Privacy Policy

Datenschutzerklärung · Last updated 2 August 2026

The short version: this website sets no cookies, runs no analytics and loads nothing from any other server. The app records nothing and sends nothing anywhere, apart from asking GitHub whether a newer version exists, which you can turn off. The rest of this page is the detail the GDPR requires.

Controller

This website

Hosting. This site is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, a subsidiary of Microsoft Corporation. When you open a page, GitHub's servers process the data your browser transmits: your IP address, the date and time of the request, the file requested, the referring page and your browser and operating system identification. This is technically necessary to deliver the site and to keep it secure. The legal basis is Art. 6 (1) (f) GDPR, my legitimate interest in providing this website reliably. I have no access to these logs and do not receive them. GitHub describes its own processing in the GitHub Privacy Statement.

Transfer outside the EU. For users in the European Economic Area GitHub's contracting entity is GitHub B.V., Prins Bernhardplein 200, 1097 JB Amsterdam, Netherlands, but the service is operated from the United States, so this processing involves a transfer to a third country. GitHub has certified to the U.S. Department of Commerce that it adheres to the EU–U.S. Data Privacy Framework Principles, which means the transfer is covered by the European Commission's adequacy decision of 10 July 2023. GitHub states that it additionally relies on the standard contractual clauses published by the European Commission under Commission Implementing Decision (EU) 2021/914.

No cookies, no tracking. This site sets no cookies and uses no analytics, no tag managers and no advertising. It also embeds nothing from third parties: every stylesheet and image used on these pages is served from this site itself, and the type is a font already on your Mac. No request leaves for another company simply because you opened a page.

Links out. The pages link to GitHub and Ko-fi. Those are ordinary links: nothing is sent to them until you click, at which point their own privacy policies apply.

The Momentary app

What it reads, and why it needs permission. Momentary has to know when a modifier key goes down and comes back up, and it has to be able to send the key you map that modifier to. On macOS both require Accessibility permission. The event tap it installs is listen-only, and of everything that passes through it only the modifier flags are read: any other key press is counted as "something happened" without its key code ever being looked at, because all the app needs to know is that the modifier was not pressed alone. What you type is not recorded, not stored and not transmitted, and there is no logging of keystrokes anywhere in the app. You can verify this in the source — the file that does it is about a hundred lines long.

What it stores. Your rules, the hold threshold and your settings are saved locally on your Mac, in the app's own preferences. Nothing is synced and nothing leaves the machine. Deleting the app and its preferences removes them.

Update checks. If “Check for updates automatically” is switched on, the app asks GitHub for github.com/dennistimmermann/momentary/releases/latest/download/appcast.xml to see whether a newer release exists. That request transmits your IP address and the usual request headers, including the app version, to GitHub. It is the only network request the app makes, and you can turn it off in the settings. The legal basis is Art. 6 (1) (f) GDPR, the legitimate interest in users being able to receive security and bug fixes; if you switch it off, no request is made.

No telemetry. There is no usage analytics, no crash reporting, no unique identifier, no account and no server of mine that the app talks to.

Donations

If you choose to donate, that happens on Ko-fi or GitHub Sponsors, on their websites and under their privacy policies. They are the controllers for whatever they collect. I receive only what their payout reporting shows me, which may include the name or handle you chose to display and any message you sent.

Your rights

Under the GDPR you have the right to obtain information about the personal data held about you (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to have its processing restricted (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). To exercise any of these, email me at the address above.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, datenschutz-berlin.de.

Changes

If the site or the app starts processing something differently, this page changes with it, and the date at the top changes too.