Privacy policy

Last updated: 31 October 2026

This policy explains what personal data is processed when you use the CloudPouch desktop app, the website cloudpouch.dev and the documentation at docs.cloudpouch.dev, why it is processed and what rights you have. It applies to every plan: Free, Pro trial, Pro and Team.

Who is responsible

The controller of your personal data is Paweł Zubkiewicz, trading as Paweł Zubkiewicz Consulting, ul. Marca Polo 39/9, 51-504 Wrocław, Poland, tax ID (NIP) 8981957769. For any question about your data, or to use your rights, write to hello@cloudpouch.dev. We have not appointed a data protection officer.

In short

• The desktop app analyses your AWS costs on your computer. Your AWS credentials, cost data and scan results do not reach us, unless they are part of an error report that you decide to send.
• Our licensing service receives your email address when you register, and your license key, a machine identifier and, when available, the app version each time the app starts.
• Paddle sells Pro licenses as merchant of record and handles your payment details.
• On cloudpouch.dev, Hotjar and Google Analytics load only after you click Accept.

The CloudPouch desktop app

What stays on your computer

CloudPouch signs in to AWS with the profiles already on your computer: the ~/.aws/config and ~/.aws/credentials files, AWS SSO and the other sign-in methods of the AWS CLI. It calls AWS directly from your computer, so these requests run under your AWS account and your agreement with AWS and do not pass through our servers.

The app keeps its data in local files: the cost and resource data it fetches, Savings Scan results, its settings (including your license key) and a log file. Temporary credentials from an AWS SSO sign-in are stored in the folder ~/.cloudpouch-aws-sso-client-credentials and expire after 24 hours. CloudPouch adds no encryption of its own to these files, so they are as safe as your computer and your user account. None of this data is sent to us, except what an error report contains when you choose to send one.

Registration for Free or the Pro trial

To register, you enter your email address and accept the License Agreement. The app sends the address, a machine identifier and the plan you chose to our licensing service, which emails you a 6-digit code. After you enter the code, the service creates your license key, the app shows it, and a copy arrives by email.

We process this data to give you the license you asked for (Article 6(1)(b) GDPR). An email address is required: without it we cannot issue a license. To stop abuse of registration, the service also keeps the IP address of the request and your email address in a rate-limit record for about 48 hours (Article 6(1)(f) GDPR: our legitimate interest in protecting the service).

License check

Each time the app starts, it sends your license key, a machine identifier and, when available, the app version to our licensing service, which replies with your plan. A machine identifier here means the ID that your operating system gives your computer. With your license, the service saves the time of the check, the machine identifier and, when the app sends it, the app version; each check replaces the values of the previous one, so the record shows the computer that checked last. It also keeps a history of checks per license key for statistics on how licenses are used. CloudPouch cannot run without this check, as it has no offline mode.

Legal basis: performing the license agreement (Article 6(1)(b) GDPR) and, for the statistics, our legitimate interest in knowing how CloudPouch is used (Article 6(1)(f) GDPR).

Updates

When the app opens its window, it checks GitHub Releases (the CloudPouch/CloudPouch.dev repository on github.com) for a newer version; updates are downloaded from there as well. GitHub therefore receives your IP address and the technical details of these requests. Legal basis: our legitimate interest in keeping the app up to date (Article 6(1)(f) GDPR).

Error reports

An error report is sent only when you click Send in an error dialog. Before sending, you can choose View the data to see what the dialog has collected for the report; it is shown only if you ask, and Send does not require opening it. A report holds a machine identifier, the app version, platform, operating system and language settings, your plan, your notes, the error that occurred, whether the AWS CLI configuration files exist, a cleaned copy of the app settings without the license key and the MCP access token, and the end of the app log. Email addresses, AWS account IDs, AWS access key IDs and the user name in file paths are removed from the notes and the log part before sending. AWS resource names are not removed, so the log part can show them. A report sent from the registration dialog also includes the email address you typed there.

Reports help us find and fix errors and answer you (Article 6(1)(f) GDPR: our legitimate interest in a working product). A notice with the report details is emailed to our mailbox. Reports are kept without a fixed end date; you can ask us to delete yours.

No usage analytics

The app sends no usage analytics and no automatic crash reports.

