Privacy Policy

1. Who we are

CloudSweep is provided by Burmarsh Systems Ltd, a company registered in Northern Ireland (company number NI743398), registered office 7 Mount Ober Gardens, Belfast, County Antrim, BT8 6BL, Northern Ireland. In this policy “we”, “us” and “CloudSweep” mean that company.

We are the data controller for the personal data described below. You can reach us at hello@cloudsweep.app.

2. What stays on your computer

This is the most important thing to understand about CloudSweep, so it comes first.

• Your Amazon Photos library never reaches us. The app talks to Amazon's servers directly from your machine, using your own signed-in session. Your videos, photos, thumbnails, filenames and album structure are never uploaded to, copied to, or visible to us.
• Your Amazon sign-in goes to Amazon, not to us. You sign in through an Amazon-hosted page shown inside the app. We never see your Amazon email, password or two-factor codes, and we do not store them. The session cookie Amazon returns is kept locally on your computer so you do not have to sign in every time.
• The library cache is local. To avoid re-downloading the same information repeatedly, the app keeps a cache of your library's metadata in your user profile folder. It never leaves your computer.
• Backups are saved locally; compression updates Amazon Photos. Backups are written to a folder on your computer or drive. Compression processes videos locally, uploads smaller replacements directly to your Amazon Photos account, and moves the originals to the Amazon bin. These files are not sent to CloudSweep’s servers.
• Uninstalling clears it. Removing CloudSweep clears the stored Amazon session and the cached library from your computer.

3. What we collect

Everything we hold falls into one of these five categories.

Buying a licence

Your email address, and the billing details you give Stripe at checkout. We never see or store your card details — those go straight to Stripe. From Stripe we receive and store your customer and subscription identifiers, your subscription status and renewal dates.

Using a licence

Your licence key, a random identifier generated for each computer you activate on, that computer's name as reported by your operating system (often something like “DESKTOP-A1B2C3” or “dean-laptop”), and the times of first activation and most recent check. This exists only to enforce the limit of three computers per licence.

Update checks

When the app checks for a new version it sends only your operating system, your release channel and the version you are running. No identifier, no licence key, and nothing that identifies you.

Anonymous usage

The app records when it is launched and which features are used — for example that a compression job started, how many videos it covered, and whether it failed — along with the app version and operating system. Nothing identifies you or your computer. There is no account, no licence key, no device id, and no identifier stored on your machine: each time the app runs it generates a random number that exists only in memory and is gone when you close it, so two sessions on the same computer cannot be connected to each other, by us or by anyone else. We never receive filenames, folder paths, video titles, search terms or anything you type. Because this data cannot be linked to a person, it is not personal data, and there is no setting to switch it off — there is nothing in it to opt out of. When something goes wrong we receive the type of error and a code for the line it came from, never the error message itself.

Counting people, for one day

So we can tell how many people use CloudSweep rather than only how many times it was opened, we work out a short code from the network address your device connects from. We never store your network address. The code is scrambled with a random value generated fresh each day and deleted within two days — so once that value is gone, nobody can turn the code back into an address, not us and not anyone who obtained our records. The code you get tomorrow is unrelated to today's. It lets us count people on a single day; it cannot follow you from one day to the next, and it is never joined to your licence, your purchase or anything else we hold. The same code is derived for visits to this website.

Contacting us

If you email us, or use the “Contact us” form inside the app, we hold your message and address so we can reply and keep a record of the conversation. Messages sent from the app also tell us which version of CloudSweep you are running, so we do not have to ask.

We do not collect anything else. There is no third-party analytics SDK, no advertising identifier, no session recording and no behavioural profiling in the CloudSweep application — the usage counts above go only to our own servers, and they are counts, not a record of an individual's behaviour. We do not sell or rent personal data to anyone, and we do not use it to build profiles or serve advertising.

