Privacy policy

Summary

Laypen is a Mac app that keeps your documents on your own computer. The app has no account, no sign-in, no telemetry, no analytics and no advertising. It sends us nothing, so we hold no personal data about how you use it.

We handle personal data in only two situations: when you visit this website (technical server logs) and when you write to us by email. This notice explains both, and then sets out the information that the laws of particular countries require.

We do not sell personal data, we do not use it for advertising, and we do not build profiles.

Who is responsible

The controller of the personal data described in this notice is Zeze Workshop, Kızılırmak, Dumlupınar Blv. Next Level No:3C1-160, 06510 Çankaya/Ankara, Türkiye (zezeworkshop.com).

For any privacy question or request, write to support@laypen.app. We have not appointed a data protection officer, because the law does not require us to; messages sent to this address reach the people responsible for data protection.

The Laypen app: your data stays on your Mac

We do not collect any personal data through the app. Your documents, Stash items, settings and the seven daily backups are stored only in your user Library folder on your Mac. They are never transmitted to us and we cannot access them. The app has no account system and does not report usage or crashes to us. Once a day it reads a small version file from laypen.app to see whether a newer version exists; this request carries no information about you or your documents, and you can turn it off in Settings.

Link previews: when you add a web link to Stash, the app contacts that address once to read its title, description and preview image. The request goes directly from your Mac to the website you chose, which will see your IP address like any site you visit. We do not receive the request or the result. Addresses on your local network are never contacted.

Calendar (optional, off by default): if you turn this on, the app reads events from your macOS Calendar to display them. This happens on your Mac only. The app does not change the events and does not send them anywhere.

App lock (optional, off by default): Touch ID is handled by macOS. Laypen only learns whether the check succeeded; it never receives your fingerprint data.

Claude connection (beta versions up to and including 0.9.2 only; optional and off by default; later versions do not contain this feature): if you turn this on, the Claude desktop app on the same Mac can read and edit your Laypen documents through a local, token-protected connection. We are not part of that exchange. Content you share with Claude is processed by Anthropic as an independent controller under its own terms and privacy policy.

Features of macOS itself, such as the security check that macOS performs when you first open a downloaded app, are provided by Apple under Apple’s privacy policy and are not controlled by us.

This website and email: what we process and why

Server logs. When your browser requests a page or a file from this website, our hosting provider automatically records your IP address, the date and time, the address requested, the referring page if your browser sends one, and your browser and operating system type. Purpose: delivering the site, keeping it secure, and detecting and fixing faults and misuse. Legal basis: our legitimate interest in running a secure and reliable website (Art. 6(1)(f) GDPR). We do not combine log data with other data to identify you.

Downloads. When you download the Laypen installer from the link we send you, the server that hosts the file creates the same kind of log entry, for the same purposes and on the same legal basis.

Beta list and download requests. When you join the beta list with the form on this website, we store your email address, the language of the page you used, the date, a random key for your personal download link, and the number and time of the downloads made with that link, on our hosting server. We use this to email you the download link through our email provider, to limit how often the link can be used, and to send you messages about the beta (new versions, changes to the beta and its end). When you email us to ask for Laypen instead, we process your email address, your name if you give it, and the content of your message for the same purpose. Legal basis: steps taken at your request before entering into the licence agreement (Art. 6(1)(b) GDPR). To prevent misuse of the form, a salted one-way hash of your IP address is kept for up to one hour and then deleted; your IP address is not stored with your email address. You can leave the list at any time by writing to support@laypen.app, and we then delete your address. Otherwise we keep it while the beta programme runs and delete it when the programme ends.

Support and other enquiries. When you email us for any other reason, we process the same data, plus anything you choose to include (for example screenshots), in order to reply and to resolve the issue. Legal basis: performance of the licence agreement where your message concerns your use of the app (Art. 6(1)(b) GDPR), and otherwise our legitimate interest in answering people who contact us (Art. 6(1)(f) GDPR).

Privacy requests and legal claims. If you exercise a data protection right, we keep a record of your request and our answer in order to comply with our legal obligations (Art. 6(1)(c) GDPR). Where necessary we may also use the data described above to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR; our legitimate interest is protecting our legal position).

What we do not do. This website has no cookies, no analytics, no tracking pixels, no advertising, no embedded third-party content and no fonts loaded from other servers. Its only forms are the beta list described above and the feedback form. When you send feedback, we receive your name if you give it, your email address, your message, the app version and an optional screenshot by email, and we keep a copy of the text (not the screenshot) on our hosting server so that it is not lost; we use it only to improve Laypen and to reply to you. We do not use that list for marketing, we do not share it, and we do not add addresses to it from any other source. See the Cookie policy for the single preference stored in your browser.

