PRIVACY POLICY

Effective Date: August 16, 2026

Out of Distribution Labs LLC ("OOD Labs," "we," "us," or "our") operates the website ood-labs.com (the "Site") and develops desktop software, including Sentinel. This Privacy Policy explains what information we collect, how we use it, and your choices regarding that information.

We collect very little data. We do not use cookies, tracking pixels, or third-party analytics on our Site. We do not maintain user accounts. This policy is written to be straightforward and honest about what we do and do not do with your information.

1. Information We Collect

Information You Provide Directly

We collect personal information that you voluntarily submit through forms on our Site:

• Release updates opt-in (on our Download page): your email address. The consent box is unticked by default and the form cannot be submitted without it, so we only ever receive an address where consent was given at the moment of signup. We store the resulting subscription, not a separate consent record. Downloading our software never requires an email address. The form also contains a hidden anti-spam field that is always empty for genuine visitors; if it is filled in, the submission is rejected and nothing is stored.
• Waitlist signup form (retired): until August 2026 we ran a waitlist form that collected your name, email address, and optionally a social media handle. That form has been removed and replaced by the release updates opt-in above. We still hold the details of people who signed up, and they are covered by this policy.
• Contact/support form: your name, email address, the product your inquiry relates to, and your message content. This information is used to respond to your inquiry.

Information We Collect When You Purchase

When you buy a license, our payment provider notifies our systems and we process the following about you, without you submitting a form to us directly:

• Sent to our licensing provider (Keygen.sh) in order to issue your license: your email address, your first and last name, your full name (used to label the license), and your order identifier and order number from LemonSqueezy.
• Sent to our email provider (Resend) in order to deliver your license key: your email address and your name.
• Added to our customer email list: your email address and your first and last name, so we can tell you about updates to the software you bought. Every such email contains a way to opt out, and opting out does not affect your license or your ability to receive support.

Information Collected Automatically

Our Site is hosted on Cloudflare Pages. Cloudflare may automatically collect standard server log data such as your IP address, browser type, referring URL, and pages visited. This data is collected and retained by Cloudflare as part of their infrastructure services and is subject to Cloudflare's Privacy Policy. We do not add any additional analytics, cookies, or tracking mechanisms to our Site.

Information We Do Not Collect

• We do not set cookies on our Site.
• We do not use analytics services (Google Analytics, etc.).
• We do not use tracking pixels or advertising networks.
• We do not collect payment or financial information directly — all payment processing is handled by LemonSqueezy (see Section 3).
• We do not require or maintain user accounts on our Site.

2. How We Use Your Information

We use the information you provide for the following purposes:

• Release announcements to former waitlist members: to tell people who signed up on the retired waitlist form that the product they asked about is available.
• Support responses: to respond to questions, bug reports, or other inquiries you submit through our contact form.
• Product announcements: to send occasional updates about OOD Labs products. You may opt out of these communications at any time (see Section 5).
• Release notifications: if you ticked the consent box on our Download page, to email you when a new stable build of the software is released.
• Licensing: to issue, deliver, and verify your software license, and to suspend it if the associated purchase is refunded or charged back.
• Customer updates: if you have purchased a license, to tell you about updates, fixes, and support information for the software you bought.

We do not sell, rent, or trade your personal information to third parties. We do not use your information for advertising or profiling.

3. Third-Party Services

We use a small number of third-party services to operate our Site and business. Each service receives only the minimum data necessary to perform its function.

Resend (Email Delivery and Mailing Lists)

We use Resend to send transactional and notification emails. When you submit a form, or when you purchase a license, your email address and (where we hold it) your name are transmitted to Resend for email delivery. Resend's handling of your data is governed by their Privacy Policy.

We maintain two contact lists in Resend:

• Release updates: email addresses of people who ticked the consent box on our Download page, or who previously joined the Sentinel waitlist.
• Customers: email addresses and names of people who have purchased a license, added automatically at the time of purchase.

If you provided an optional social media handle on our waitlist form, it is stored alongside your email address in our Resend contact list. You can ask us to remove it at any time using the contact details in Section 8.

Keygen.sh (Software Licensing)

We use Keygen.sh to issue and verify software licenses. When you purchase a license, we transmit your email address, your first and last name, your full name, and your LemonSqueezy order identifier and order number to Keygen so that a license can be created and attributed to you. When you activate the software, Keygen also receives a unique machine identifier and your license key (see Section 12). Keygen's handling of your data is governed by their Privacy Policy.

LemonSqueezy (Payments)

We use LemonSqueezy as our Merchant of Record for product purchases. LemonSqueezy collects and processes payment information (credit card numbers, billing address, etc.) directly — this information never passes through our servers or Site. LemonSqueezy handles sales tax, VAT, and payment compliance on our behalf. Their handling of your data is governed by their Privacy Policy.

Cloudflare (Hosting and CDN)

Our Site is hosted on Cloudflare Pages and our downloads and media are served from Cloudflare R2. We also run our purchase webhook as a Cloudflare Worker, store bug reports you have chosen to send in Cloudflare R2, and use Cloudflare KV for short-lived technical records that prevent duplicate and abusive requests. Those records include IP addresses and are discarded within 24 hours. Cloudflare additionally processes standard connection data (IP addresses, request headers) as described in Cloudflare's Privacy Policy.

