Privacy Policy

1. Who we are

RoMacro ("we," "us," "our") is a Windows desktop application and cloud service for creating and sharing input macros. It is operated by [Virage Studio], a sole proprietorship registered in Québec, Canada (NEQ: [YOUR NEQ]), with mailing address [YOUR REGISTERED ADDRESS].

Privacy officer (per Loi 25): [YOUR FULL LEGAL NAME]
Contact: [email protected]

2. What we collect

When you create an account

• Email address — required so you can log in and we can send security notices.
• Display name — chosen by you. Can be a pseudonym.
• Password — stored only as an irreversible PBKDF2 hash. We never see, store, or log the original password.

When you use the app

• Macros you create — titles, descriptions, tags, and the macro body (the recorded sequence of actions).
• Engagement — likes, downloads, when a macro was opened.
• Sign-in timestamps — the time of your last login.
• API logs — including your IP address, used to detect abuse and debug errors. Retained for 30 days, then deleted.

What we do not collect

• Tracking cookies, ad pixels, or third-party analytics.
• Anything you type outside RoMacro.
• Anything inside macros you keep private (we store them encrypted at rest on our database, but never make them visible to anyone but you).

3. Why we collect it

Data	Purpose	Legal basis (Loi 25 / GDPR)
Email + password	Identify you, let you log in	Performance of contract
Display name	Attribute your published macros	Performance of contract
Public macros	Show them to other users (the point of the service)	Performance of contract
Private macros	Sync them between your devices	Performance of contract
Likes / downloads	Power the "Trending" and "Recent" feeds	Performance of contract
IP + sign-in logs	Rate limiting, abuse prevention, debugging	Legitimate interest

4. How long we keep it

Data	Retention
Active account data	As long as your account exists
Macros	Until you delete them or close your account
API logs (incl. IP)	30 days, rolling
Database backups	14 days, rolling
Closed account data	Hard-deleted within 30 days of account closure

5. Who we share it with

We use these third parties to operate the service:

Provider	Purpose	Location	Their privacy policy
Fly.io	Hosting the API and database	United States (Virginia)	fly.io/legal/privacy-policy
GitHub	Hosting installer downloads and auto-updates	United States	docs.github.com/site-policy

We may add a payment processor (Stripe or Gumroad) and an email provider (Resend or Postmark) when paid plans launch. We'll update this policy before that happens.

Cross-border note for Quebec users: Your data is processed and stored in the United States. By using RoMacro, you consent to this transfer. United States data protection laws may not be equivalent to those of Québec.

6. Your rights

Under Loi 25 and standard privacy practice, you can at any time:

• Access — request a copy of everything we have on you.
• Correct — fix inaccurate information.
• Delete — close your account; we hard-delete your data within 30 days.
• Withdraw consent — same as deleting the account.
• Object or restrict processing of your data for specific purposes.

To exercise any of these, email [email protected]. We will respond within 30 days.

If you believe your rights are not being respected, you can file a complaint with the Commission d'accès à l'information du Québec (CAI) at cai.gouv.qc.ca.

7. Local data on your computer

The desktop app stores one file locally:

• %APPDATA%\RoMacro\auth.dat — your encrypted authentication token. Encryption uses Windows DPAPI scoped to your Windows user account. The file never leaves your machine.

Uninstalling RoMacro does not remove this file automatically. Delete it manually if you want to wipe local state.

8. Children

RoMacro is not intended for users under 13 years of age. We do not knowingly collect personal information from anyone under 13. If you are 13–17, you need permission from a parent or legal guardian to use the service.

If you are a parent or guardian and believe a child under 13 has created an account, contact [email protected] and we will delete the account and data immediately.

9. Security

• Passwords are hashed with PBKDF2 (ASP.NET Core Identity standard).
• All client-server communication uses HTTPS / TLS 1.2+.
• JWT signing keys are stored as encrypted Fly.io secrets, not in source code.
• Database access requires authentication; backups are encrypted.

We are not a Fortune 500. If there is a security breach involving your personal information, we will notify you within 72 hours of becoming aware of it, as required by Loi 25.

10. Changes to this policy

We will update this page when our data practices change. Material changes (new third parties, new types of data collected) will be announced at least 30 days in advance by email and via an in-app banner. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

• Privacy: [email protected]
• Support: [email protected]
• Mail: [YOUR REGISTERED ADDRESS]