Privacy Policy

Last updated: 15 August 2026

Aldo Reborn (the "Application") is desktop software for macOS that lets you compose photo fanzines, with print imposition handled automatically. The Application is published and distributed by Rémi Courtillon.

This policy describes what personal data is processed by the Application and by the website aldoreborn.com, for what purpose, who it is shared with, and what rights you can exercise. It is written to comply with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and with French data protection law.

Use of the Application is governed by the Terms of Use and Sale, which also serve as the End User Licence Agreement.

• Name: Rémi Yann Courtillon, a natural person
• Status: sole trader (entrepreneur individuel), registered in France
• Trading name: ENNEA, REMI COURTILLON
• SIREN: 948 127 386. SIRET: 948 127 386 00019
• Registered address: 52 Le Haut Léhée, 35360 Saint-Uniac, France
• Contact for data protection matters: hello@aldoreborn.com

No data protection officer has been appointed. Data protection requests are handled directly at the address above. Full publisher details are on the legal notice page.

Aldo Reborn is built to be frugal with data. The projects, photos and documents you create in the Application stay on your machine and are never sent to a server. Saving a project and exporting a PDF happen entirely on your disk, with no network exchange at all. The Application contains no analytics, no telemetry and no behavioural tracking.

Only two network flows exist in the Application. Both are described below.

3.1 Licence activation and revalidation (Lemon Squeezy)

Purpose: to check that you hold a valid right of access, so that exporting your documents can be unlocked. Licences are sold by Lemon Squeezy, which acts as Merchant of Record. Lemon Squeezy, and not the publisher of Aldo Reborn, handles the payment, the invoice, the tax and the refunds.

During the seven-day free trial, the Application sends nothing to Lemon Squeezy. There is no licence key stored yet, so no request is made. The trial start date is written once to a local file on your machine and never leaves it.

What is sent to Lemon Squeezy when you activate a key:

• the licence key you type in;
• an anonymous installation identifier: a random identifier generated on your machine the first time you activate, then kept in a local file. It is never derived from your computer name, your system account or any hardware identifier, and it contains nothing that identifies you. It exists only so that an installation can be attached to your licence and, if you wish, deactivated again.

What comes back and is kept on your machine, in the data folder of the Application:

• the licence key itself;
• the installation identifier, and the product and variant you bought;
• the status of the licence (active, expired, deactivated);
• the expiry date, where there is one, and the date of the last successful check;
• the email address used for the purchase, as passed on by Lemon Squeezy. It is kept locally so it can be shown in the account screen of the Application. It is not passed on to anyone else.

How often the check happens: when a licence key is stored, the Application contacts Lemon Squeezy once at every launch to confirm that the licence is still valid, which covers refunds, revocations and expiry. There is no timer and no background schedule. If the check cannot be made, for example because you are offline, the Application keeps working from its local record: exporting stays available for 30 days after the last successful check, and is locked after that until a check succeeds. Editing is never locked.

IP address: as with any request sent over the internet, your IP address is visible to the servers of Lemon Squeezy at the moment of the request. The Application does not read, keep or transmit that address itself. What Lemon Squeezy does with it is governed by their own privacy policy.

3.2 Update check (GitHub)

Purpose: to find out whether a newer version of Aldo Reborn is available, and to download it.

How it works: shortly after launch, and then roughly every six hours, the Application reads the public list of published releases hosted on GitHub. The comparison between that list and the version you are running happens on your machine. Downloading a new version only starts when you click to start it, and an update that has been downloaded is installed the next time you quit the Application.

What is sent to GitHub: nothing from the Application. The request is a plain read of a public feed and carries only standard HTTP headers, with a generic user agent identifying the packaging tool. No device identifier, no installation identifier and no licence information is attached, and the version number you are running is not sent. As with any request sent over the internet, your IP address is visible to the servers of GitHub at that moment.

3.3 What is not collected

• No telemetry, no usage statistics, no crash reporting: the Application does not measure what you do with it and sends no usage or crash report of any kind.
• No user content leaves your machine: your project files, the photos you import and the PDFs you export are read and written on your own disk only.
• No account is created on the publisher side: the model is zero account. Your access rests on the licence key issued by Lemon Squeezy, not on an Aldo Reborn account.
• Your font list stays local: the Application reads the fonts installed on your system so you can choose one. That list is used on your machine and is never transmitted.

3.4 The website aldoreborn.com

The website sets no cookie and runs no analytics. There is no tag manager, no audience measurement, no advertising script and no visitor profiling. You are not tracked from one page to the next.

