Privacy Policy

Last updated: July 26, 2026

The short version: the AAF / XML Bridge application does all its work on your computer — your audio, projects and timelines never leave it. It makes only three kinds of network request: license activation, an occasional license re-validation, and a short version check when it starts, which you can switch off and which carries no identifier. For visitor statistics this website uses GoatCounter (cookieless, no personal data). The only cookies it sets are Google Ads and Google Analytics cookies for our ad campaign and usage statistics — and only if you accept the cookie banner; decline and none are set. Payments are processed by Lemon Squeezy as merchant of record; we never see your payment details.

1. Introduction

This privacy policy describes how we collect, use and share information when you:

We have designed our products to collect as little personal information as technically possible. This policy is therefore short; the sections below describe everything there is.

2. Products and Services Covered

This policy covers:

3. Information We Collect

Desktop application

The application performs all conversions locally on your machine. It contains no analytics on your media, no crash reporting and no account system. The files you convert — audio, video, project and timeline data — are processed entirely on your computer and are never transmitted to us or to anyone else.

There are exactly three situations in which the application talks to the network. They are described below; everything else it does works without an internet connection.

License activation

When you enter a license key, the application contacts the Lemon Squeezy licensing API once to validate and activate the key. This request contains the license key, an activation label that includes your computer’s name (for example “AAF Bridge (Studio-Mac)” — so you can recognise which machine an activation belongs to), and the standard technical data that accompanies any internet request (such as your IP address). If you don’t want your computer’s name transmitted, rename the machine in System Settings before activating. The free demo requires no activation.

License re-validation

An activated license is checked against the Lemon Squeezy licensing API again roughly once a week, so that licenses which were refunded or released for another computer stop working. The request contains the license key and the activation reference, nothing about your files or your use of the app. If you are offline the check is skipped and your license keeps working — it never locks you out.

Update check on start

When the application starts, it sends one short request to our update endpoint. It contains three pieces of information: the application version, the platform (macOS or Windows), and whether it is running in demo or licensed mode. It contains no identifier — no license key, no account, no device or installation ID.

For the update check when opening the application, the endpoint derives a hashed form of your IP address. We do not store the IP address itself. Nothing is linked to your license or to any of your files.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in knowing which versions are in use and in being able to tell you that an update exists. You can object to this processing at any time — write to us at the address above and we will tell you how to stop the request on your machine. The endpoint runs on Cloudflare, Inc. as our processor under a data processing agreement; the hashed rows are deleted after 14 days. The application never downloads or installs anything by itself — it only opens this website in your browser.

Purchases

When you buy a license, the purchase is handled by Lemon Squeezy as merchant of record. Lemon Squeezy collects and processes the information needed to complete the transaction — such as your name, e-mail address, billing address, payment details and applicable tax information — under the Lemon Squeezy privacy policy. We never receive or store your payment details. We receive your e-mail address, order details and license key records so that we can issue and manage your license and provide support.

Website

This is a static website. It sets no cookies of its own, embeds no social media widgets and no third-party fonts, and shows no advertising. For basic visitor statistics it uses GoatCounter, a privacy-friendly, open-source analytics tool: it loads one small script from gc.zgo.at and records only aggregate, non-identifying information — which page was viewed, the referring site, a rough browser/operating-system label and the day. GoatCounter sets no cookies, stores no personal data, and does not track you across other websites; your IP address is used only transiently to derive an approximate country and is not stored — so GoatCounter itself needs no consent.

We additionally use two Google services via the Google tag (gtag.js): Google Ads conversion measurement (to see which ad clicks lead to a download or purchase) and Google Analytics 4 (aggregate site-usage statistics). These are the only parts of the site that can set cookies, and only after you agree: on your first visit a banner asks you to Accept or Decline. We use Google Consent Mode v2 with every consent signal denied by default, so no Google advertising or analytics cookies (such as _gcl_au or _ga) are set unless you accept — decline and none are set. Your choice is remembered; you can change it by clearing this site’s data in your browser. Any data you consent to is handled under the Google privacy policy. Our hosting provider may additionally keep standard server logs (IP address, time of access, requested page, user agent) for security and operational purposes.

E-mail

If you contact us, we receive your e-mail address, the contents of your message, and any attachments you choose to send (for support this may include conversion reports or project files — send them only if you are comfortable doing so).

4. How We Use Your Information

We use the limited information described above to:

We do not use your information for advertising, profiling or automated decision-making, and we do not send newsletters or marketing e-mails unless you have explicitly asked for them.

5. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process personal information under the following legal bases:

6. Sharing Your Information

We share information only in the following situations:

We do not sell personal information, and we never have access to your project or media data in the first place.

7. Data Security

The most effective security measure in our products is architectural: your creative work never leaves your computer, so it cannot be breached on our side. Beyond that, license validation uses encrypted connections (HTTPS/TLS), this website is served over HTTPS, and access to order data in the Lemon Squeezy dashboard is protected by authentication and limited to the developer.

8. Cookies and Tracking Technologies

Our own analytics (GoatCounter, see section 3) is cookieless and stores no personal data, so it sets nothing on your device. The only cookies this website itself can set are Google Ads conversion cookies and Google Analytics cookies (for example _gcl_au and _ga) — and only after you accept via the cookie banner on your first visit. We use Google Consent Mode v2, so with the default (or if you decline) no such cookies are set. If you accept, they are governed by the Google privacy policy; you can withdraw consent by clearing this site’s data in your browser. Separately, when you open the Lemon Squeezy checkout to purchase a license, Lemon Squeezy may set cookies necessary to process the transaction, governed by the Lemon Squeezy privacy policy. The desktop application stores its settings and license state locally on your computer only.

9. Data Retention

10. Your Data Protection Rights

Depending on your location, you have the following rights regarding your personal data:

To exercise any of these rights, e-mail us at support@aafbridge.com. If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority.

11. Third-Party Software

AAF / XML Bridge reads and writes interchange files for third-party applications such as Ableton Live, DaVinci Resolve, Pro Tools, Media Composer, Premiere Pro and Final Cut Pro. All of this happens locally on your computer. We are not responsible for the privacy practices of third-party software; please review the privacy policies of the applications you use alongside AAF / XML Bridge.

12. International Data Transfers

Lemon Squeezy is a US-based company; when you purchase a license or activate the application, the associated data is processed in the United States under Lemon Squeezy’s safeguards for international transfers. Support e-mail is processed where our e-mail provider operates its servers.

13. Changes to This Policy

If we change this policy — for example because a future version of the application gains an online feature — we will update this page and the “Last updated” date above. Material changes to what the application sends over the network will always also be stated in the application’s release notes.

14. Contact

AAF / XML Bridge is developed and operated by a one-person studio.