Privacy notice
What personal data Maude Cloud holds, why, for how long, who else sees it, and how to get it out or get rid of it.
Last updated: 4 November 2026
Who holds your data
Bc. Michal Dovrtěl, IČO 03387666, Houbalova 2088/5, Líšeň, 628 00 Brno, Czech Republic — the controller for the personal data described here, and the processor for the design work you store (that relationship is governed by the DPA). Contact: cloud@maude.sh.
We do not have a DPO; the service is small enough that the contact address reaches a person who can act.
What we hold, and why
| What | Why | Kept for |
|---|---|---|
| Your email address | It is your identity here, and how we reach you about your projects | While your account exists |
| Password hash (only if you did not use Google) | Signing you in | While your account exists |
| Google account id, name, email (only if you used Google) | Signing you in without a password | While your account exists |
| Project name, plan, state, dates | Running and billing the project | While the project exists |
| Billing details — company, address, VAT id | Issuing correct invoices, charging the right VAT | 10 years (Czech accounting law) |
| Stripe customer and subscription ids | Linking your project to its payments | While the project exists |
| Audit log — who did what to a project, and when | So you can see what happened, including if we ever looked | While the project exists |
| Your designs and their history | The service itself. Processed on your instruction — see the DPA | Until you delete the project |
| Website server logs and analytics — IP address, page, time, browser; aggregated page views | Hosting the website securely and knowing which pages are read | As set by Cloudflare for its logs; aggregated counts for analytics |
| Usage events — your account id, the project id, the name of the action, and when it happened | Operating the service and knowing which parts of it are used | 90 days |
| Project size figures — how many designs, artboards and design systems a project holds, and how much media storage it uses | Knowing what it costs us to run your project | 90 days |
We hold no tracking pixels and no advertising identifiers. This website uses Cloudflare Web Analytics, which counts page views without cookies and without storing anything on your device. We also count downloads and button clicks the same way: each count is the page, the button or platform, the referring site and your country, with no IP address and nothing that tells one visitor from another. Cloudflare, Inc. processes it for us, under our legitimate interest in knowing which pages are read. The website sets no cookies. The application sets one cookie for you: your session. (Signing in with Google adds a second one for ten minutes, to carry that sign-in back.) These cookies are strictly necessary, so we ask for no cookie consent.
Website visitors. When you read this website, Cloudflare, which hosts it, keeps ordinary server logs (your IP address, the page, the time, your browser). The analytics above are aggregated page-view counts.
About those usage events. They are first-party and emitted by our own servers — the application ships no JavaScript at all, so there is nothing in the page that could report on you even if we wanted it to. An event is the name of something that happened ("signed in", "project created"), your account id, the id of the project it concerned, and a timestamp. It never contains your email address, and it never contains anything from inside your designs. They are stored on Cloudflare, already our hosting subprocessor, and they are not shared with anyone. We rely on legitimate interests for this, and you may object — write to cloud@maude.sh.
One thing worth naming plainly: a project id is the short name you chose when you created the project, and it becomes part of that project's web address. If you name a project after yourself or a client, that name is in these records. Nothing else about the project travels — not its contents, not its file names.
About the size figures. Your project counts its own designs and reports the totals to us once an hour, so we can see what running it actually costs. Counts and sizes only: never a design's name, never a file path, never anything you wrote.
The desktop app and the maude command on your computer
Neither sends telemetry: no usage data, no analytics, nothing from your designs. On their own, they make two network calls, and both only ask whether a newer version exists:
- The desktop app's update check asks
maude.sh/releases/<platform>/<architecture>/<installed version>shortly after it starts, when its window gets focus, and every 4 hours. The request carries your platform, your processor architecture and the version you have installed, plus your IP address, which any web request carries. Nothing else. - The
maudecommand's version check asks the public npm registry for the latest version at most once a day, and only when it runs in a terminal. SetMAUDE_NO_UPDATE_CHECK=1to turn it off.
Diagnostics stay on your computer. The app keeps its own logs for the server, sync, AI and export in ~/.maude/logs. Paths, credentials and email addresses are removed before anything is written, and the logs are deleted after 7 days. Crash logs, if you turn them on in the first-run setup, are local files too. Logs and crash files leave your computer only when you choose to send them: by copying a diagnostic report, or by sending a bug report.
Anything else the app reaches over the network, it reaches because you connected it: a team project or hub you link, the AI assistant you sign in to, a media-generation provider whose key you add.
What we never do
- We never open, run, or render your designs on our computers. There is no browser in the workspace image, and a CI gate fails the build if one reappears.
- We never sell or share personal data for marketing.
- We never read the rest of your computer. Only the project folder syncs.
Why we are allowed to
- Performance of a contract — your account, your projects, your invoices.
- Legal obligation — accounting and tax records.
- Legitimate interests — keeping the service secure and abuse-free, keeping the audit log that lets you check us, the usage events above, and the website analytics and logs.
We do not rely on consent for any of the above, so there is no consent to withdraw. Marketing email, if it ever exists, will be opt-in and separate.
Who else sees it
The subprocessor list is in the DPA and is part of it: Cloudflare (hosting, storage, DNS, usage events, and this website with its logs and its analytics; no customer project data), Resend (transactional email).
Others receive data for their own purposes or at your instruction:
- Lemon Squeezy (Sold through Link, LLC), a Stripe affiliate, sells you the subscription, processes the payment and issues invoices. It is our merchant of record and acts as an independent controller of your payment and billing data, under its own privacy policy. We receive the details we need for the invoice and the tax treatment, never your card number.
- Google, if you sign in with Google. Google also receives the emails you send to cloud@maude.sh and security@maude.sh, because those addresses are forwarded to the operator's Gmail inbox. Cloudflare Email Routing processes those emails in transit to forward them.
- GitHub, only if you connect the automatic copy to your own GitHub. It happens at your instruction.
- Anthropic receives nothing from Maude Cloud. If you use AI, you do it on your own Claude account, on their terms.
Transfers outside the EEA. Several of these providers are US companies: Cloudflare, Inc., Stripe and Lemon Squeezy (Link), Resend, Google and GitHub. Each transfer runs on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
Do you have to give us your data? You need to give your email address to have an account, and billing details to buy a plan. Without them we cannot provide the service.
Automated decisions. We make no decisions about you by automated means alone that have legal or similarly significant effects.
Your rights
Access, correction, erasure, restriction, objection, and portability — the usual GDPR set. Two of them are self-service and do not require asking us:
- Portability: Download everything, on your project, at any time, including while it is paused.
- Erasure: Delete project, which stops billing, detaches the address and erases the stored data.
- Correction of billing details: Manage billing on your project's billing page opens the customer portal hosted by Stripe. There you can update your name, email address, billing address and tax id, update your payment method, see your invoices, and cancel the subscription at the end of the billing period.
For the rest, write to cloud@maude.sh. We answer within 30 days. If we get it wrong, you may complain to the Czech data protection authority (Úřad pro ochranu osobních údajů, uoou.gov.cz) or to the authority where you live.
If something goes wrong
We notify you of a personal data breach within 72 hours of becoming aware of it, at the contact address on the account. Security issues: security@maude.sh.
Children
The service is not for under-18s and we do not knowingly hold their data.
Changes
Material changes are announced before they take effect. The date at the top of this page is the last change.