POSA Launcher privacy

Version 1 — 9 November 2026

1. Who is responsible

Kinematik Studio, Germany, e-mail [email protected]. Full provider details: https://kinematik-studio.com/imprint.

2. In short

• The launcher installs and updates POSA and shows our news. It has no advertising, no analytics and no tracking.
• Signing in happens on patreon.com in your browser. We never see your Patreon password or payment details, and we do not receive your name or e-mail address.
• Our service keeps, per account, only a pseudonymous account number, the POSA versions you activated (with tier and date) and the date of your download consent. For a tester key we also keep a short note on whom we gave it to (section 4a).

3. Without signing in

The launcher fetches What's new, the Dev log and Known issues from our service "posa-gate" (run on Cloudflare Workers). Like every internet request, these requests carry your IP address to Cloudflare. We do not log or store IP addresses; the service's logs are switched off. Cloudflare processes the address briefly to deliver the request and to protect the service against attacks, as our processor (section 10).

4. Signing in with Patreon

When you click "Sign in with Patreon", your browser opens Patreon's sign-in page. After you allow it, Patreon tells our service:

• your Patreon user ID,
• whether your membership of POSA's campaign is active, ended or not there, and which tier it entitles you to.

We use the access Patreon grants for this one check only; we do not store it. We do not ask for your e-mail address or your name. Patreon processes your data as an independent controller under its own privacy policy (https://privacy.patreon.com). The launcher then keeps a sign-in token for 30 days on your PC (see section 6).

Legal basis: Art. 6(1)(b) GDPR — we need the check to provide the membership you joined. Signing in is needed only to install POSA; without it the launcher shows the news, VR setup and help.

4a. Signing in with a tester key

If we invited you as a tester, you sign in with a personal tester key instead of Patreon. Our service never stores the key itself, only a one-way hash of it. For each key it keeps:

• a short note we wrote when we made the key, so that we know whom we gave it to (usually a first name or a nickname). It is never sent to the launcher;
• the key's tier, its end date, whether it may install test versions, and whether it was revoked;
• the time of the last sign-in, so that we can see whether a key is in use or has been passed on.

The account number for a key (section 5) is a salted hash of the key's hash. Testers give no download consent, because nothing is bought.

Legal basis: Art. 6(1)(b) GDPR (providing the test access you accepted) and Art. 6(1)(f) GDPR (the last sign-in time, our legitimate interest in stopping keys that were passed on). How long: until six months after the key ended or was revoked; then the key record and the account record of section 5 are deleted.

5. What our service keeps

For each account, one record:

• the account number: a salted one-way hash (SHA-256) of your Patreon user ID — it cannot be turned back into the ID without our secret salt;
• the POSA versions you activated, each with the tier and the date;
• the date on which you agreed that the download starts before the withdrawal period ends (membership terms, right of withdrawal).

Why: so that you can install the versions you activated again — on a new PC too, and after your membership ended — and as proof of your consent to the early download.

Legal basis: Art. 6(1)(b) GDPR for the activations (part of the membership); Art. 6(1)(f) GDPR for the consent date (our legitimate interest in being able to prove that the right of withdrawal ended).

How long: as long as we run the launcher service. On request we delete the record; your activated versions keep working on your PC, but we can no longer restore them on another PC. The consent date alone is then kept until the end of the third year after the year of your consent (the statutory limitation period), and deleted after that.

6. What stays on your PC

• Launcher settings (%APPDATA%\Kinematik Studio\POSA Launcher\launcher.json): channel, install folder, the 30-day sign-in token and the record of your download consent. Signing out deletes the token.
• "POSA download consent.txt" next to it: your confirmation of the download consent, for you to keep.
• Activation files in POSA's data folder (LocalLow\Kinematik Studio\POSA\licence): account number, version, tier, date and our signature. POSA reads them to know which features a version has; it does not send them anywhere.
• The installed POSA versions in the install folder you chose.

These files are needed for the launcher and POSA to work (§ 25(2) TDDDG); no consent is needed for them.

7. Downloads

POSA's files come from Cloudflare R2. For each download our service hands the launcher links that expire after a few hours and only work for the version your account may install. Cloudflare receives your IP address with each download (section 3). The files and the account records of section 5 are stored in Europe; Cloudflare may deliver requests through its worldwide network, including the USA (section 10).

8. Founder votes

If you have the Founder tier, you can vote on roadmap topics in the launcher. While the vote is open we keep your choice together with a keyed hash of the vote and your account number, so that each account votes once. When the vote closes, we keep only the percentages and delete who voted.

9. Problem reports

If you send a problem report from the launcher, the same rules apply as for problem reports from POSA (see POSA's privacy text, "Problem reports"): only what you choose to send, nothing in the background.

10. Service providers

• Cloudflare, Inc. (Workers, R2): runs our service and stores POSA's files and the account records, as our processor under Cloudflare's data processing addendum. Data may be processed in the USA; Cloudflare is certified under the EU-US Data Privacy Framework, and the addendum contains the EU standard contractual clauses.
• Patreon: sign-in and membership, an independent controller (section 4).
• Problem reports go to the recipients named in POSA's privacy text.

We do not sell or share your data with anyone else, and there is no automated decision about you beyond checking whether your membership includes a download.

11. Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and you can lodge a complaint with a supervisory authority. To exercise them, write to [email protected] and include the account number the launcher shows under Account, so that we can find your record. We hold no name or e-mail address with it, so this number is the only way to match a request to a record.

12. Changes

We will update this text when the launcher changes. The version and date are at the top.