Privacy Policy

1. Scope and Summary

This privacy policy covers the Macro Deck desktop app for Windows, macOS and Linux, including its web client that devices on your network open in a browser.

Macro Deck runs on your own computer. Your profiles, buttons, variables, devices, integration settings, logs and backups are stored locally on your computer and are not transmitted to us. The app contains no general usage analytics, crash reporting or advertising. The only usage measurement sent by the app is the limited Store download information described in section 4. It otherwise connects to Macro Deck services and third parties only for the functions described below.

For data that stays on your computer, you decide yourself what is stored; we have no access to it and are not the controller for it.

2. Controller

Responsible for data processing:

Macro Deck, Owner Manuel Mayer
Porzer Straße 142A
53859 Niederkassel
Germany

Email: legal@macro-deck.app

We are not required to appoint a data protection officer. For all data protection questions, please contact us at the address above.

3. Macro Deck Account

Signing in with a Macro Deck account is optional. When you choose to sign in, the app starts a sign-in with our identity service at auth.macro-deck.app and opens the sign-in page in your browser. After you confirm there, the identity service returns tokens to the app.

The app stores the following on your computer: an encrypted refresh token, your account ID, display name, username, profile picture and roles. The encryption key is protected by the credential store of your operating system (Windows Credential Manager, macOS Keychain or the Secret Service on Linux). The profile picture is refreshed from the identity service about once an hour while you are signed in. The account is not included in backups.

When you sign out, the app revokes the token at the identity service and deletes the stored account data from your computer. To change or delete your account itself, use "Manage account", which opens the account console.

How the identity service processes your account data is described in the tab Accounts, Store & Creator Portal. The legal basis for the sign-in is Art. 6 para. 1 lit. b GDPR. Storing the sign-in data on your computer is strictly necessary for the function you requested (§ 25 para. 2 no. 2 TDDDG).

4. Macro Deck Store

4.1 Package list

To show which plugins, icon packs and other packages are available, the app downloads the signed Store registry from GitHub (raw.githubusercontent.com) shortly after it starts and then about once an hour. Images and package files are downloaded from store-assets.macro-deck.app, which is delivered by Cloudflare, when you open a Store page or install a package. Image requests contain no account data or information about your installed packages.

Package descriptions and changelogs are written by the package's creator and can show images hosted on other websites, for example a donation badge. When you open such a Store page, the app loads these images directly from the website the creator chose. That website receives your IP address and the technical details of the request, but no referrer, account data or information about your installed packages. These websites are operated by third parties under their own responsibility and may be located outside the EU/EEA. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is showing a package page as its creator designed it.

When you open the Store page of a package whose repository is on GitHub, the app requests the package's open issues from GitHub's API (api.github.com) to show them in the Issues tab. GitHub receives your IP address and the requested repository, but no account data or information about your installed packages. The app keeps the result in memory for about 10 minutes. GitHub is operated by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is showing known problems of a package before you install it.

For a package download, the app sends a random identifier for that individual operation and whether it is an initial installation, an update or a repair. For an update or repair it also sends the currently installed version. The requested address identifies the package and target version. The operation identifier is used again only if that same download is retried or split into partial requests; it is not a permanent device identifier. No Macro Deck account ID is sent with the direct package download. Details about counting, retention and Cloudflare are described in the tab Accounts, Store & Creator Portal.

GitHub and Cloudflare receive your IP address and the technical details of the respective request. GitHub, Inc. and Cloudflare, Inc. are based in the USA. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interests are showing an up-to-date and verified Store and providing aggregate installation and update download statistics without general tracking of app usage.

4.2 Ratings and reviews

If you are signed in with your Macro Deck account, you can rate and review Store packages in the app. The app sends your rating, title and text to the Store together with your account token, and loads the reviews of other users. Your review is public and is shown with the display name and profile picture of your account. You can change or withdraw it at any time. Details, including moderation, are described in the tab Accounts, Store & Creator Portal. The legal basis is Art. 6 para. 1 lit. b GDPR.

