Privacy Policy

Last updated: Tuesday 22 September 2026

The short version

The Redatta app collects nothing. It makes no network connections at all. There is no account, no telemetry, no analytics, no crash reporting and no AI. Your worlds stay in a file on your Mac. We have never seen them and have no way to.

The rest of this page is about the small amount of information involved in buying Redatta and emailing us — which happens on the web, not in the app.

1. Who we are

Redatta is made by Richard Chappelow trading as Redatta (“we”, “us”), of Ground Floor, Radley House, Richardshaw Road, Leeds, LS28 6LE.

For the purposes of UK and EU data protection law we are the data controller for the information described below. You can contact us about anything on this page at hello@redatta.app.

We have appointed a representative in the European Union under Article 27 of the EU GDPR. If you are in the EU or EEA you can contact them instead of, or as well as, us — their details and the ways to reach them are in section 13.

2. The app

Redatta is a local application. Specifically:

• It makes no network connections, for any purpose
• There is no account and nothing to sign in to
• There is no telemetry, usage tracking or analytics
• There is no crash or error reporting
• The app reads no hardware identifiers, and your licence is not tied to a particular Mac
• No AI or machine learning service is used. Nothing you write is sent to any model. World Health checks your world against itself using fixed rules, computed on your Mac
• Your worlds are stored as .world files wherever you choose to put them on your own disk

Because the app transmits nothing, there is no app data for us to hold, share, lose or be compelled to hand over. There is also nothing for you to opt out of.

3. Buying Redatta

Purchases are handled by Paddle.com Market Ltd, which acts as the merchant of record and is the legal seller of your licence. When you buy, Paddle collects and processes the information needed to take payment and comply with tax law — typically your name, email address, country, payment details and applicable tax information.

We never receive your payment card details. Paddle does not share them with us.

Paddle provides us with the order information we need to issue your licence and support you: your name, email address, country and order reference. Paddle is a separate data controller for its own processing, and its handling of your information is covered by Paddle’s own privacy policy at paddle.com.

Our lawful basis: performance of our contract with you (issuing your licence and supporting your purchase), and our legal obligations in respect of business and tax records.

4. Licence keys

If you buy Redatta we hold your email address and order reference so that we can issue your licence key and re-issue it if you lose it. Your licence key is verified by the app on your own Mac and is not checked against any server.

Your name and email address are encoded inside the key itself, so that Redatta can show who it is licensed to and so that a key found in circulation can be traced back to the order it came from. That encoding happens here, when we generate the key; the app only reads what is already in it. It does mean your key identifies you, so treat it like a receipt rather than a password — worth avoiding in public posts and screenshots.

The app reads no hardware identifier from your Mac. Your licence is not tied to a particular machine, and nothing about your computer is examined, stored or sent anywhere.

Lawful basis: performance of our contract with you, and our legitimate interest in protecting Redatta from unlicensed copying.

5. Emailing us for support

If you email us, we hold that email and our reply so we can help you and refer back if you write again. Please don’t send us your .world file unless we specifically ask and you’re comfortable doing so — if you do, we use it only to investigate your issue and delete it afterwards.

Lawful basis: performance of our contract with you, and our legitimate interest in providing support and keeping a record of it.

6. Update emails

If you give us your email address to be told about new versions, we hold that address and use it for that purpose only. We do not sell, rent or share it, and we do not use it for anything other than release announcements.

Our emails contain no tracking. We do not record whether you opened an email or whether you clicked a link in it.

Every email includes an unsubscribe link. You can also ask us to remove you at any time by replying.

Our email list is operated using Shipmail, who process the addresses on our behalf — see section 11 for where.

Lawful basis: your consent, which you may withdraw at any time.

7. The website

We use no analytics, no tracking pixels and no advertising cookies on redatta.app, and we set no cookies of our own.

redatta.app is served through Cloudflare, which sits in front of the site as a reverse proxy. Every request to the site passes through Cloudflare’s network before it reaches us, and Cloudflare processes visitors’ IP addresses in order to route requests, serve cached content and block malicious traffic. On the plan we use:

• We can see aggregated traffic statistics — request counts, bandwidth and response codes — for up to 30 days. These are totals, not records of individual visitors
• Sampled security and firewall events, which can include IP addresses, are available to us for 24 hours
• Per-request raw logs are not available on our plan. We cannot see them and do not hold them

Cloudflare may set a __cf_bm cookie on your device as part of separating human visitors from automated traffic. It expires after about 30 minutes, contains no identifier that corresponds to you, and is not used to follow you between websites. If you are challenged as a suspected bot, a cf_clearance cookie records that you passed. Both are strictly necessary for the site’s security, which is why there is no cookie banner asking you about them.