AI assistants (MCP server)

CloudPouch includes an MCP server for AI assistants, which is off by default. Once you turn it on, it listens only on your computer (127.0.0.1) and answers only clients that present its access token. The assistant you connect, for example Claude Code, Codex or Cursor, can then read the cost and savings data that CloudPouch holds, and ask CloudPouch to refresh cost data or run a Savings Scan. It cannot change your AWS resources through CloudPouch.

CloudPouch itself does not call any AI model and has no AI provider account or key. Your assistant handles what it reads under its own terms: if it sends that data to its model provider, this happens between you and that provider, which is not our processor. Check the privacy settings of your assistant before you connect it.

Purchases and Team licenses

A Buy button opens the checkout of Paddle.com, which sells CloudPouch Pro licenses as merchant of record. Paddle processes your payment and billing data as an independent controller under its own privacy notice. Its script loads only after you click. While the checkout is open, your browser also connects to global.localizecdn.com and o522631.ingest.sentry.io; these connections come from Paddle's checkout, not from our site.

If you arrived through a link with campaign tags (the parameters utm_source, utm_medium, utm_campaign, utm_content, utm_term and utm_id in the address), the site passes their values to Paddle with your order, cut to 100 characters each. When the tags with their names come to more than 1,000 characters in total, or contain a character outside plain ASCII (for example, a Polish letter), the site passes none of them. The site does not check whether the values hold personal data, so if a link puts, for example, an email address there and the tags are passed, that email address reaches Paddle and, with the order details, our licensing service. We use the tags to see which link a purchase came from (Article 6(1)(f) GDPR: our legitimate interest in knowing which of our links lead to purchases).

After a purchase, Paddle sends our licensing service the order details: your email address and name, the Paddle order, subscription and customer numbers, the plan, any coupon, the amounts and currency, the next billing date, your marketing preference and any campaign tags that the site passed. With them we create your license key, email it to you and keep your subscription status current after a renewal, a failed payment or a cancellation (Article 6(1)(b) GDPR). The full message from Paddle is also written to our server log.

Team licenses are not sold through Paddle. You ask for an offer by email to hello@cloudpouch.dev, and we issue the licenses ourselves; your messages are used to prepare the offer and the licenses (Article 6(1)(b) GDPR). Our admin tool can also add the name of the person who holds a license to its record, so that we know who owns each license (Article 6(1)(f) GDPR: our legitimate interest in identifying license holders).

Emails from us

Amazon SES sends our emails from hello@cloudpouch.dev: the registration code, your license key, notices about your trial or subscription, and the download link that you request on the website. Replies and copies reach our mailbox, which Google Workspace hosts.

When you register for Free or the Pro trial in the app, or buy Pro, your email address is also added to our mailing list at Mailchimp, with a tag for your plan (Free, Pro trial, ended trial or paid subscription). We use the list to send news about CloudPouch, such as new versions and offers. Legal basis: our legitimate interest in telling our users about CloudPouch (Article 6(1)(f) GDPR). Mailchimp requires marketing emails sent through its service to contain an unsubscribe mechanism. You can also object at any time by writing to hello@cloudpouch.dev, and we will remove you from the list.

The website cloudpouch.dev

Download link form

On phones and tablets, the site offers a form that asks for your name, your email address and an optional message. We use them to email you a link to download CloudPouch for your computer and to answer your message (Article 6(1)(b) GDPR: a step you asked for). Giving this data is voluntary, but without an email address we cannot send the link. The entry is saved in our database on Amazon Web Services and appears in our server log, Amazon SES sends the email, and a copy reaches our mailbox.

Analytics (optional)

With your consent, Hotjar records how visitors scroll, click and move on this site and builds heatmaps from it. Hotjar does not load until you click Accept. Google Analytics 4, also only after Accept, counts visits, shows which link or campaign a visit came from (the utm_ tags in the address you arrived with) and counts clicks on the download, demo and Buy buttons. It also counts when the interactive demo opens and which of its buttons and panels you click, never what you type there. After a purchase on this site, it also receives the Paddle order number, the amount, the tax and the currency. Its advertising features are off. The legal basis is your consent (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law), which you can withdraw at any time in Cookie settings.

Technical data

Every visit sends your IP address and browser details to Amazon CloudFront, which hosts and delivers the site. GitHub receives your IP address when you download the installer from GitHub Releases, and sometimes when the page looks up the latest version itself. The documentation at docs.cloudpouch.dev is delivered by Amazon CloudFront as well and uses no analytics or cookies. Legal basis: our legitimate interest in running a working website (Article 6(1)(f) GDPR).

