Na razie ta strona jest dostępna po angielsku.
Privacy Notice
Last updated: 25 października 2026
In short: our apps have no accounts, ads or tracking, and your photos, your files and the contents of your cards never pass through us. We only handle personal data when you buy from us or write to us. This website uses no analytics and no tracking cookies.
1. Who is responsible
The controller of your personal data is Jabuti Labs, São Paulo, SP, Brazylia. For anything about privacy, write to contato@jabutilabs.app.br. This notice follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and, for people in the European Economic Area and the United Kingdom, the GDPR and UK GDPR.
2. What stays on your devices
Photos on TV keeps the links of the albums you add, your settings and the unlock on the TV itself. The TV loads photos and videos directly from Google's servers, and Google handles that under its own privacy policy. Videos are stored temporarily on the TV while they play. The page you open on your phone to add albums is served by the TV over your home network and doesn't pass through us. We never receive your photos, your album links or your Google account.
Veracard runs its checks on your Mac. Your files and the contents of your cards never leave it, and your check history and settings stay on the Mac; deleting the app deletes them. Only if you choose to share a result with the Community does Veracard publish to Apple's CloudKit public database: the store name, platform and country, optionally the city and price, the card's claimed and real capacity, the verdict and the chip's manufacturer ID. These reports aren't linked to your identity; CloudKit only keeps an anonymous identifier per app, used so other people can hide or report entries. To remove a report you shared, write to us.
Wakeful, Extracta, DiskOrbit and Convert Anything work entirely on your Mac: your files, what's on your disk, your history and your settings never leave it. Wakeful uses your location only so that macOS lets it read the name of your Wi‑Fi network, for Wi‑Fi triggers; it never stores or shares it.
3. What we handle, why, and for how long
| When | Data | Why, and legal basis | How long |
|---|---|---|---|
| You visit this website | IP address and browser details, in the logs of our hosting provider (Cloudflare). Cloudflare also tells the site which country you're in, so pages open in your language; the site doesn't store it | To deliver the site and protect it against abuse. Legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)) | Kept briefly by Cloudflare under its policies. We keep no logs of our own. |
| You buy an unlock or a licence from us | A random purchase code created by the TV or Mac (not linked to your identity or to the device's serial number), the payment reference and the date; your email, so you can activate the app with it and we can send you your licence key if you lose it; and the CPF used with Pix, in scrambled (hashed) form. For a Mac app, also the licence key and a scrambled identifier of each Mac you activate, derived from the Mac's hardware ID, which itself never leaves the Mac | To unlock the app once the payment is confirmed, to let you restore it later or activate it on another of your Macs, and, for the Mac apps, to check about once a week that the licence wasn't refunded. Performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)) | As long as we offer the app, so you can restore the unlock. You can ask us to delete it sooner, but then you can't restore. |
| You pay (Kiwify) | Kiwify processes the payment and collects your payment details. We receive the order number, your name, email and country, the CPF if you are in Brazil, the product, the amount, the payment method and the date. | To deliver the unlock or licence, answer support requests, handle refunds and keep accounting records. Contract and legal obligation (LGPD art. 7, II and V; GDPR art. 6(1)(b) and (c)) | 5 years, as required by Brazilian tax law |
| You share a Veracard result | The Community report described in section 2, and CloudKit's anonymous identifier | To show other buyers which stores sell fake cards, and to let people hide or report entries. Your consent, given when you choose to share (LGPD art. 7, I; GDPR art. 6(1)(a)) | Until you ask us to remove it |
| You write to us | Your email address and whatever you choose to tell us | To answer you. Legitimate interest or contract (LGPD art. 7, V and IX; GDPR art. 6(1)(b) and (f)) | Up to 2 years after our last exchange |
When the TV or a Mac app asks our payment service whether a purchase went through or a licence is still valid, or a Mac app bought from us checks this website for updates, the request carries your IP address, as any internet request does. Cloudflare uses it to deliver the request. We don't store it.
We don't sell personal data, we don't use it for advertising, and we don't make automated decisions about you.
4. Who receives data
- Kiwify (Brazil), which processes payments by Pix and card, under its privacy policy.
- Apple (Apple Inc., United States, and Apple Distribution International, Ireland), which sells our Mac apps on the Mac App Store and stores Veracard's Community reports in CloudKit, under its privacy policy. From App Store sales we receive only totals, never your name or payment details.
- Cloudflare, Inc. (United States), which hosts this website and our payment service and forwards our email.
- Our email provider, which stores the messages you send us.
- Our accountant, and public authorities when the law requires it.
5. International transfers
Some of these providers process data outside Brazil and outside your country, for example in the United States and Ireland. These transfers rely on the safeguards the providers offer, such as standard contractual clauses (LGPD art. 33; GDPR art. 46), or on an adequacy decision where one exists.
6. Your rights
You can ask us to:
- confirm whether we hold data about you, and give you access to it;
- correct data that is incomplete, wrong or out of date;
- delete data, or anonymise or block data that is unnecessary or handled unlawfully;
- restrict how we use your data, or object to a use based on legitimate interest;
- give you your data in a portable format;
- tell you who we have shared it with;
- withdraw any consent you gave.
Write to contato@jabutilabs.app.br. We reply within 15 days. We may need to keep some data even after a request when the law requires it, such as accounting records. You can also complain to a data protection authority: in Brazil, the ANPD (gov.br/anpd); in the EEA or the UK, the authority where you live.
7. Security
We keep as little data as we can. Everything travels over encrypted connections (HTTPS). The keys to the payment providers are kept only in the encrypted settings of our payment service, never in the apps. CPFs are stored only in hashed form, and only we have access to our accounts with these providers.
8. Cookies
This website uses no analytics or third-party scripts, and no tracking cookies. If you pick a language with the link at the top, a small cookie named "lang" remembers that choice for a year, so pages keep opening in it; it holds only "en" or "pt". The apps keep their settings on your TV or Mac only.
9. Children
Our apps aren't aimed at children, and we don't knowingly collect children's personal data. Payments must be made by an adult or with a parent's permission.
10. Changes
If we change how we handle data, we'll update this notice and the date at the top. If a change is significant, we'll also say so on our website.