Skarn privacy policy

Who we are

The controller of the data described here is Red Black Tree d.o.o., Cacak, Republic of Serbia, the maker of Skarn. Red Black Tree intends to incorporate Skarn OU in Estonia and to assign the Skarn business, including this data, to it. Contact us about privacy at [email protected].

The scanner sends nothing

Skarn is a local scanner. When it runs, no session content, no findings, no file paths, no secrets, and no telemetry leave the machine; at scan time the binary makes no network call at all. The license is an Ed25519-signed file verified offline against a key embedded in the binary, so running Skarn is not a data transfer to us. This policy is only about the website registration and purchase processes.

What we collect when you register or purchase

To issue a Free License, the registration form at getskarn.com/free/ collects:

• the company or team name you enter;
• the work email address you enter;
• the number of developers you enter;
• whether you ticked the optional marketing-consent box;
• the IP address the request arrives from;
• the Cloudflare Turnstile token your browser submits with the form.

To purchase a Paid License (Team or Enterprise), our third-party checkout provider and merchant of record, Paddle, collects and processes on our behalf:

• your full name and work email address;
• your company name, registered business address, and VAT identification number;
• your payment details (processed securely by Paddle; we never see or store your full credit card or bank details);
• the IP address and country location to verify tax and VAT compliance.

We do not build a profile of you beyond these fields and the license we issue against them.

Why we collect it, and the lawful basis

For Free Licenses, we use the company name, email address, and developer count to issue the license and to support it. The lawful basis is the performance of the license agreement you enter when you register (GDPR Article 6(1)(b)).

For Paid Licenses, we use your purchase details, email, and company information to generate your commercial License Token, deliver the Software, provide customer support, and manage your billing. The lawful basis is the performance of our contract with you (GDPR Article 6(1)(b)) and compliance with our legal, accounting, and tax obligations (GDPR Article 6(1)(c)).

We use the request IP address and the Turnstile token to confirm the request is genuine and to prevent abuse of our endpoints. The lawful basis is our legitimate interest in keeping our endpoints secure (GDPR Article 6(1)(f)).

Marketing email is separate and optional

The registration and purchase forms may carry an unticked checkbox that opts you into occasional email from Skarn: new detection coverage, releases, and security research. It is not a condition of license issuance. We record your choice only so we can honor it. The lawful basis for that email is your explicit consent in accordance with GDPR Article 6(1)(a) and Article 13 of the ePrivacy Directive 2002/58/EC. You can withdraw it at any time, independently of your license, using the one-click unsubscribe in every message we send. Withdrawing consent does not affect your license.

Website analytics without cookies

We measure use of getskarn.com with Matomo, an analytics platform we host ourselves; your visit data is not sent to any third-party analytics service. The measurement is cookieless, IP-anonymized audience measurement: it sets no cookies, uses no cross-site identifiers, is designed to store no name, email address, or account identifier, and the last two bytes of your IP address are discarded before anything is stored. If your browser sends the Do Not Track signal, no analytics beacon is sent at all.

We use these statistics for two purposes: to understand which pages and channels lead people to install Skarn and register licenses, and to detect errors on our own pages (the tracker reports JavaScript errors and content-security violations, with no page content attached). The lawful basis is our legitimate interest in measuring and improving our own website (GDPR Article 6(1)(f)).

Raw visitor logs are automatically deleted after 180 days, and backup copies age out within a further month. Aggregated statistics, such as monthly page-view counts, are retained; they contain no personal data.

How long we keep it

We do not retain your data longer than necessary for the purposes for which it was collected:

• We keep your free license registration details (company name, email, developer count) for the active duration of your free license and for a period of 2 years after the license expires or is deactivated, in order to facilitate renewals and handle related support inquiries.
• We keep billing, invoice, and transactional data related to Paid Licenses for a minimum period of 10 years to comply with statutory accounting, tax, and corporate record-keeping laws in Serbia and the EU.
• We keep website security logs, including your IP address and Turnstile metadata, for a strict period of 30 days from the date of the request, after which they are automatically deleted, unless required longer to investigate a specific security incident.
• We keep your marketing consent record until you withdraw your consent. Once you unsubscribe, we immediately cease sending you marketing emails, but we will retain a record of your opt-out for a period of 5 years solely to ensure we respect your choice and to demonstrate our compliance with applicable anti-spam laws.

Who processes it

We keep the number of parties in the path small, and every one of them processes the data on our instructions:

• Cloudflare, which hosts the site and runs our registration and processing endpoints;
• SMTP2GO, which delivers the transaction, confirmation, and license retrieval emails;
• Matomo, self-hosted by us, for privacy-respecting website analytics;
• Paddle, our merchant of record, which handles paid checkouts, VAT/tax calculation, payment processing, and financial record retention.

We do not sell your data, and we do not share it for anyone else's advertising.

International data transfers

Because the Licensor is located in the Republic of Serbia, and some of our service providers operate globally, your data may be transferred to and processed in countries outside the European Economic Area (EEA). Whenever we transfer your personal data outside the EEA, we ensure a similar degree of protection is afforded to it by ensuring that we implement appropriate safeguards, such as the European Commission approved Standard Contractual Clauses (SCCs), or by relying on adequacy decisions where applicable.

Your rights

Subject to applicable law, you can ask us to give you a copy of your data, correct it, erase it, restrict or object to our use of it, or provide it in a portable form; and you can withdraw marketing consent at any time. In particular, you have the right to object at any time to the processing of your personal data for direct marketing purposes under Article 21 of the GDPR. To exercise any of these rights, email [email protected]. If you believe we have handled your data wrongly, you also have the right under Article 77 of the GDPR to lodge a complaint with a data-protection supervisory authority in the EU or EEA country where you live or work.

Changes to this policy

If we change what we collect, why, or who processes it, we update this page and change the date at the top. Material changes that affect a basis we rely on will be described here rather than made silently.