4. Why we can use it (legal bases)

Under the UK GDPR we rely on the following:

• Performance of a contract — issuing and validating your licence, taking payment, renewing or cancelling your subscription, and providing support.
• Legitimate interests — enforcing the per-licence device limit, preventing fraud and licence sharing, keeping our service secure, and keeping records of payment events so we can resolve disputes. We have considered your rights and kept the data to the minimum that achieves this.
• Legal obligation — retaining transaction records for UK tax and accounting purposes.

5. Who we share it with

We use a small number of service providers, each processing data only on our instructions:

• Stripe — payment processing and subscription management. Stripe is the controller of the card data you give it; see the Stripe privacy policy.
• Railway — hosting for our licensing service and its database.
• Cloudflare — delivery and protection of this website.

We do not share your personal data with anyone else, except where we are required to by law, or where it is necessary to establish or defend a legal claim.

Some of these providers operate outside the UK. Where personal data is transferred abroad, it is protected by the safeguards required under UK data protection law — typically the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or a country the UK has judged adequate.

6. How long we keep it

• Customer, licence and payment records — for as long as your subscription is active, and then for six years after the end of the relevant accounting period, because UK tax law requires us to keep transaction records for that long.
• Device activations — until you deactivate that computer or the licence ends, whichever comes first.
• Support emails — normally up to two years after the conversation ends.
• Anonymous usage counts — 180 days, then deleted automatically.

7. This website

cloudsweep.app is a static site. It sets no cookies and runs no advertising scripts, so there is no cookie banner to dismiss.

We use Cloudflare Web Analytics to count visits. It is cookieless: it sets nothing on your device, stores no identifier, and does not follow you between sites or sessions. It tells us how many people viewed a page and roughly where they came from — never who they are. There is nothing to opt out of and nothing to consent to, which is why the site still has no cookie banner.

We also count page loads on our own server, so that we are not dependent on a third party to know how the site is doing. For each page load we record the page you looked at, the website that linked you to us (the address of the site only — never the specific page, its search terms or anything else in the link), and any campaign tag we put on our own links. We do not record your IP address, we do not work out your location from it, and we store nothing at all on your device — not even a temporary one-visit identifier. We do derive the same one-day code described above, so page loads can be counted as people and not only as visits; the address itself is never written down, and the code stops meaning anything within two days. Beyond that single day we cannot tell whether two page loads were the same person, and none of it is connected to you, to a licence or to anything else we hold. These counts are kept for 180 days and then deleted.

When you click a download link we record which of those sources the click came from, so we can tell which ones lead to downloads. That is a label on the link, not on you: it says nothing about who clicked, and it cannot be traced back to your visit.

On the landing page, we also count which download message was displayed and which button was clicked. We record the message, button position, page path, referring website and campaign label. Each event has a new, unrelated random identifier assigned on our server; it cannot connect events to a visit, an installation or a purchase. A click does not tell us whether the installer finished downloading. These events are kept for 180 days. Our own website counting is disabled when your browser sends Do Not Track or Global Privacy Control.

The site is served through Cloudflare, which processes standard request information — including your IP address, browser type and the page requested — in order to deliver the site and protect it from abuse.

8. Your rights

You have the right to ask us to give you a copy of the personal data we hold about you, to correct it if it is wrong, to delete it, to restrict or object to how we use it, and to receive it in a portable format. To exercise any of these, email hello@cloudsweep.app. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put it right first.

9. Security

Traffic between the app, this website and our servers is encrypted in transit with TLS. Licence data is held in a managed, access-controlled database. Administrative access is restricted to us, protected by a password and two-factor authentication, and administrative actions are logged. Card details never touch our systems.

No system is perfect. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the ICO and, where required, you — without undue delay.

10. Children

CloudSweep is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

If we change this policy we will update the date at the top of this page. If a change materially affects how we use your personal data, we will tell licence holders by email before it takes effect.

12. Contact

Questions about privacy, or a request about your data: hello@cloudsweep.app.

See also our Terms of Service.