Legal & Privacy
Legal Notice / Impressum
Publisher and legal entity / Anbieter
Maxim Shevchenko-Tymchuk
Portitzer Straße 44
04318 Leipzig
Germany / Deutschland
Email: i.am@maximshechenko.com
Responsible for DragTwoZero (Drag 2.0), a free, open-source macOS application. “Maxim Kich” is the creator name used in the app.
Verantwortlich für DragTwoZero (Drag 2.0), eine kostenlose, quelloffene macOS-Anwendung. „Maxim Kich“ ist der in der App verwendete Creator-Name.
Contact / Kontakt
Please use the email address above for support, privacy questions, or legal correspondence. / Für Support, Datenschutzfragen oder rechtliche Anliegen verwenden Sie bitte die oben angegebene E-Mail-Adresse.
Scope
This notice identifies the provider of this website and application. The MIT license and the Privacy notice are available separately. This application is an independent project.
Website privacy
Deployment review: dragtwozero.com is the planned domain. The Cloudflare Workers project exists, but its first deployment failed and optional analytics is disabled in this build. The hosting service, account agreements, logs and retention must be verified before publication. The desktop app’s separate disclosure follows below.
Controller and scope
The controller is Maxim Shevchenko-Tymchuk, at the address and email in the Legal Notice / Impressum. This section covers this website. Website consent never enables analytics in the desktop app.
Hosting and security
Cloudflare is the intended hosting and delivery provider. A public Cloudflare deployment necessarily processes connection and request information, including IP addresses, requested URLs, request times, browser information and security-related metadata, to deliver the website, maintain availability and protect it against abuse. Necessary delivery and security are separate from optional analytics and continue when analytics is declined. The intended legal basis is the legitimate interest in providing a reliable, secure website (Article 6(1)(f) GDPR).
The project uses Cloudflare Workers with static assets. The account’s domain-registration invoice identifies Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, United States. The applicable Workers/Web Analytics agreement, essential hosting and security log settings, retention and transfer safeguards still need verification. On 23 October 2026, the Worker’s Logs, Traces and Issues switches were off and no telemetry export destination was configured. This does not disable or establish retention for Cloudflare’s essential delivery and security processing. No EU-only processing or fixed Cloudflare retention period is claimed.
Optional Cloudflare Web Analytics
With your permission, the prepared integration measures visits to the home, legal, terms and licenses pages and website performance, including page-loading timings and Core Web Vitals. Cloudflare describes Web Analytics as not using analytics cookies, persistent visitor identifiers or fingerprinting to track you across visits. Network connections still involve IP addresses and browser connection information.
The integration permits only page URLs without query strings, numeric performance measurements, the public site token, the beacon version and a temporary per-page correlation value. It removes referrers, element selectors and resource URLs from outgoing metric bodies. It does not include playground input, selected content, email or user identifiers. Pages with query strings, unrecognized fragments or unlisted paths are excluded. Fonts and images are served locally; there are no advertising pixels or session recordings.
Optional analytics requires your agreement. Where personal data is processed, the basis is consent under Article 6(1)(a) GDPR, together with any terminal-access consent required under section 25 TDDDG. You can decline and still use the website. On an enabled deployment, allowing analytics reloads the page before collection begins, so earlier activity is not backfilled. A failed or blocked beacon leaves the site usable.
Use here or in any page’s footer to withdraw. Withdrawal prevents new optional metric dispatches, including from other open tabs using the same browser storage. Requests already transmitted cannot be recalled. Withdrawal does not affect the lawfulness of processing before it. Analytics retention and whether individual data can be located in aggregate reports still require account-specific verification before activation.
Remembering your choice
When you choose Allow analytics or Decline, we save only that choice, the policy version, the time of your choice and its expiry in first-party browser storage for 180 days. The period is the same for both choices. There is no visitor ID. This storage exists solely to remember and respect the preference you expressly request; it is not used for analytics. We rely on section 25(2)(2) TDDDG for this necessary preference function and Article 6(1)(f) GDPR for respecting and managing your privacy choice where personal data is involved.
You can change your choice at any time. Clearing browser data removes it. An expired, invalid or outdated choice returns to analytics off. If storage is unavailable, analytics stays off. Closing the notice, scrolling or using the site is not consent.
Providers and international processing
Cloudflare and its authorized subprocessors may process website information outside the European Economic Area. Cloudflare publishes its Data Processing Addendum and Privacy Policy, including information on international-transfer safeguards such as Standard Contractual Clauses where applicable, and a service subprocessor list. These published terms do not establish which agreement or entity applies to this account. That review remains open.
Support, playground and downloads
The playground runs in your browser; its input is not submitted to a chat service. This build offers a download-information dialog, not a public release file or third-party download redirect. Download hosting must be disclosed once a release is available. Clicking an external link connects to that provider. A mail link opens your email application; it does not send a message automatically. The Google Workspace support processing and your rights are explained below and apply to website correspondence too.
Your rights
You may request access, correction, erasure, restriction and portability where the GDPR conditions apply. You may object to legitimate-interest processing on grounds relating to your particular situation and withdraw consent for the future. You may complain to the Saxon Data Protection and Transparency Commissioner or the supervisory authority in your usual place of residence or work. Contact i.am@maximshechenko.com. Using optional analytics is voluntary; declining has no effect on access. This website does not make automated decisions with legal or similarly significant effects.