Where the data comes from and whether you must provide it

We obtain personal data only from you: from your browser when you visit the site, and from your emails. We do not obtain data about you from other sources. If your message contains information about another person, we use it only to deal with your message.

You are under no legal or contractual obligation to give us any data. Server logs are created automatically and the site cannot be delivered without your IP address. If you do not give us an email address, we cannot send you the download link or reply to you. Please do not send us sensitive information we have not asked for.

Who receives the data

Service providers. We use a website hosting provider and an email provider. They act as our processors: they handle the data only on our instructions and only to provide their service to us.

Authorities and advisers. We disclose personal data to courts, public authorities or professional advisers only where the law requires it or where it is necessary to establish, exercise or defend legal claims.

Nobody else. We do not sell or rent personal data and we do not disclose it to anyone for advertising or marketing.

International transfers

We are established in Türkiye, so the data you send us is processed in Türkiye. Türkiye is not currently covered by an adequacy decision of the European Commission, the United Kingdom or Switzerland. Your data is nevertheless protected by Turkish data protection law (Law No. 6698) and, where it applies to us, by the GDPR and the other laws described below.

Our hosting and email providers may store data on servers in other countries. Where the law requires a safeguard for such a transfer, we rely on an adequacy decision or on standard contractual clauses or standard contracts approved by the competent authority. You can ask us at support@laypen.app which countries are involved and for a copy of the safeguards.

How long we keep it

Server logs are kept for the short rotation period applied by our hosting provider and are then deleted or anonymised. They are kept longer only where a specific security incident needs to be investigated.

Email correspondence is kept for up to 24 months after our last exchange and is then deleted.

Records of privacy requests are kept for three years after the request is closed, so that we can show how we handled it.

We keep data beyond these periods only where a law requires it or while a legal claim is pending, and only for as long as that reason lasts.

Security

This website is served only over an encrypted connection (HTTPS). Access to our mailbox and hosting account is limited to the people who need it. No method of transmission or storage is perfectly secure; if a breach affecting your data occurs, we will notify you and the competent authorities where the law requires.

Your rights

Wherever you live, you can ask us whether we hold personal data about you, ask for a copy, and ask us to correct or delete it. Depending on the law that applies to you, you may also have the right to restrict processing, to receive your data in a portable format, to object to processing, and to withdraw any consent you have given. We do not currently rely on consent for any processing.

Right to object. Where we rely on our legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop the processing unless we have compelling legitimate grounds to continue or need the data for legal claims.

How to exercise your rights. Write to support@laypen.app. We answer free of charge and without undue delay, at the latest within 30 days. We may ask for information needed to confirm your identity; normally a reply from the email address you used with us is enough. Please note that we usually cannot link an IP address in a server log to a particular person.

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

You also have the right to complain to a data protection authority. The sections below name the authority for each region.

European Economic Area, United Kingdom and Switzerland

European Economic Area. Where the GDPR applies to our processing of your data, the legal bases are those stated above and you have the rights in Articles 15 to 22 GDPR. You may lodge a complaint with the supervisory authority of the country where you live, where you work, or where you believe the infringement took place.

United Kingdom. Where the UK GDPR and the Data Protection Act 2018 apply, the same legal bases and rights apply under UK law. You may complain to the Information Commissioner’s Office (ico.org.uk).

Switzerland. Where the Federal Act on Data Protection (FADP) applies, you have the rights of access, rectification, erasure and objection that it provides. Your data is processed in Türkiye and in the countries where our hosting and email providers operate their servers; we will tell you which countries on request. The competent authority is the Federal Data Protection and Information Commissioner (FDPIC).

Türkiye: information notice under KVKK

This section is the information notice (aydınlatma metni) required by Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) and by the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

Data controller: Zeze Workshop, Kızılırmak, Dumlupınar Blv. Next Level No:3C1-160, 06510 Çankaya/Ankara, Türkiye. Contact: support@laypen.app.

Data and purposes. Transaction security data (IP address, date and time, address requested, browser information) is processed to deliver the website, ensure its security and detect faults and misuse. Identity and contact data (your name if you give it, your email address) and the content of your message are processed to send you the download link, answer your requests, provide support, handle applications made under KVKK and, where necessary, protect our legal rights.

Method and legal grounds of collection. Log data is collected by fully automated means by the servers of our hosting provider when you visit the site. Email data is collected by electronic means when you write to us or fill in the beta form. The legal grounds are Article 5(2)(c) KVKK (processing necessary for the conclusion or performance of a contract), Article 5(2)(ç) (compliance with a legal obligation), Article 5(2)(e) (establishment, exercise or protection of a right) and Article 5(2)(f) (legitimate interests of the controller, provided your fundamental rights and freedoms are not harmed). We do not process special categories of personal data and we do not rely on explicit consent.

