Privacy

Who is responsible

Digital Network Design owns and publishes ADHD Minds Studio. Digital Network Design is the data controller for personal data handled in the studio's own storefront, support, protected-access systems, and newsletter list.

Lemon Squeezy is the merchant of record for purchases and is separately responsible for the checkout, payment, tax, fraud, receipt, refund, and chargeback data it processes under its own buyer terms and privacy notice.

App notes and local backups

Notes, choices, plans, and other content entered in a downloaded app or protected PWA stay in that browser or app copy. They are not automatically sent to Digital Network Design, added to an online account, or synced between devices.

Export and import controls, when present, let you create and restore a local backup. You choose where an exported backup is stored. Browser storage can be cleared by browser or device changes, so keep a current backup when your notes matter to you.

Please do not send private app notes, backup files, passwords, or a full license key in a support or privacy email.

Orders and protected access

Lemon Squeezy collects the checkout and payment details needed to complete an order. Digital Network Design receives the order, product, license, payment status, and refund information needed to deliver the product, provide access, answer order questions, and revoke access after a full refund or license-status change.

To activate protected PWA access, you enter the receipt email and Lemon Squeezy license key. The access service creates keyed, non-readable hashes of the email and license key. Cloudflare D1 stores those hashes, not the plain email or full license key, together with order and entitlement identifiers, access status, and relevant timestamps.

A random browser installation ID is created in that browser and linked to the entitlement so the setup limit can be applied. The service also uses secure, strictly necessary session cookies. It does not use a hardware fingerprint, and app notes are never included in access checks.

Why we use this data

We use order and access data to perform the purchase contract, deliver the ZIP, activate the included protected PWA, apply browser-setup limits, keep sessions secure, provide support, and process refunds or revocations.

We use limited operational records for our legitimate interests in preventing duplicate processing, protecting the service, investigating misuse, and keeping purchase and access systems reliable. We may also keep records when required to meet legal, accounting, dispute, or fraud-prevention obligations.

We use your consent to send the optional newsletter and to run optional website measurement. These are separate choices. You can withdraw either choice without affecting your purchase or protected app access.

Service providers

We use the following providers only for the functions described. Their own terms and privacy notices also apply to the data they handle, and processing may take place in countries where they or their approved service providers operate.

• Lemon Squeezy acts as merchant of record and processes checkout, payment, tax, order, receipt, download, refund, chargeback, fraud, and license information.
• Cloudflare hosts the storefront and protected-access service, provides network and security functions, stores access and operational records in D1, and receives limited operational events in Analytics Engine. When optional website measurement is configured and you allow it, Cloudflare also receives the limited website events described below.
• Zoho Mail processes messages and the routing information needed for product support, order help, general enquiries, and privacy correspondence.
• Kit hosts the optional newsletter signup form and processes subscriber data on our behalf to confirm subscriptions, deliver newsletters, manage unsubscribe requests, and report delivery and engagement. Kit's Data Processing Addendum describes that processing; its Privacy Policy covers data it handles for its own services. Kit is based in the United States, and processing may take place there or in other countries where its service providers operate.

Optional website measurement

When configured, optional website measurement starts only after you choose Allow measurement in Privacy choices near the site footer. If measurement is not configured, it stays off. You can choose Keep off at any time. Global Privacy Control and Do Not Track browser settings take priority over an allow choice.

With your permission, we count page visits, product views, video plays, and sales-link clicks. The events use limited fields such as a page category, product or offer identifier, and broad referral category. They do not include an email address, license key, app notes, a visitor ID, full page or referrer URLs, or query strings. Network requests still reach Cloudflare, which may process technical connection information for hosting and security.

Your choice is stored in this browser for up to 180 days when browser storage is available. If it is unavailable, the choice lasts only on the current page. Optional measurement stays off when JavaScript is disabled. We do not use these events to build a cross-session profile or for targeted advertising, and we do not sell personal data.

Operational events and necessary cookies

The protected-access service records only server-confirmed purchase, refund, and protected-access activation events in Cloudflare Analytics Engine. Purchase and refund events are deduplicated by order, and activation events are deduplicated by entitlement, for 120 days. Those events use fixed fields such as the event name, offer type, product or bundle ID, environment, and the relevant refund or access category. They do not contain an email, license key, order number, IP address, user-agent value, free text, app notes, or URL query string.

Secure, strictly necessary cookies keep a protected PWA session signed in and protect requests. These functions are separate from optional website measurement and newsletter signup. The storefront does not use advertising pixels or tracking cookies for optional website measurement.

Optional newsletter

Our newsletter offers practical tips, app news, and occasional offers from ADHD Minds Studio. The signup link opens a form hosted by Kit that asks only for your email address. Submitting the form requests a confirmation email; you join the newsletter list only after confirming. A purchase, receipt, activation, or support message does not subscribe you to marketing.

Kit processes the subscriber email address, signup and confirmation records, delivery information, and unsubscribe status. It may also process newsletter-open and link-click information, and technical information from its hosted pages, under the applicable Kit notices and processing terms. Newsletter and hosted-page measurement is separate from website measurement: the website Privacy choices control does not change Kit's newsletter or hosted-page settings.

You can withdraw newsletter consent using Unsubscribe in any newsletter or by contacting us. Unsubscribing stops marketing emails without affecting receipts, downloads, support, or protected app access. Joining our list does not subscribe you to another creator's newsletter, and Creator Network recommendations are turned off for this signup.

Read the Email Preferences page for the signup process, unsubscribe help, and links to Kit's Privacy Policy and Data Processing Addendum. You can contact the privacy address below for information about processing locations, applicable transfer safeguards, or your data rights.

How long data is kept

Local app notes remain in the browser until you delete them or the browser, device, or storage settings remove them. Exported backups remain wherever you choose to save them.

A protected-access session can last up to 180 days and can end earlier if you sign out, access is revoked, or a security reset is required. Expired session records are removed by scheduled cleanup. A protected tool's offline access check lasts up to 30 days after a successful online check. That 30-day period does not expire or renew the one-time purchase.

Completed webhook records and D1 server-analytics deduplication receipts are retained for 120 days and then removed by scheduled cleanup. The limited event data written to Cloudflare Analytics Engine is retained for three months.

Hashed email and license data, entitlement and order records, installation records, status, and access timestamps are kept while needed to provide the purchased access and to handle support, refunds, disputes, security, and legal obligations. They are deleted or anonymized when they are no longer needed for those purposes. Zoho support messages are kept only as long as reasonably needed to answer the request and meet related legal or operational obligations. Lemon Squeezy applies its own retention periods to the order data it controls.

Newsletter records are kept while needed to maintain the subscription, provide delivery and engagement information, document consent, and honor unsubscribe requests. Unsubscribing does not automatically delete historical records. We may retain a limited record of an unsubscribe or complaint to avoid sending unwanted emails; contact us to request deletion or information about the records that remain.

Your choices and privacy rights

Depending on the law that applies, you may ask to access, correct, delete, restrict, or receive a portable copy of personal data we control, or object to certain processing. You may also complain to the data protection authority available in your country or region.

Email the privacy contact below to make a request. We may ask for the minimum information needed to verify that the request belongs to you. Some information may need to remain while protected access is active or where retention is required for tax, legal, security, fraud, or dispute purposes. Requests about checkout or payment data controlled by Lemon Squeezy should also be directed to Lemon Squeezy.

Privacy requests and questions: [email protected]

Changes to this notice

We may update this notice when the service, providers, or legal requirements change. The effective date at the top will show the current version. Material changes will be explained before new processing begins where required by law.