5. Updates

Installed versions of the app check updater.macro-deck.app for new versions at start, when your computer wakes up and about every six hours, and download updates from there. The request contains the operating system, processor architecture and update channel as part of the address, and your IP address. You can turn automatic update checks off in the settings. On Linux systems that use the Macro Deck package repository, updates are handled by your package manager and packages.macro-deck.app.

Both addresses deliver files stored in Cloudflare R2 through Cloudflare's network. Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, acts as our processor under a data processing agreement and receives your IP address and the technical details of the request in order to deliver the files and protect its network. Update checks and downloads are not linked to your Macro Deck account, and we do not keep our own logs of them. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is providing security fixes and new versions.

6. Features That Contact Third Parties

The following features contact third parties only when you set them up or use them. The providers process your data under their own responsibility.

• Weather: the location you search for and the coordinates of the locations you add are sent to Open-Meteo (open-meteo.com) to find the location and load forecasts. No personal account is used.
• Steam: if you add a SteamID and a Steam Web API key to the Steam integration, both are sent to Steam (api.steampowered.com) to read your profile status, the game you are playing, your friends list with your friends' names, online status and current games, and the games you own with their playtime. Game covers are loaded from Steam's content delivery network (cdn.cloudflare.steamstatic.com), also without a key, and the profile pictures of the friends a widget shows from Steam's avatar servers (avatars.fastly.steamstatic.com or anotheravatars.*.steamstatic.com host). You create the key yourself on the Steam website, and Macro Deck stores it encrypted on your computer. The data goes directly between your computer and Steam, which is operated by Valve Corporation, PO Box 1688, Bellevue, WA 98009, USA.
• Email (IMAP): if you add an email account to the Email (IMAP) integration, Macro Deck signs in to the mail server you enter or pick from the provider list (for example Gmail, iCloud Mail, GMX or WEB.DE) with the username and password or app password you enter, always over an encrypted connection. It reads the number of messages and unread messages and, for the newest messages, the sender, subject, a short preview, the date and the read status, to show them on your deck and to start your automations. It does not change, move or delete messages and does not store message contents; the server address, username and account name are stored on your computer, the password encrypted. Messages contain data of other people, such as senders; Macro Deck shows them only on your own devices. The data goes directly between your computer and your email provider, which processes it under its own responsibility and privacy policy.
• USB connection for Android: when you click the download button in the ADB settings, the Android platform tools are downloaded from Google (dl.google.com).
• Integrations: integrations such as OBS Studio, Home Assistant or Streamer.bot connect to the program or device you configure. Integrations for online services connect to that service, see section 7.
• Plugins: plugins you install, including plugins from the Store, are made by third parties and can connect to other services. Please check the information of the respective creator.
• Links: links to our documentation, Discord, GitHub or donation pages open in your browser.

The legal basis for requests made on your instruction is Art. 6 para. 1 lit. b GDPR.

7. Setting Up Integrations With Online Services

Some integrations connect Macro Deck to an account of yours at an online service. To set them up, Macro Deck opens the service's website in your browser:

• Twitch: Macro Deck opens the Twitch activation page (twitch.tv), where you sign in and allow Macro Deck access to your Twitch account. Macro Deck uses its own registered Twitch application for this, unless you enter your own. Twitch then gives the access tokens directly to Macro Deck on your computer. Twitch is operated by Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA.
• Spotify and Discord: Macro Deck links to the developer dashboards of Spotify (developer.spotify.com) and Discord (discord.com/developers), where you create your own application, and then opens the sign-in page of the service, which returns you to Macro Deck on your computer. Spotify is operated by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden; Discord by Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands.
• YouTube and Google Calendar: Macro Deck links to the Google Cloud Console (console.cloud.google.com), where you create your own OAuth client, and then opens Google's sign-in page. For YouTube you confirm there a code that Macro Deck shows you; for Google Calendar, Google then returns you to Macro Deck on your computer. The YouTube integration uses the YouTube API Services; see the Google Privacy Policy (policies.google.com/privacy) and the YouTube Terms of Service (youtube.com/t/terms). For users in the EEA and Switzerland, Google's services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Outlook and Microsoft 365: Macro Deck opens Microsoft's sign-in page (login.microsoftonline.com), where you sign in with your Microsoft account or your work or school account and allow Macro Deck to read your calendars. Macro Deck uses its own registered Microsoft application for this, unless you enter your own. Microsoft then returns you to Macro Deck on your computer. For users in the EEA, Microsoft's services are provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