Amazon CloudFront also keeps an access log of every request to cloudpouch.dev: your IP address, the time, the address you asked for (with any campaign tags such as utm_source), the page you came from and your browser type. We use it to count visits and downloads per link or campaign, which works even if you reject cookies, and to keep the site secure. Log files are deleted after 365 days. The legal basis is our legitimate interest in knowing which of our channels bring visitors (Article 6(1)(f) GDPR); you have the right to object to it (see Your rights).

Server logs and monitoring

Our licensing, error report and form services run on Amazon Web Services and keep logs. Access logs record the IP address, time and path of each request. The messages that our server functions write can include your email address, license details and the messages from Paddle. In addition, the functions send traces of their work, which can contain the data of a request, to Lumigo, a monitoring service. We use logs and traces to run the services, find errors and keep them secure (Article 6(1)(f) GDPR). Server logs have no fixed expiry date.

Cookies and similar storage

Necessary, always on:

• cloudpouch.consent (localStorage): your cookie choice, kept for about 6 months.
• @@scroll|… (sessionStorage): scroll position, deleted when you close the tab.
• cloudpouch.latest-installers.v1 (sessionStorage): the latest installer links, kept for 1 hour.
• Paddle's own entries, set only after you click a Buy button.

Optional, only after Accept:

• Hotjar cookies and browser storage entries whose names start with _hj; they recognise a browser and a visit.
• Google Analytics cookies whose names start with _ga; they recognise a returning browser and its visits.

To change your choice, open Cookie settings at the bottom of any page. Withdrawing consent stops Hotjar and Google Analytics and deletes their cookies on this site; it does not affect recordings or counts made before. Your browser settings also let you block or delete cookies at any time.

Who receives your data

• Amazon Web Services: hosting of the website, the licensing, error report and form services, their databases and logs, and email sending (Amazon SES).
• Google: our Google Workspace mailbox and, with your consent, Google Analytics.
• Mailchimp: our mailing list.
• Lumigo: monitoring of our server functions.
• Hotjar: recordings and heatmaps of the website, with your consent.
• GitHub: installer downloads and app updates.
• Paddle: payments and billing, as an independent controller.

The AI assistant that you connect to CloudPouch, and its model provider, receive data from you, not from us.

Transfers outside the EEA

Our services, databases and logs run on Amazon Web Services in the United States (region us-east-1). Google, Mailchimp, Lumigo, Hotjar, GitHub and Paddle may also process data outside the European Economic Area. Each of these recipients names, in its data processing terms or privacy notice, the safeguards it uses for such transfers, such as Standard Contractual Clauses or the EU-US Data Privacy Framework. You can ask us for a copy of these safeguards by writing to hello@cloudpouch.dev.

How long we keep data

• Registration codes and the related email address: about 30 days.
• IP address and email address in registration limits: about 48 hours.
• Your license record (email address, machine identifier, plan, purchase details) and the history of license checks: no fixed end date.
• Error reports, form entries and our emails: no fixed end date.
• Server logs: no fixed end date.
• Traces at Lumigo: the default retention of our Lumigo plan (14 days on Lumigo's Basic, Standard and Plus plans).
• Mailing list: until you object or ask us to delete your data.
• CloudFront access logs: 365 days.
• Hotjar recordings and heatmaps: the default retention of our Hotjar plan, at most 12 months from the day they are recorded.
• Google Analytics data: 14 months
• Your cookie choice: about 6 months.

For data kept without a fixed end date, the section “Your rights” below explains how to request its deletion or object to its processing.

Your rights

Under the GDPR you have:

• the right to access your data and get a copy of it,
• the right to have it corrected,
• the right to have it deleted,
• the right to restrict its processing,
• the right to data portability, for data processed under a contract or your consent,
• the right to object to processing based on our legitimate interest,
• the right to withdraw consent at any time, without affecting the processing done before.

Write to hello@cloudpouch.dev. You may also complain to a data protection authority; in Poland that is the President of the Personal Data Protection Office (uodo.gov.pl).

Do you have to give us data?

No law requires it. An email address is needed to register, to buy and to receive the download link, and the license check data is needed for the app to run. Analytics on the website are optional.

No automated decisions

Your data is not used for decisions based solely on automated processing that have legal or similarly significant effects on you (Article 22 GDPR).

Changes

When this policy changes, we update the date above and, if the change affects cookies, ask for your choice again.