What this site knows about you, and what it only learns if you say yes.

At a glance

• Google Analytics runs only if you allow statistics in the cookie banner. Without your consent no analytics script is loaded and no analytics cookie is set. There are no tracking pixels and no advertising.
• There is no newsletter. An account exists only once you start a trial or buy a license, and it holds your email address, your license and the computers you have installed it on.
• Fonts are served from this site itself. Nothing is fetched from Google Fonts or any other CDN.
• Our host writes a server log when your browser requests a page. That log contains your IP address and is kept for a short time for security and troubleshooting.
• If you email us, we keep the email in order to answer it.
• The sitereal application runs on your computer. Your projects, your files and your git history never reach us.

The rest of this page is the same information in the form the GDPR asks for.

Who is responsible

The controller for data processing on this website, within the meaning of Art. 4 (7) GDPR, is:

We are not required to appoint a data protection officer under Art. 37 GDPR or § 38 BDSG, and have not appointed one voluntarily. Data protection questions go to the address above and are answered by a partner.

Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel serves the pages, the fonts and the downloads, and processes personal data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Every request your browser makes is written to a server log. The log holds the requested address, the date and time, the amount of data transferred, the referring page, your browser and operating system version, and your IP address.

The legal basis is our legitimate interest under Art. 6 (1) (f) GDPR in delivering the site reliably, keeping it secure, and being able to investigate a fault or an attack. This data is not merged with any other source and is not used to identify you. It is kept only as long as that purpose requires — a few days as a rule — and is then deleted.

Transfer to the United States

Vercel is based in the USA and operates servers in several regions. Where data reaches the USA, the transfer is covered by the EU-US Data Privacy Framework, under which Vercel is certified, and additionally by the European Commission’s standard contractual clauses in Vercel’s data processing agreement. US authorities may have access rights that European law does not provide for; that residual risk cannot be excluded and is the reason this paragraph exists.

Downloading the application

The builds offered on the download page are ordinary files served from this site. Downloading one produces a line in the server log described above and nothing else: no registration, no email address, no license key, no counter tied to a person.

Cookies, storage and consent

When you first visit, a banner asks whether you allow statistics. Nothing that needs your consent is stored or loaded before you answer, and Reject all is as easy as Accept all. Your answer is kept in your browser’s local storage under the key sitereal.consent, so you are not asked again on every page. Storing it is strictly necessary to respect your choice, so it needs no consent (§ 25 (2) no. 2 TDDDG). It is kept for six months, then you are asked again.

If you sign in to your account at account.sitereal.app, that site also sets a cookie named sitereal_account on the sitereal.app domain. It holds only the value 1 and tells this site that the browser is signed in, so the header can link to your account instead of showing Sign in. It names nobody and expires when your session ends.

You can change or withdraw your consent at any time with the Cookie settings link at the foot of every page.

Every cookie and storage entry, with how long it is kept, is listed on the cookies and storage page.

Statistics (Google Analytics)

If you allow statistics in the cookie banner, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). It tells us which pages are read, how visitors find the site and where they leave, so we can improve the site and the documentation.

Google Analytics sets cookies (_ga and _ga_VM86L0QYTH) that recognize your browser across visits, and processes usage data: the pages you view, the time and length of your visit, the page you came from, your approximate location derived from your IP address, and technical details about your browser, operating system and device. Google Analytics 4 does not store full IP addresses. We use the data only in aggregate, not to identify you, and do not combine it with your account or any other data.

The legal basis is your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time, with effect for the future, through the Cookie settings link at the foot of every page; from the next page on, Google Analytics is no longer loaded. Cookies already set stay in your browser until they expire (after up to two years) or until you delete them in your browser settings. Analytics data is deleted automatically after the retention period set in Google Analytics, at most 14 months.

Processor and transfer to the United States

Google processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, and the transfer is additionally covered by the European Commission’s standard contractual clauses. US authorities may have access rights that European law does not provide for; that residual risk cannot be excluded.

More in Google’s privacy policy and in Google’s explanation of how it uses data from sites that use its services.

Fonts

The site is set in Work Sans and Inter, served as font files from this site itself. Your browser never contacts Google Fonts or any other font service, so no request carrying your IP address leaves for a third party in order to draw the text.

Links to other services

Some links lead away from this site — to GitHub, where the releases live. A link is only a link: nothing is transmitted until you follow it. Once you do, the operator of that site receives your request and its own privacy policy applies.

