Privacy Policy

Effective and last updated October 31, 2026

1. Who we are

Adam Proksch, trading as Adam Proksch Creative ("we", "us"), makes opentab and is the controller of the personal data described here. Contact: contact@opentab.cc. This policy covers the opentab App, the Sites (opentab.cc and policies.opentab.cc) and our support channels.

2. Data the App sends us (check-ins)

The installed App sends a check-in to https://www.opentab.cc/api/checkin when it starts and about every 30 minutes while it runs. The portable build and development builds never check in.

The App shows you your user ID and this list in Settings → General → Your info.

We use check-in data to:

• count active installs and see which versions and platforms are in use;
• provide support, including finding your copy when you contact us;
• send in-app notices;
• detect abuse; and
• enforce the Terms, including disabling a copy (see Terms §5).

Staff may also add internal notes to a device record and keep a log of support emails sent, including the recipient, subject and user ID.

To stop check-ins, use the portable build or uninstall the App. Check-ins are needed for in-app notices and support lookups on the installed build.

3. Data that stays on your device

We do not collect or receive the following. It stays in the App's data folder on your computer, and you can delete it at any time.

• browsing history, open tabs, sessions and page addresses;
• bookmarks, notes and sidebar items;
• cookies, site storage, saved site permissions and sign-ins to websites;
• settings, themes and custom background images;
• data imported from Chrome or Edge, which is copied locally on your computer and never passes through our servers;
• Spotify sign-in tokens and pinned playlists; and
• cached ad and tracker filter lists.

4. Third parties the App contacts for you

Some features connect directly from your computer to other companies. Those companies receive your IP address and the request itself, and their own privacy policies apply. We are not a party to those connections. Details are in Third-Party Services.

• Websites you visit and your chosen search engine: Google, DuckDuckGo, Brave, Bing, Ecosia or Startpage. Each receives your searches.
• Spotify, if you sign in for the music player: playback controls, now playing, search and playlists.
• Apple iTunes Search, which receives the track and artist name to find album art. Lyrics providers such as LRCLIB, where that feature is offered, receive the same.
• Ad and tracker filter list hosts, from which the App downloads lists about once a week.
• GitHub, from which the installed App checks for and downloads updates.

5. The Sites

The Sites do not use analytics, advertising or tracking cookies. When you visit, our hosting and network providers (Cloudflare and Railway) process standard request data, such as IP address, user agent, requested URL and time, to deliver and secure the Sites. The Sites load fonts from Google Fonts and a script from jsDelivr, so those services also receive your IP address and user agent. Downloads are served from GitHub.

6. Support and email

When you email us, we receive your email address, your message and anything you include, such as your user ID. We use it to reply and to keep a record of the conversation. Incoming mail is received through Cloudflare Email Routing and stored in our own mail system on Cloudflare. Outgoing mail is sent through Resend or Cloudflare Email. Staff sign-in codes are also sent by email.

7. Legal bases (EEA, UK and Switzerland)

• Legitimate interests: running, securing and improving opentab; counting installs; preventing abuse; enforcing our Terms; and keeping server logs.
• Contract: providing the App, updates and support you ask for.
• Legal obligation: responding to lawful requests and keeping records the law requires.

You may object to processing based on legitimate interests. See Section 10.

8. Sharing

We do not sell or rent personal data, and we do not share it for cross-context behavioral advertising. We share it only:

• with service providers who process it for us under contract: Cloudflare (Workers, D1 database, email, network), Resend (outgoing email) and Railway (website hosting);
• if the law, a court order or a valid legal process requires it (see Data Requests);
• to protect the rights, safety or property of users, the public or us; or
• as part of a merger, acquisition or sale of assets. If that happens, we will give you notice where required.

9. Retention

• Device records are kept while the copy is active. After 24 months with no check-ins, they are deleted automatically. A disabled copy's record is kept until it is re-enabled or deleted, so the restriction can be enforced.
• Support emails, the email log and the staff audit log (which records who disabled, re-enabled, messaged or deleted a device, and when) are deleted automatically after 3 years.
• Server and network logs are kept for the periods our providers set, usually a few days to weeks.

We may keep data longer if we need it for a legal claim, an abuse investigation or a legal obligation.

10. Your rights

Depending on where you live (for example, under the GDPR, the UK GDPR, or the CCPA/CPRA and other US state laws), you may have the right to:

• access your personal data;
• correct it;
• delete it;
• receive a portable copy;
• restrict or object to processing;
• withdraw consent; and
• not be discriminated against for using these rights.

To make a request, see Data Requests. Include your user ID so we can find your record. You can also complain to your local data protection authority.

California: in the last 12 months we collected identifiers (user ID, IP address, hashed device name), internet and device information, and approximate geolocation (country), for the purposes in Section 2. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics. Shine the Light (Civil Code §1798.83): we do not disclose personal information to third parties for their own direct marketing purposes.

11. International transfers

Our providers may process data in the United States and other countries. Where the law requires, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses included in our providers' data processing terms.

12. Security

We protect data with:

• HTTPS for all check-ins;
• access to the admin panel limited to listed staff, with time-limited sessions;
• an audit log of staff actions on device records; and
• a minimal set of collected data, with the device name hashed before it leaves your computer.

No system is perfectly secure. To report a vulnerability, see the Security Policy.

Breaches: if a personal data breach is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, where the law requires. If the risk to you is high, we will also tell you without undue delay, through an in-app notice or on this site.

13. Children

opentab is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has used the installed App, email contact@opentab.cc and we will delete the related device record.

14. Do Not Track and Global Privacy Control

We do not track you across sites, so these signals do not change how we process data. Websites you visit with opentab decide for themselves how to respond to such signals.

15. Changes

If we change this policy, we will update the date above. If a change is material, for example if we start collecting new kinds of data, we will tell you in the App or on the Sites before it takes effect.