ControlNav Privacy Policy
Last updated: July 27, 2026
1. Data Controller
Responsible for ControlNav and its data processing:
Stefan Lohmaier
Weitlstr. 103
80935 München
Germany
Email: admin@slohmaier.com
Website: slohmaier.com
A data protection officer has not been appointed; there is no obligation to appoint one under Art. 37 GDPR or § 38 BDSG.
2. Summary
ControlNav’s core features run entirely offline on both Windows and Linux. The control-enumeration (UI Automation on Windows, AT-SPI on Linux), hotkey, and control-interaction functions never transmit control names, window titles, screen content, or keyboard input — none of this data ever leaves your device.
However, ControlNav is licensed software. License activation and periodic validation contact our licensing service at lic.slohmaier.com. This page explains exactly what is sent, what is stored, and on what legal basis.
- No telemetry, analytics, or crash reporting
- No tracking SDKs or advertising libraries
- Network access is limited to license activation/validation and automatic update checks
3. License Activation & Validation
When you activate or revalidate a license, ControlNav contacts lic.slohmaier.com (the licensing service operated by Stefan Lohmaier) and sends:
| Data | Purpose |
|---|---|
| License key (UUID issued at purchase) | Verify the key against LemonSqueezy’s records |
| Device hostname (your computer’s name) | Label the activation in the license dashboard |
Device identifier — a SHA-256 hash derived on Windows from the registry MachineGuid and the system volume serial number, and on Linux from the system machine ID (/etc/machine-id) | Bind the license to your device and enforce the per-device activation limit |
The device identifier is a one-way cryptographic hash. It cannot be reversed to identify your hardware, user account, or any personal information; it is used solely to count and verify device activations.
Validation requests are sent automatically in the background approximately every 14 days and contain only the license key, the product identifier, and the device identifier — not the hostname.
4. What Is Stored on Our Server
For each activation, the licensing service stores:
- The license key
- The customer email address (received from LemonSqueezy with the order)
- Order metadata (e.g. order identifier and product/variant of the purchase)
- The device identifier hash
- The device hostname
- Timestamps of activations and validations
- Your IP address (only the most recent one — it is overwritten on each request and removed after 90 days; no history is kept)
The licensing server is hosted by 1blu GmbH in Germany (data processing agreement per Art. 28 GDPR in place).
5. Legal Basis (GDPR)
- Art. 6 (1) (b) GDPR (performance of a contract): processing the license key, the customer email address, the order metadata, and the device binding (hostname + device identifier) is necessary to provide the licensed software you purchased.
- Art. 6 (1) (f) GDPR (legitimate interest): processing the IP address and the device fingerprint serves our legitimate interest in enforcing the per-device activation limit and preventing license abuse.
No separate consent is required for this processing.
6. Trial / Evaluation Period
The 7-day evaluation period is fully local and contacts no server. During the trial, ControlNav makes no licensing requests whatsoever. The licensing service only ever sees a paid activation — never an evaluation user.
7. Payments
Payments are processed entirely by LemonSqueezy, acting as Merchant of Record and as a separate, independent data controller. LemonSqueezy is US-based, so your payment data is processed in the United States. Stefan Lohmaier does not receive or store your payment details — only the license key, the customer email address, and the order metadata required to fulfil the license agreement. During activation, the device name you configured is also forwarded to Lemon Squeezy (USA) as the activation’s instance name. See LemonSqueezy’s privacy policy: https://www.lemonsqueezy.com/privacy
8. Automatic Update Checks
ControlNav checks for software updates once daily. The update check is a standard HTTPS GET request to the update feed on dl.slohmaier.com:
- Windows (via WinSparkle):
dl.slohmaier.com/appcast/controlnav-win.xml; the request includes the app version and WinSparkle version in the User-Agent header. - Linux (built-in updater):
dl.slohmaier.com/appcast/controlnav-linux.xml; the User-Agent header contains only the app version and the platform (ControlNav/<version> (linux)).
No hardware details, system profile, or personal information are sent. Downloaded updates (the Windows installer, or the Linux AppImage) are verified against an Ed25519 signature before installation. On Linux, only AppImage installations update themselves — and only after you confirm the update prompt; deb/rpm installations are never modified by ControlNav and are updated exclusively through your package manager.
You can disable automatic update checks on Windows in the Registry at HKEY_CURRENT_USER\Software\Stefan Lohmaier\ControlNav\WinSparkle\CheckForUpdates (set to 0). The Linux build currently has no setting to disable the daily check; nothing is ever downloaded or installed without your confirmation.
9. Local Data Storage
Windows: All preferences (hotkey, language, auto-start) are stored locally in the Windows Registry at HKEY_CURRENT_USER\Software\ControlNav. License state (key, signed validation token, last-validated timestamp) is stored at HKEY_CURRENT_USER\Software\ControlNav\License.
Linux: All preferences are stored in ~/.config/controlnav/settings.ini. License state (key, signed validation token, last-validated timestamp, trial start) is stored in ~/.config/controlnav/license.conf with file permissions restricted to your user. The timestamp of the last update check is kept in ~/.cache/controlnav-last-update-check; if auto-start is enabled, a launcher entry exists at ~/.config/autostart/controlnav.desktop.
On both platforms, this data never leaves your device.
To delete all local data: on Windows, uninstall ControlNav via Windows Settings and remove the registry key HKEY_CURRENT_USER\Software\ControlNav. On Linux, uninstall the package (or remove the AppImage) and delete ~/.config/controlnav/, ~/.cache/controlnav-last-update-check, and ~/.config/autostart/controlnav.desktop.
10. Retention & Your Rights
Your activation data is retained only for as long as it is needed: IP addresses are removed after 90 days, activations that have not been validated for about 18 months are deleted automatically, and the customer email address is anonymized about 12 months after the license is disabled or expires. Deactivating a device in the app immediately deletes that device’s activation record from the server.
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object (Art. 21) to the processing of the data held about you on the licensing server. You can also view and reset your own activations at any time via the self-service portal at https://lic.slohmaier.com/portal.
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (www.lda.bayern.de).
To exercise your rights, email support@slohmaier.com with the subject “Privacy Request — ControlNav”. Requests are handled within 30 days.
11. Changes to This Policy
Any material changes to this policy will be noted on the ControlNav product page at slohmaier.com/products/controlnav and in the release notes.