Lawful basis: our legitimate interest in keeping the site available and defending it against abuse.

Do Not Track. Some browsers can send a “Do Not Track” signal. Because we do not track visitors across websites in the first place, there is nothing for that signal to switch off, and we do not respond to it differently.

The Paddle checkout runs on Paddle’s own infrastructure and is subject to Paddle’s privacy policy and cookie practices.

8. Security

We hold very little, which is the main protection. Beyond that:

• The accounts we use with Paddle and Shipmail are protected by two-factor authentication
• Both providers encrypt stored data at rest
• Only the person running Redatta can access order records, the mailing list or support email

No system is perfectly secure, but if a breach ever affected your information and posed a risk to you, we would tell you, and we would report it to the Information Commissioner’s Office within 72 hours where the law requires it.

9. Automated decisions

We do not carry out automated decision-making or profiling. No decision affecting you is made about you by a machine, and nothing about you is used to build a profile.

10. How long we keep things

11. Where your information goes

We are based in the UK.

Shipmail processes our mailing list within the European Economic Area. Transfers from the UK to the EEA are covered by the UK’s adequacy regulations, so no additional safeguard is required.

Cloudflare, which serves redatta.app, operates a global network and is headquartered in the United States. Transfers to Cloudflare are made under the safeguards required by UK data protection law, as set out in Cloudflare’s data processing addendum.

Paddle may process information outside the UK, including in the United States. Where that happens, transfers are made under the safeguards required by UK data protection law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

We do not sell your information, share it for advertising, or pass it to anyone other than the service providers named on this page.

12. Your rights

Under UK and EU data protection law you have the right to:

• Ask what information we hold about you and get a copy of it
• Have inaccurate information corrected
• Ask us to delete information, where we have no continuing reason to keep it
• Object to, or ask us to restrict, our processing
• Withdraw consent where consent is our basis (for example, update emails)
• Ask for your information in a portable format

To exercise any of these, email hello@redatta.app. We will respond within one month.

If you’re unhappy with how we’ve handled your information you may complain to the Information Commissioner’s Office (ico.org.uk), the UK’s data protection regulator. If you are in the EU you may complain to your own national supervisory authority.

13. If you are in the EU or EEA

We sell Redatta from the UK, which is outside the European Union. Because we offer the app to people in the EU, we have appointed a representative there under Article 27 of the EU GDPR. They are a point of contact inside the Union for you and for data protection authorities, and they can be addressed on any question about how we handle your information.

Our EU representative is:

Euverify Ltd (registered in Ireland, company number 781168)
Unit 3D, North Point House
North Point Business Park
New Mallow Road
Cork, T23 AT2P
Ireland

Email: gdpr@euverify.com

They also run a portal where you can confirm that they really are our appointed representative and send us a request in the same place — a copy of your information, a correction, a deletion, or anything else listed in section 12:

https://gdpr.euverify.com/verify/e3f024ab-5ce2-41a4-a256-8a2ddb86f9fb

Requests sent that way are logged and tracked by Euverify and passed to us.

Going through the representative is your choice, not a requirement. Emailing hello@redatta.app reaches us directly, and we handle a request the same way whichever route it arrives by. Either way, you keep the right to complain to the supervisory authority in your own country.

14. If you are in California

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — the two things California law means by “sell” and “share”. We have not done either in the past twelve months, and we do not do it with the personal information of anyone under 16.

The categories of personal information we collect are:

We collect these for the purposes described in sections 3 to 7, from you directly and from Paddle. We do not collect sensitive personal information, so there is nothing for you to limit the use of. We disclose personal information only to the service providers named on this page.

You have the right to know what we hold, to have it corrected, to have it deleted, and not to be treated differently for exercising any of those rights. We will honour these requests whether or not California law formally applies to us. Email hello@redatta.app; we reply within 45 days. Our response to Do Not Track signals is described in section 7.

We do not disclose personal information to third parties for their own direct marketing purposes, so there is nothing to request under California’s “Shine the Light” law.

15. If you are elsewhere in the United States

Several other states — including Virginia, Colorado, Connecticut, Texas and Oregon — have their own consumer privacy laws, most of which apply only above thresholds we do not meet. If you live in any US state with a privacy law, we will honour the rights listed in sections 12 and 14 regardless of whether that law formally applies to us. Email hello@redatta.app.

16. Children

Redatta is not directed at children. We do not knowingly collect information from anyone under 13, and if we learn we have, we delete it.

17. Changes to this policy

If we change how we handle information — in particular if the app ever makes a network connection — we will update this page and change the date at the top before that version ships.

18. Contact

Richard Chappelow trading as Redatta
Ground Floor, Radley House
Richardshaw Road
Leeds
LS28 6LE
hello@redatta.app