On these pages you deal directly with the respective service, which processes your data, for example your sign-in, IP address and browser data, under its own responsibility and privacy policy. The access you grant determines which data of your account Macro Deck can read and change, for example your channel information, chat, calendar events, currently playing music or voice status. Live chat and calendar events can contain data of other people, such as chat authors, attendees and organisers; Macro Deck shows these only on your own devices. Macro Deck exchanges this data directly between your computer and the service, without passing it through our servers, and stores access tokens and the details of your own applications encrypted on your computer. We do not receive your account data at these services.

You can remove the access at any time by removing the integration in Macro Deck and by revoking the connection in the account settings of the service, for example under "Connections" at Twitch, "Manage apps" at Spotify, "Third-party apps and services" in your Google account or the app permissions of your Microsoft account. The legal basis for the connection you request is Art. 6 para. 1 lit. b GDPR.

8. Local Network and Connected Devices

Macro Deck makes your deck available to devices in your local network. Devices sign in with the username and password you set up or with a one-time pairing code. The app stores for each connected device its name, type, operating system, browser or app version, model and when it was last seen. It announces itself in the local network with the computer name and version so that devices can find it; you can turn this off in the settings. None of this data leaves your network through Macro Deck.

Browsers that open the web client store their sign-in and display settings in their local storage. This is strictly necessary for the web client (§ 25 para. 2 no. 2 TDDDG).

9. Logs and Backups

The app writes log files on your computer. Tokens, passwords and other secrets are removed from the logs automatically, and log files are deleted after 14 days. Backups are encrypted and stored where you choose. Logs and backups are only transmitted to us if you send them to us yourself, for example to report a problem; we then use them only to handle your request (Art. 6 para. 1 lit. b and f GDPR) and delete them when it is resolved.

10. Transfers to Third Countries

GitHub and Cloudflare are based in the USA. Twitch, Discord, Google, Microsoft and Valve (Steam), which you use under their own responsibility when you set up the respective integration, also process data in the USA. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR); otherwise it is based on standard contractual clauses (Art. 46 para. 2 lit. c GDPR). Your email provider, if you add an email account, may also process data outside the EU/EEA; please check its privacy policy.

Images that a package's creator embeds in a Store page are loaded from the website the creator chose, which may be located in a third country.

11. Storage Duration

Data stored on your computer stays there until you delete it, sign out or uninstall the app. Cloudflare processes update requests only as long as necessary to deliver the files and protect its network; we do not keep logs of them. The retention of Store download information is described in the tab Accounts, Store & Creator Portal.

12. Your Rights

You have the following rights with regard to your personal data:

• Access to the personal data we hold about you (Art. 15 GDPR).
• Correction of inaccurate data (Art. 16 GDPR).
• Deletion of your data (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Objection to processing based on our legitimate interests (Art. 21 GDPR), on grounds relating to your particular situation.

To exercise these rights, contact us at legal@macro-deck.app. We may ask you to confirm your identity, for example by writing from the email address of your account or by giving your licence ID.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de/

14. Changes to This Privacy Policy

We update this privacy policy when our services or the legal requirements change. The current version is always available at macro-deck.app/privacy/desktop. Last updated: 16 October 2026.