Google Workspace (Email)

Mail sent to our published addresses, including support requests and any privacy request you make under Section 5, is received and stored in Google Workspace. See Google's Privacy Policy.

GitHub (Issue Tracking)

Bug reports you choose to send from Sentinel may be filed as issues in our private GitHub repository so we can track the fix. See GitHub's Privacy Statement.

4. Data Storage and Security

Form submission data (names, email addresses, messages) is processed through Astro Server Actions and transmitted to Resend's servers for storage and email delivery. Purchase data is received from LemonSqueezy by a webhook and passed to Keygen.sh and Resend as described in Sections 1 and 3. Most of your personal data is held by the third-party providers listed in Section 3 rather than by us. We do also keep operational records of our own on Cloudflare infrastructure: bug reports you have chosen to send (Section 12), short-lived technical records used to prevent duplicate and abusive requests, which include IP addresses and are discarded within 24 hours, and a local working copy of our mailing list used to manage it. We do not run a customer-facing database or user accounts.

We take reasonable measures to protect your information, including:

• All data transmission occurs over HTTPS/TLS encryption.
• API keys and service credentials are stored securely in environment variables and are never exposed to client-side code.
• Our Site is statically generated, minimizing attack surface.
• We use only established, reputable third-party service providers with their own security programs.

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security.

5. Your Rights

You have the following rights regarding your personal information:

• Access: you may request a copy of the personal information we hold about you by contacting us at contact@ood-labs.com.
• Deletion: you may request that we delete your personal information. We will remove your data from Resend Audiences and any other systems where it is stored. Contact us at contact@ood-labs.com to make a deletion request.
• Correction: you may request that we correct any inaccurate personal information we hold about you.
• Opt-out of communications: every marketing or announcement email we send includes a way to unsubscribe. You may also email contact@ood-labs.com at any time to be removed from our mailing lists. Once you opt out, we will not add you back to a list from a website form, even if your address is submitted again. Opting out of marketing email does not stop strictly transactional messages you have asked for or need — for example your license key, or a direct reply to a support inquiry.

We will respond to all legitimate requests within 45 days. We may ask you to verify your identity before processing your request.

6. Children's Privacy

The Site and our products are intended for users who are at least 18 years old. We do not knowingly collect personal information from anyone under the age of 18. If we learn that we have collected personal information from someone under 18, we will delete that information promptly. If you believe we have collected information from someone under 18, please contact us at contact@ood-labs.com.

7. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Effective Date" at the top of this page. If we make material changes to how we handle your personal information, we will notify you by email (if we have your email address) or by posting a prominent notice on our Site.

Your continued use of our Site after any changes to this policy constitutes your acceptance of the updated terms.

8. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email:contact@ood-labs.com
• Website:ood-labs.com/support

9. California Privacy Rights

While OOD Labs may not currently meet the statutory revenue or data-volume thresholds that mandate CCPA compliance, we voluntarily extend the following rights to all California residents as a matter of transparency and good practice.

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Right to know: you may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to delete: you may request that we delete the personal information we have collected from you, subject to certain exceptions.
• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA rights.
• Right to correct: you may request that we correct inaccurate personal information we have collected about you.
• Sale of personal information: we do not sell or share your personal information as those terms are defined under the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months. We do not collect sensitive personal information as defined by the CPRA.

To exercise any of these rights, contact us at contact@ood-labs.com. We will verify your identity before processing your request and respond within 45 days.

10. International Users and European Privacy Rights

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following additional provisions apply:

Legal Basis for Processing

We process your personal data on the following bases:

• Consent — for release-update emails, which we send only where you ticked the consent box, and which you may withdraw at any time.
• Performance of a contract — for issuing, delivering, and verifying your software license after a purchase.
• Legitimate interests — for responding to support inquiries; for protecting our software against unauthorized use; and for emailing customers about updates to a product they have already bought, which we consider a relationship you would reasonably expect. You may object to this last use at any time by unsubscribing, with no effect on your license or your support.

Additional Rights

In addition to the rights described above, you may have the right to: request data portability (receive your data in a structured, machine-readable format); restrict processing of your personal data; withdraw consent at any time (without affecting the lawfulness of processing before withdrawal); and lodge a complaint with your local data protection authority.

International Data Transfers

Your data is processed in the United States through our service providers (Resend, Cloudflare). These providers maintain appropriate safeguards for international data transfers, including Standard Contractual Clauses where applicable.

To exercise any of these rights, contact us at contact@ood-labs.com.

11. Data Retention

We keep personal data only as long as we have a reason to. Support inquiries are retained for up to 3 years after resolution for legal defense and record-keeping. Bug reports are retained for up to 24 months. You may request deletion at any time by contacting contact@ood-labs.com, and we will process your request within 45 days.

For the mailing lists described in Section 3, we retain your details until you unsubscribe or ask us to remove you, or until we close the list. We do not delete subscribers on a timer, because doing so would destroy the record of your subscription that we may need in order to show your mail was solicited. If you unsubscribe, we keep the minimum record needed to make sure we do not contact you again.

Please note that certain transactional data (such as purchase records held by LemonSqueezy and license activation records held by Keygen.sh) may be retained by our third-party service providers as required for tax compliance, fraud prevention, and legal obligations, even after you request deletion of your marketing and support data.