• GitHub is operated by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, a Microsoft company. See GitHub’s privacy statement.
• The documentation is part of this site and is covered by this same policy.

Nothing on this site is embedded from a third party: no maps, no videos, no fonts, no social plugins, no captcha. There are two exceptions. Google Analytics is loaded only with your consent, as described above, and the checkout page loads Paddle’s checkout script as it opens, because Paddle takes the payment.

If you write to us

There is no contact form on this website. If you email us, your address and everything in your message stays with us in order to deal with the matter — including any follow-up questions.

The legal basis is Art. 6 (1) (b) GDPR where your message concerns a contract or steps taken before entering into one, and otherwise our legitimate interest in answering enquiries addressed to us, Art. 6 (1) (f) GDPR. Where you have given consent, Art. 6 (1) (a) GDPR applies and you can withdraw it at any time with effect for the future.

We keep the correspondence until you ask us to delete it, until the matter is settled and there is no reason to keep it, and in any case no longer than a statutory retention period requires. Email reaches us over an encrypted transport, but email as a system is not end-to-end encrypted; please do not send anything genuinely confidential that way without asking us first.

The sitereal application itself

sitereal is a desktop application. It runs on your computer, against a folder on your disk. It contacts one server of ours, and only to check your license (listed below with its other connections). We receive no telemetry, no usage statistics, no crash reports and no copy of anything you build.

What stays on your machine

Your projects, the project file, your pages, your media, your git history and the application’s own settings are files on your disk. The application reads and writes them locally and sends them nowhere.

The connections it does make

• License check — when the application starts, it asks our license server whether anything about your license has changed. It sends the license token, a random identifier created once for this installation, and your computer's name, so that you can tell your machines apart in your account. Nothing about your project is sent, and a failed check changes nothing: the license already on your machine is what counts.
• Update check — once, when the application starts, it asks GitHub for the latest release. GitHub sees that request, including your IP address. Downloading and installing an update each wait for you to click.
• Icon sets — when you search for an icon, the names and drawings of the set you installed are fetched from the Iconify API (iconify.design) and cached in your project. No icon search, no request.
• GitHub sign-in — entirely optional, and only if you connect an account. The authentication is handled by the GitHub CLI on your machine and the token stays inside it; we never see it.
• Anything you configure yourself — a deployment target, a form endpoint, an MCP client — connects wherever you have pointed it.

These are the application’s connections, not this website’s, and they are listed here so that the whole picture is in one place. Legal basis for the update check and the icon search is our legitimate interest in a working, up-to-date application, Art. 6 (1) (f) GDPR.

Who else sees your data

Our host, Vercel, and, only if you allow statistics, Google. When you open the checkout or have an account, also: Paddle, which sells the license and handles payment as merchant of record and is therefore the seller in its own right, not our processor; Neon, which hosts the database holding your account and license, in Frankfurt; and Resend, which delivers the sign-in and license emails from its Ireland region. Vercel, Google, Neon and Resend are processors bound by contract. We do not sell personal data, we do not share it for advertising, and we pass it to anyone else only where we are legally obliged to, or where it is necessary to enforce or defend a legal claim.

There is no automated decision-making and no profiling within the meaning of Art. 22 GDPR.

Your rights

Under the GDPR you have, in respect of the data we hold about you:

• the right of access, Art. 15 — what we hold, where it came from and where it goes;
• the right to rectification of inaccurate data, Art. 16;
• the right to erasure, Art. 17, and to restriction of processing, Art. 18;
• the right to data portability, Art. 20, in a machine-readable form;
• the right to withdraw consent at any time, Art. 7 (3), with effect for the future;
• the right to object, Art. 21, to processing based on legitimate interest.

Exercising any of them costs nothing: email support@sitereal.app and we will answer within a month, as Art. 12 (3) GDPR requires.

Complaint to a supervisory authority

You may complain to a supervisory authority, in particular in the member state of your residence or place of work. The authority responsible for us is:

Encryption

This site is served over TLS. You can see it in the address bar: the address begins with https and the browser shows a closed padlock. While it is active, what you send to this site cannot be read by third parties in transit.

Changes to this policy

We update this policy when the site changes or the law does, for example if we ever add a contact form or a newsletter. The version in force is always the one published here, and the date at the top of the page says when it was last changed. Nothing is added retroactively: if a change requires your consent, you will be asked for it before anything is processed.

The documents

Everything we publish about how this site and this application work.