Operator and contact
Roman Novikov PE (Tax Number 1020738), ofA13, The Grove, Cascavelle, Mauritius, operates StatePort. For privacy questions or requests, contact info@stateport.dev.
Website and analytics
Our website is hosted through Cloudflare. Normal delivery and security operations can process request data such as technical request information and security logs. We use Cloudflare Web Analytics for aggregate traffic, page-performance, and referral insights. The website does not use advertising pixels or a marketing account requirement.
The first-party funnel event layer is enabled. The website records a small allowlisted set of decision events — such as a pricing action, download-page platform availability, a checkout attempt, or a shared card landing — through its own endpoint. Each event carries only a bounded event name and coarse dimensions such as a page class or platform. It never includes email addresses, names, raw IP addresses, transaction identifiers, activation tokens, State Card contents, authentication material, share identifiers or keys, or full URLs and query strings. Shared-card landing pages never load third-party analytics scripts, and their events carry only a fixed page class.
For attribution across ordinary pages, this tab can retain only approved, shared source and campaign labels and their capture time in first-party session storage for up to 24 hours. A new tagged landing replaces them; an ordinary page visit does not extend their expiry. We store no visitor identifier, full landing URL, or raw referral data in this layer.
When the corresponding licensing service is deployed, approved labels accompany a checkout intent on our server; they are not sent to Paddle. They are used only within its 30-minute validity and cleared by daily cleanup after expiry. The service keeps aggregate daily trial and fulfilled purchase counts for 90 days, plus the daily cleanup interval. Those counts contain no customer, payment, licence, device, or State Card identifiers. Trial source remains unknown. We do not collect analytics inside Desktop or connect website visits to Desktop use through product identity.
See the published analytics boundarydocumentationfor the event vocabulary, retention, and access model. Analytics is never used as the source of truth for purchases, trials, entitlements, or product access.
Commerce and licensing
When Paddle checkout and StatePort entitlement services are enabled, Paddle processes payment, tax, fraud, billing, and buyer-support data as authorised reseller and Merchant of Record under itsPrivacy Notice. StatePort may receive and retain the limited Paddle-derived identifiers and status information needed to reconcile a transaction, issue or update a software entitlement, and provide activation support. StatePort does not receive or store raw payment-card details from Paddle checkout.
The entitlement design stores licence and transaction references, subscription status where relevant, activation timestamps, and hashed machine-slot identifiers. Support messages are processed when you choose to send them to us. We do not describe unimplemented commerce flows as active collection.
Local State Cards
State Cards and State Capsules are local product artifacts by default. StatePort does not automatically upload their contents to this website or to licensing services merely because you capture or open a State Card. Browser, API, and authentication-related state can be sensitive, so you remain responsible for review and redaction before sharing or export.
StatePort's dedicated sharing relay stores encrypted share ciphertext, not readable State Card contents. The decryption material stays in the share link fragment and is not sent to the website or relay in a query parameter. Ordinary shares do not include machine-local protected values, Development Profile or authentication state, credentials, passwords, cookies, or tokens. Where an installed build supports it, an eligible protected Persona is a separate, explicitly selected and encrypted handoff; recipient acceptance installs it into recipient-local protected storage rather than the ordinary Card.
Security and your choices
We use HTTPS for website and service traffic, keep service secrets on the server side, and design entitlements to be signed. These measures reduce risk but do not guarantee absolute security. You may contact us to ask about access, correction, deletion, or another privacy concern where applicable. Transaction records held by Paddle may also require a request through Paddle buyer support.