What we store,
and what we do not

Who is responsible for your data

The data controller is Michał Zaborowski, a sole trader registered in Poland under the business name whitecode Michał Zaborowski, ul. Kazimierza Morawskiego 5/14, 30-102 Kraków, Poland, NIP 6612315577. For anything in this document, write to contact@trichromalab.com — a person reads it.

The short version

• Your images never leave your computer. The application does all of its work locally. It does not upload photographs, scans, previews, file names or folder paths, and it has no analytics or crash reporting.
• The application does not need an account. A trial needs no email address and no card.
• An account exists only for the forum — for writing there, and for nothing else.
• Two cookies, both strictly necessary, both on the forum only. No advertising, no analytics, no tracking, and therefore no cookie banner.

1. The application and your licence

To check that a licence or trial is valid, the application talks to api.trichromalab.com. This is what it sends, and nothing else:

Machine identifier

A SHA-256 hash derived from your operating system's own installation identifier (the IOPlatformUUID on macOS, MachineGuid on Windows, /etc/machine-id on Linux) — or, if the system will not answer, a random value generated once and stored on your machine. We store the hash, never the underlying value. It lets one licence run on a fixed number of machines and stops one trial being taken repeatedly. It is not a hardware fingerprint and does not identify you by name. Purpose: performing the contract (Art. 6(1)(b) GDPR) and preventing abuse of the free trial (Art. 6(1)(f)).

Number of rolls processed

A single counter, so a trial can end after fifteen rolls. It carries nothing about the rolls themselves. Purpose: Art. 6(1)(b).

Your IP address, hashed

When a new trial is registered we count registrations per network to stop automated farming. The address is hashed with SHA-256 before it is stored, and the raw address is never written down. Counters older than the current window are deleted. Purpose: Art. 6(1)(f), our interest in not giving the product away to a script.

Licence details, if you have bought one

Licence key and identifier, tier, status, expiry, and the email address and name given at purchase. Purpose: Art. 6(1)(b), and Art. 6(1)(c) for the retention that tax law requires.

⛔ The application sends no image data of any kind — not a photograph, not a thumbnail, not a histogram, not a file name.

2. Buying a licence

Purchases are handled by Lemon Squeezy, which is the merchant of record: they are the seller, they take the payment and they handle VAT. We never see or store your card details. Lemon Squeezy passes us your email address, your name and an order reference so that we can issue and support your licence. Their own privacy policy governs what they do with the payment data, and it is worth reading: lemonsqueezy.com/privacy.

3. The forum

The forum at forum.trichromalab.com is optional. Reading it needs no account. Writing does.

Email address

The whole of your account. There is no password — signing in sends a one-time link, valid for fifteen minutes and usable once. If you own a licence bought with the same address, your posts carry a "Licence" badge, which you can switch off in your settings. Purpose: Art. 6(1)(b).

Your username, and optionally a name and a short bio

Public, and shown next to everything you write.

What you post

Public and indexed by search engines. That is the point of the forum: a question answered once should be findable by the next person with the same problem.

Images you upload

⚠️ Stored exactly as you send them, including their EXIF metadata — camera, lens, settings, date and, if your camera recorded it, GPS coordinates. We do not strip it, and we tell you so beside the upload field rather than quietly changing your file. If a frame was shot somewhere you would rather not publish, remove its metadata before uploading. Images are public.

Your IP address, hashed

Counted per network on sign-in attempts, to limit how often a link can be requested. Hashed with SHA-256, never stored raw, and deleted after two days. Purpose: Art. 6(1)(f).

4. Cookies

The marketing site you are reading sets no cookies at all and loads nothing from a third party. There is no banner because there is nothing to consent to.

The forum sets two, and both are strictly necessary — they exist only to keep you signed in to a service you asked for, which is why no consent is required for them under the ePrivacy rules:

__Host-tlf

Your sign-in session. Contains a random token and nothing about you. Expires after 90 days, or immediately when you sign out.

__Host-tlp

Held for fifteen minutes between proving your email address and choosing a username, then discarded.

The sign-in page — and only that page — loads Cloudflare Turnstile, which tells a person from a script without the puzzles and without profiling you across sites. It may set its own short-lived cookie to remember that you passed. Nothing else on either site loads third-party code.

5. Who else touches this data

• Cloudflare — hosting, the database, image storage and the sign-in emails. Everything described above runs on their infrastructure.
• Lemon Squeezy — payments, as described in section 2.

Both operate internationally, so data may be processed outside the European Economic Area under the European Commission's standard contractual clauses. We do not sell data, we do not share it for advertising, and we make no automated decisions about you.

6. How long we keep it

Sign-in sessions

90 days at most; expired ones are deleted nightly.

Sign-in links

15 minutes.

Rate-limit counters

2 days.

Trial records

Kept while the anti-abuse purpose lasts. A trial deleted on request could simply be taken again, which is the one thing the record exists to prevent.

Licences

For the life of the licence, and afterwards for as long as tax and accounting law requires.

Forum posts

Until you or a moderator delete them.

7. What you can ask for

Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to you in a portable format. Write to contact@trichromalab.com and we will answer within one month.

Two honest limits. Deleting your forum account removes your address, username and profile; posts written in a conversation may be kept with the author shown as deleted, because removing one side of a thread destroys the answers other people wrote — tell us if you want the posts gone too and we will remove them. And a trial record is kept as described above.

If you think we have handled your data badly you can complain to your national data protection authority. In Poland that is the Urząd Ochrony Danych Osobowych.

8. Children

This is a tool for photographers and is not directed at children under 16. We do not knowingly collect their data.

9. Changes

If this document changes we update the date at the top. If a change matters — a new recipient, a new purpose — we will say so on the forum rather than hope you re-read the page.

See also the terms of use.