The Privacy Policy
Elba privacy policy — what we know about you.
Almost nothing. It would feel dishonest to write a program about privacy and then farm yours.
1 · The program itself
Elba runs entirely in your browser, on your machine. It does not talk to us. It does not talk to anyone. It makes zero network requests. Your files, your passphrase, and the contents of your fence never leave the computer they were made on. There is no telemetry, no analytics, no phone-home, no account.
2 · When you buy
Payment is handled by Paddle.com Market Ltd. as the merchant of record. To complete a purchase, Paddle collects your name, email address, billing country, and payment details, and shares with us only what we need to fulfil the order — normally your email address and the country used for tax. Meanwhile VOF processes this information on the legal basis of contract performance (to deliver the product) and legal obligation (Dutch tax bookkeeping). Paddle's own privacy notice is at paddle.com/legal/privacy.
3 · What we keep, and for how long
We keep your email address and order record so we can send you the download link, honour refunds, respond to support, and meet our bookkeeping obligations (typically seven years, as required by Dutch tax law). We do not use your email for marketing unless you explicitly opt in.
4 · This website
The marketing pages on elba.works set no tracking cookies, no third-party analytics, no ad pixels, and no session recording. Our host (Cloudflare) may set one strictly-necessary cookie for bot protection. A minimal backend handles orders, the optional email list, and the public read-only agent tools at /mcp — the data it stores is described in §3 and §5. Standard server access logs (IP address, timestamp, requested URL) are kept by our host for a short period to protect against abuse. That's the whole picture.
5 · Security measures
Elba encrypts your files in your browser using AES-256-GCM; your passphrase and derived keys never leave your device. The elba.works site is served over HTTPS. Order records are stored in a backend database with access limited to the people who need it to provide support and refunds. We do not store payment details; Paddle handles those under its own security and compliance programmes.
6 · Your rights
Under the GDPR you may ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Write to privacy@elba.works. We will respond within thirty days.
7 · Data controller
The controller for the personal data described above is Meanwhile VOF, based in The Netherlands and reachable at privacy@elba.works. For payment data held by Paddle, Paddle is the controller.
8 · Changes
If we ever change this policy in a way that matters, we will note it here with a new date and, for material changes, email people who have bought Elba.
Last updated · 4 July 2026