Last updated: June 2026. This Privacy Policy explains how Holdfast ("we", "us", "our") collects, uses, and protects your information when you use our service at holdfast.tools.
What we collect
We collect minimal information necessary to provide our service:
- Email address, collected at checkout via Stripe, used to deliver your licence key
- Payment information, processed entirely by Stripe. We never see or store your card details
- Licence key usage, we log how many times your key is used to monitor for abuse
- Name, optionally collected at checkout for invoice purposes
Your files
We never see, store, or transmit your files. The Holdfast tools run entirely in your browser. Your photos, messages, and backups are processed locally on your device, they are never uploaded to our servers or any third party. This is a core design principle of our service.
How we use your information
- To deliver your licence key by email after purchase
- To validate your licence key when you use a tool
- To track usage counts for abuse monitoring
- To respond to support requests if you contact us
We do not sell your information. We do not use your email for marketing without your consent.
Data retention
We retain your email address and licence key for as long as your licence is active. If you would like your data deleted, contact us at [email protected] and we will remove it within 30 days. Note that your licence keys live in these records, so deleting them deactivates your keys.
Security
Your licence key and email are stored in a secured database with access controls. Payment data is handled entirely by Stripe and subject to their PCI-DSS compliance. We do not store payment card information.
Your rights
You have the right to request access to, correction of, or deletion of any personal data we hold about you. To exercise these rights, contact us at [email protected].
Cookies
We do not use tracking cookies. Stripe may set cookies during the checkout process as part of their fraud prevention systems.
Third party services
We use the following third party services to operate our platform:
- Stripe, payment processing. Subject to Stripe's Privacy Policy
- Supabase, database for storing licence keys and email addresses. Subject to Supabase's Privacy Policy
- Resend, transactional email delivery. Subject to Resend's Privacy Policy
- Cloudflare, website hosting and functions. Subject to Cloudflare's Privacy Policy
- Google Fonts, the pages load fonts from Google, so your browser requests font files from Google when a page loads. Subject to Google's Privacy Policy
Changes to this policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date.
Contact
For any privacy-related questions, contact us at [email protected].