App privacy
DragTwoZero processes selected content on your Mac to move it between applications. The current app has no account system, advertising, analytics SDK, automatic crash upload, or automatic update service. It does not send captured content or screen samples to the publisher.
Who is responsible?
Maxim Shevchenko-Tymchuk
Portitzer Straße 44
04318 Leipzig
Germany / Deutschland
Email: i.am@maximshechenko.com
The publisher is responsible for personal information received through direct correspondence and any other processing under the publisher’s control. The app’s local access does not itself provide the publisher with access to your Mac or its content. If you use it at work, your organization may have its own responsibilities for the information you process.
Accessibility and input events
With macOS Accessibility permission, the app reads accessible text, links, element positions, and editor selection information to identify source blocks and drop targets. This can include content surrounding a selected block and caret information from other running applications. It observes keyboard and pointer events to recognize the configured shortcut, selections, and dragging; it does not create a typing-history log. To deliver content, it may activate the destination app, focus its editor, restore its caret, issue a paste command, or set an accessible table cell’s value.
Optional screen sampling
When Liquid Glass is enabled and macOS Screen Recording permission has already been granted, the app may sample a small screen region around the pointer to choose a readable appearance. The current implementation samples a 48 × 48 point area into a 32 × 32 pixel image, excluding the app’s own windows. Samples are processed in memory; the app does not save or transmit them. It does not capture audio or record a video stream. If permission is unavailable, the app uses its fallback appearance.
Clipboard and destination applications
For paste-based delivery, the app temporarily reads and saves the current clipboard contents in memory, then places the selected text on the system clipboard. It restores the previous clipboard only when it can confirm insertion and no other application has changed the clipboard in the meantime. If insertion cannot be confirmed, the captured text can remain on the clipboard until replaced. Other software with clipboard access, clipboard managers, or operating-system clipboard synchronization may access that content.
The destination application receives the text you drop and may store, sync, or transmit it according to its own behavior and privacy policy. DragTwoZero does not control that processing. Accessible table-cell delivery may bypass the clipboard.
Local storage and retention
Preferences such as the trigger shortcut, activation state, appearance, animation, haptics, and multiselect choices are stored locally in the app’s macOS preferences. They remain until changed or removed.
The app writes a diagnostic file at ~/Library/Logs/DragTwoZero/status.log. It contains timestamps and operational states such as Accessibility/listener status, capture activation, and light/dark backdrop classification. The current log statements do not include captured text, URLs, clipboard contents, or screen images. The app does not upload this log or automatically rotate/delete it; it remains until you remove it.
Captured text, accessibility references, caret information, and temporary clipboard backups are held in process memory for interaction and caching. They are not saved as a capture history by the app. Quitting ends those in-memory sessions, but does not erase the system clipboard or content already delivered to other apps. macOS backups and diagnostics are controlled by the operating system.
Email and voluntary support reports
If you contact the publisher, the publisher receives your email address, message, and any attachments or diagnostic information you choose to send. These are used to answer your request and investigate reported issues. Please remove confidential content before sending screenshots or logs.
Where a request relates to a contract or steps toward one, the legal basis is Article 6(1)(b) GDPR. Other project correspondence is handled under Article 6(1)(f), the legitimate interest in answering inquiries and maintaining the project. Article 6(1)(c) applies where retention is legally required. macOS permission prompts are device-access controls, not blanket consent to unrelated processing.
Correspondence is kept only as long as needed to resolve the request and necessary follow-up, or to meet applicable retention duties or establish, exercise, or defend legal claims. Relevant factors are whether an issue is still open and any applicable limitation or retention period. Support email is hosted in Google Workspace. Google and its authorized subprocessors process message content, attachments, sender/recipient details, and associated service data to provide and secure email. Google’s published standard contracting entity for German Workspace customers is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; an existing account agreement may identify a different Google entity.
Google’s Cloud Data Processing Addendum describes processor obligations and international-transfer safeguards. Processing may occur outside the European Economic Area, including in the United States. Google’s terms provide for applicable adequacy mechanisms and Standard Contractual Clauses where required. Details and copies of the relevant safeguards are available through that addendum and Google’s transfer-framework information. Google publishes its Workspace subprocessor list.
Your choices and rights
You can turn off Activate in General, quit the app, disable Liquid Glass to stop the appearance sampler, or revoke macOS permissions in Privacy & Security. These choices do not undo earlier insertions. To remove local settings and logs, quit the app and remove its preferences and log data; uninstalling the app alone may leave these files behind.
For personal data processed by the publisher, you may request access, correction, erasure, restriction, and portability where the GDPR conditions apply. You may object to processing based on legitimate interests on grounds relating to your particular situation. If processing is based on consent, you can withdraw it for the future. You may complain to a supervisory authority, including the Saxon Data Protection and Transparency Commissioner or the authority in your usual place of residence or work. Contact the publisher using the address above. The publisher cannot retrieve local-only content from your Mac.
Providing support information is voluntary; without sufficient details, an issue may not be diagnosable. The publisher does not use this app to make automated decisions with legal or similarly significant effects or to profile users.
External links and scope
The legal documents are bundled locally. Clicking an external link opens your browser or mail application; the chosen service then receives the normal connection or message data. The app’s GitHub profile link is governed by GitHub’s own privacy practices. This app-privacy section covers the current desktop app. Website processing is described separately above. A future store, payment flow, or third-party fork requires a separate assessment.