Recipients and purpose of transfer. Personal data is transferred only to our hosting provider and our email provider, so that the website can be hosted and email can be sent and received, and to authorised public institutions and courts where the law requires, in accordance with Article 8 KVKK. Where a provider’s servers are located outside Türkiye, the data is transferred abroad only in accordance with Article 9 KVKK, on the basis of an adequacy decision or of one of the appropriate safeguards listed in that Article, such as the standard contract published by the Personal Data Protection Board.

Your rights under Article 11 KVKK. You have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of the processing and whether the data is used in accordance with that purpose; know the third parties in Türkiye or abroad to whom the data is transferred; request correction of incomplete or inaccurate data; request erasure or destruction of the data under the conditions in Article 7; request that correction, erasure or destruction be notified to the third parties to whom the data was transferred; object to a result to your detriment that arises from analysis of the data exclusively by automated systems; and claim compensation if you suffer damage because of unlawful processing.

How to apply. You may apply in Turkish, under Article 13 KVKK and the Communiqué on the Procedures and Principles for Applications to the Data Controller, in writing to the postal address above, by email to support@laypen.app from the email address you have previously used with us, or by another method provided in that Communiqué. Your application should contain the information listed in Article 5 of that Communiqué (including your name, contact details and the subject of your request). We conclude applications free of charge within 30 days at the latest; if the reply requires a separate cost, the fee set by the Board’s tariff may be charged.

Complaint. If your application is refused, if you find our answer insufficient, or if we do not answer in time, you may lodge a complaint with the Personal Data Protection Board (kvkk.gov.tr) under Article 14 KVKK within 30 days of learning of our answer and in any case within 60 days of the date of your application.

United States (including California)

US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA) generally apply only to businesses above certain size thresholds. Whether or not they apply to us, we give the following information and honour the following rights for every US resident.

Categories we collect, and have collected in the past 12 months: identifiers (IP address, email address, and your name if you give it); internet or other electronic network activity information (the server log entries described above); and the content of messages you send us. We do not collect sensitive personal information as defined by these laws. Sources: you and your browser. Purposes and retention periods: as described above.

Disclosure. We disclose these categories only to our service providers (hosting and email) for the business purposes described above. We do not sell personal information and we do not share it for cross-context behavioural advertising or targeted advertising; we have not done so in the past 12 months, including for anyone under 16. We do not use personal data for profiling that produces legal or similarly significant effects. We offer no financial incentives in exchange for personal information.

Your rights. You may ask to know what personal information we hold about you and receive a copy, to have it corrected, and to have it deleted. Because we do not sell or share personal information or use sensitive personal information, there is nothing to opt out of. We will not discriminate or retaliate against you for exercising your rights.

How to exercise them. Write to support@laypen.app. We verify requests by replying to the email address you used with us. You may use an authorised agent, who must show written permission from you. If we decline your request, you may appeal by replying to our decision; we will answer the appeal in writing and, if we uphold the refusal, tell you how to contact your state attorney general.

Do Not Track and Global Privacy Control. This website does not track visitors over time or across third-party websites, and no third party collects personal information on it. It therefore behaves the same way whether or not your browser sends one of these signals.

Children. Laypen and this website are not directed at children under 13, and we do not knowingly collect personal information from them (Children’s Online Privacy Protection Act).

Brazil (LGPD)

Where Law No. 13.709/2018 (LGPD) applies, we process personal data on the legal bases in Article 7: preliminary procedures relating to a contract at your request (V), compliance with a legal obligation (II), the regular exercise of rights in legal proceedings (VI) and our legitimate interests (IX).

You have the rights listed in Article 18, including confirmation that processing exists, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion, and information about the entities with which we share data. Our contact channel for these requests is support@laypen.app. You may also petition the National Data Protection Authority (ANPD).

Other countries

We apply the standard described in this notice to everyone, wherever they live. If the mandatory law of your country gives you additional rights, this notice does not limit them. Write to support@laypen.app and we will handle your request under the law that applies to you; you may also contact your national data protection authority.

Children

Laypen and this website are not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has written to us, tell us and we will delete the message.

Changes

If we change this notice, we will update the date at the top of this page. Significant changes, in particular any new use of personal data, will be announced on the website before they take effect.

Contact

Zeze Workshop, Kızılırmak, Dumlupınar Blv. Next Level No:3C1-160, 06510 Çankaya/Ankara, Türkiye. Email: support@laypen.app