Privacy Policy
Most of this page is what we don't do. unattend.tools runs entirely in your browser — there is no backend to send data to, no account system, no analytics, no cookies. This document exists so you can verify that claim line by line.
Last updated:
Controller
The data controller within the meaning of the GDPR (Regulation (EU) 2016/679) is:
- SARU s. r. o.
- Černyševského 10, 851 01 Bratislava, Slovakia
- saru@saru.sk
For questions about this policy or to exercise any of the rights listed below, email the address above.
What we don't collect
The hosted build at unattend.tools is a static site. When
you load a page, your browser fetches HTML, CSS, JavaScript, and font
files from our CDN. After that, the application runs locally. We do
not operate any server endpoint that receives data from the running
app.
- No account, signup, or login. There is nothing to identify you with.
- No analytics. No Google Analytics, Plausible, Fathom, Matomo, or equivalent.
- No third-party fonts, scripts, pixels, or tag managers.
- No tracking cookies. The site sets no cookies at all.
- No telemetry on errors, performance, feature usage, or anything else. If the app crashes in your browser, we do not find out.
- The XML you generate stays in your tab. It is never uploaded anywhere. "Download" writes it to your local disk; "Copy" puts it on your clipboard.
What's stored on your device
The app uses your browser's localStorage to remember
user-interface preferences across visits — specifically your theme
(light/dark) and your in-progress builder state, so a page reload
doesn't wipe your work. This data lives only in your browser. We
cannot read it. Clearing site data in your browser removes it.
A subset of the builder state can also be encoded into a URL when you choose to share a link. That encoding happens in the browser; the URL is not transmitted to us.
Server logs
Static assets are served by our hosting provider (Websupport, s. r. o.). Like any web host, it records standard access logs (IP address, user agent, requested URL, timestamp) for abuse prevention and traffic billing. We do not operate analytics on top of those logs. Retention follows the provider's defaults; see the Websupport privacy policy.
Third-party URLs in generated content
Some first-run command snippets and documentation references contain URLs to Microsoft Update, Chocolatey, vendor driver portals, and similar resources. These URLs are text in the XML or docs. The page does not call them. They are executed only later, on your deployed Windows machine, by scripts you generated and chose to run.
Your rights under GDPR
Articles 15–22 of the GDPR grant you the right to access, rectify, erase, restrict, port, and object to processing of personal data. Because we do not collect personal data, there is nothing to access, rectify, erase, or port. If you believe we hold data about you anyway, contact the address above and we will investigate.
You also have the right to lodge a complaint with a supervisory authority. In the Slovak Republic, that is the Office for Personal Data Protection (dataprotection.gov.sk).
Children
The service is a developer tool with no age-gated features and no data collection. It is not directed at children, but there is also nothing about it that creates a child-protection concern beyond general internet use.
Changes to this policy
If the architecture ever changes in a way that would mean we collect data — adding a backend, adding analytics, adding accounts — this page will be updated before that change ships, and the "last updated" date above will reflect it.