A short
privacy policy._

Only what's needed to run an account, deliver a file, take a payment, and send the list. Nothing is collected for advertising.

Card details are never collected by me at all — see section 04.

Every piece of data maps to one reason and one lawful basis. If a reason disappears, the data does too.

• →Running your account and delivering what you bought — email, password, purchase history. Basis: performance of a contract (Art. 6(1)(b)). Without it there's no way to give you your files.
• →Taking payment and keeping tax records — order and VAT records. Basis: legal obligation (Art. 6(1)(c)) under Swedish bookkeeping and VAT law.
• →The email list — telling you when a file drops or a batch opens. Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time from any email.
• →Proving you agreed to be emailed — the IP address, time and rough location of the signup itself. Basis: legal obligation (Art. 6(1)(c)) — the law requires me to be able to demonstrate consent (Art. 7(1)), and a record with no evidence behind it isn't a record. It's used for nothing else, and it goes when you unsubscribe.
• →Keeping accounts secure and stopping fraud — sign-in activity, IP. Basis: legitimate interests (Art. 6(1)(f)) in not having accounts stolen or files redistributed.
• →Showing the right price — country from IP, so you see your currency and the correct VAT. Basis: performance of a contract (Art. 6(1)(b)).

There is no profiling and no automated decision-making that produces legal effects for you.

A short, named list. If a vendor is on it, your data is on their servers — I'd rather tell you than dress it up. Each acts as a processor on my behalf under a data processing agreement.

• →Clerk · runs accounts and sign-in. Stores your email, hashed password, Google profile if you use it, and session records including IP and device.
• →Stripe · takes payments and calculates VAT. Receives your email and the location data needed for tax, and holds the card details directly.
• →Vercel · hosts this site. Processes your IP address and normal server logs as part of serving pages. Also provides the visitor statistics described below — same company, no extra vendor.
• →Cloudflare · stores the build files you buy and delivers them to you. Sees your IP address when you download, and nothing else — not your name, not your email, not which account you are. Files are held in the EU and are never public: each download uses a private link that expires within minutes.
• →MailerLite · manages the email list. Stores your email, unsubscribe state, and — as the record that you agreed to be emailed — the IP address you signed up from, the time you did it, and the country and city that IP resolves to.
• →Google · only if you choose "Continue with Google". Google tells me your email and basic profile; I tell Google nothing about you.

That's the whole list. No advertising network, no data broker, and nothing is ever sold or shared for marketing. When the list changes, this page changes.

Visitor statistics. I count page views to know which pages people actually read and whether the site works — how many opened a page, from which country, and how many got as far as entering an email address. It runs on Vercel, who already host the site, so no new company receives anything.

It is cookieless and has no profile of you in it. Nothing is stored on your device, you are not given an identifier that follows you between visits or between sites, and I cannot see what any individual person did. Your email address is never attached to it — when you sign up to the list, what gets counted is that a signup happened and which form it came from, never who. That is why there is no cookie banner: there is nothing here to consent to.

Checkout happens on Stripe's own pages. Your card number, expiry and security code go straight to them and never pass through a Raccoon Lab server. I couldn't see or store them if I wanted to.

What comes back to me is the minimum needed to give you your files and keep lawful records: that a payment succeeded, the amount, your email, and the location Stripe used to work out VAT.

Stripe is an independent controller for its own fraud-prevention and regulatory purposes. Their handling of your data is governed by Stripe's privacy policy.

• →Account and purchase history · for as long as you have an account. Delete the account and it goes — along with your access to the files, so back them up first.
• →Order and VAT records · seven years, because Swedish bookkeeping law requires it. This is the one category I can't delete on request — a legal obligation overrides erasure here.
• →Email list · until you unsubscribe, then removed.
• →Emails you send me · until the conversation is clearly finished and there's no reason to keep it.
• →Server logs · short-lived, per the host's own retention.

Some of the vendors above are based in, or process data in, the United States. That means your data may be transferred outside the EU/EEA.

The build files themselves are stored in the EU — the Cloudflare bucket they live in is pinned to a Western European region, so buying and downloading doesn't move your files or your download record out of Europe.

Where that happens, the transfer relies on the safeguards the law requires — the European Commission's Standard Contractual Clauses, or an adequacy decision such as the EU–US Data Privacy Framework where the vendor is certified under it.

I don't transfer your data anywhere else, and I don't sell or share it with anyone for their own purposes.

No devices have dropped yet. This section describes how they are designed to work.

Every device comes with a PDF guide. During setup you enter your WiFi credentials and it connects to your local network — your Home Assistant or MQTT broker. That's the only network it ever talks to. There is no Lab account, no cloud backend, no telemetry endpoint. I have no way to receive anything the devices send, and I'm not building one.

When firmware updates are available, I'll send them by email. You decide whether to apply them. The same principle holds there.

Standard EU rules. Email me and I'll handle any of these within 30 days — usually the same week, because there's one person reading the inbox. Exercising them is free and I won't treat you differently for it.

Where I rely on consent — the email list — you can withdraw it at any time using the unsubscribe link in any email, or by writing to me. Withdrawing doesn't affect anything done before you withdrew.

You also have the right to complain to the Swedish supervisory authority, IMY (Integritetsskyddsmyndigheten), at imy.se — or to the authority where you live.

Only cookies that are strictly necessary to make the site work — which is why there's no cookie banner asking your permission. Consent is only required for the non-essential kind, and there aren't any.

• →Sign-in cookies set by Clerk, so you stay logged in between pages. Clearing them logs you out.
• →Functional cookies set by the host to serve the site correctly.
• →Stripe may set cookies on its own checkout pages for fraud prevention.

No analytics cookies, no advertising cookies, no third-party tracking pixels. The visitor statistics described in tools_we_use are counted without cookies and without storing anything on your device, which is exactly why they need no banner.

This shop isn't aimed at children and accounts aren't knowingly created for them. If you're under 18, ask a parent or guardian to buy for you.

If you're a parent or guardian and think a child has given me their information, email me and I'll delete it.

Any changes are logged below with a date. If a change meaningfully affects your data, you'll get an email.

• →2026-05-24 · initial version published.
• →2026-08-07 · rewritten to cover accounts, payments and file delivery, and to add legal bases, retention periods, international transfers and the full list of rights.
• →2026-08-10 · added Cloudflare, which now stores and delivers the build files (previously Vercel), and noted that those files are held in the EU. Spelled out that the IP, time and rough location of an email signup are kept as proof of consent.
• →2026-08-11 · added cookieless visitor statistics, run by Vercel, who already host the site. No new company receives anything, nothing is stored on your device, and no email address is attached to it. Also corrected the vendor count in tools_we_use from five to six — six were always listed.