Three things do involve a third party, and they are listed here for completeness:

• Hosting: the site is hosted by Cloudflare, which processes standard request data such as your IP address, your user agent and the page requested, in order to serve the site and keep it secure.
• Download clicks: when you click a download link, the server records the page you came from, the country Cloudflare derives from your IP address, and which file was served. This is used to know how many people download the app. Your IP address itself is not recorded by our own code.
• Scripts loaded from another server: the checkout script of Lemon Squeezy is loaded on every page so that the buy overlay can open. Because that file comes from Lemon Squeezy's servers, your IP address and your user agent are visible to Lemon Squeezy when a page loads. This is the only third-party file the website loads. The Inter typeface is served from our own domain, so no font provider sees your visit.

• Licence activation and revalidation: performance of the contract, that is, supplying the paid software you ordered. Article 6(1)(b) GDPR.
• Update check: legitimate interests, that is, keeping the software secure and working correctly. Article 6(1)(f) GDPR.
• Serving and securing the website, including the download counter: legitimate interests, that is, delivering the site, protecting it against abuse and knowing how many people download the app. Article 6(1)(f) GDPR.

No other third party receives data from the Application or from the website. If a service is added later, this policy will be updated before it goes live.

• On your machine: the licence record, the anonymous installation identifier and the trial start date are kept in the data folder of the Application for as long as it is installed, or until you deactivate the licence from inside the app. On macOS that folder is ~/Library/Application Support/aldo-reborn/. Removing the Application does not necessarily remove that folder, so you can delete it yourself if you want nothing left behind.
• At Lemon Squeezy: according to their own retention rules, which cover invoicing and their accounting and tax obligations. See the Lemon Squeezy privacy policy.
• At GitHub: according to their own server log retention rules, set out in the GitHub General Privacy Statement.
• At Cloudflare: according to their own log retention rules. See the Cloudflare privacy policy.

• Lemon Squeezy is a United States company, so a transfer outside the European Union takes place when a licence is bought or checked. Their privacy policy states that any transfer of personal information from the European Economic Area to countries outside it will be protected by appropriate safeguards, for example by using standard data protection clauses approved by the European Commission.
• GitHub is a United States company and a subsidiary of Microsoft. Their privacy statement says they generally rely on the standard contractual clauses published by the European Commission under Commission Implementing Decision 2021/914, and that they comply with the EU-U.S. Data Privacy Framework.
• Cloudflare is also a United States company. The transfer mechanisms it relies on are set out in its own privacy policy, linked above and available on its website.

Subject to the conditions set by the applicable rules, you have the following rights over data concerning you:

• Access: obtain a copy of the data concerning you.
• Rectification: have inaccurate data corrected.
• Erasure: ask for your data to be deleted. In practice this means deactivating your licence and deleting the local data folder, as described in sections 3.1 and 6.
• Portability: receive the data you provided in a structured, commonly used and machine readable format, where that right applies.
• Objection and restriction: object to processing based on legitimate interests, or ask for processing to be restricted.

To exercise any of these rights, write to hello@aldoreborn.com. Please describe your request clearly, and include the email address used for your purchase if your request concerns a licence.

You also have the right to lodge a complaint with a supervisory authority. The publisher is established in France, so the competent authority is the Commission nationale de l'informatique et des libertés (CNIL), www.cnil.fr. If you live in another country of the European Union or the European Economic Area, you may instead lodge your complaint with the supervisory authority of your own country.

For data held by Lemon Squeezy, such as your email address and your payment history, or by GitHub or Cloudflare, you can also make your request directly to those companies under their own privacy policies.

• The licence information kept on your machine sits in the data folder of the Application, protected by the access rights of your user session. The licence key is stored base64-encoded, which is an encoding and not encryption. It is not held in the macOS Keychain, a deliberate choice that avoids an authorisation prompt at every launch and after every update. The data concerned is the licence record listed in section 3.1.
• All communication with Lemon Squeezy uses HTTPS.
• The macOS application is signed with an Apple Developer ID and notarised by Apple, so macOS can verify that the copy you run has not been altered since it was built.
• The security measures applied by Lemon Squeezy, GitHub and Cloudflare are set out in their own policies.

This policy may be updated to reflect changes to the product or to the applicable rules. The version in force is the one published on this page, and the date of the last update is shown at the top. If you use Aldo Reborn, it is worth checking this page from time to time.

For any question about this privacy policy, write to hello@aldoreborn.com, or to Rémi Courtillon, 52 Le Haut Léhée, 35360 Saint-Uniac, France.