makes your deck available to devices in your local network. Devices sign in with the username and password you set up or with a one-time pairing code. The app stores for each connected device its name, type, operating system, browser or app version, model and when it was last seen. It announces itself in the local network with the computer name and version so that devices can find it; you can turn this off in the settings. None of this data leaves your network through Macro Deck.

Browsers that open the web client store their sign-in and display settings in their local storage. This is strictly necessary for the web client (§ 25 para. 2 no. 2 TDDDG).

9. Logs and Backups

The app writes log files on your computer. Tokens, passwords and other secrets are removed from the logs automatically, and log files are deleted after 14 days. Backups are encrypted and stored where you choose. Logs and backups are only transmitted to us if you send them to us yourself, for example to report a problem; we then use them only to handle your request (Art. 6 para. 1 lit. b and f GDPR) and delete them when it is resolved.

10. Transfers to Third Countries

GitHub and Cloudflare are based in the USA. Twitch and Discord, which you use under their own responsibility when you set up the respective integration, also process data in the USA. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR); otherwise it is based on standard contractual clauses (Art. 46 para. 2 lit. c GDPR).

11. Storage Duration

Data stored on your computer stays there until you delete it, sign out or uninstall the app. Requests to our update server are logged and deleted after 30 days at the latest, unless they are needed to investigate a specific security incident.