Legal information & contact
Legal notice
Information under Section 5 of the German Digital Services Act (DDG) and Section 18 of the State Media Treaty (MStV).
Updated October 19, 2026
Provider
Noah Mirwaldt
NGM Web & App Studios
Juvenelsstraße 3690419 Nürnberg
Germany
Direct contact
Responsible for content
Responsible according to Section 18 Paragraph 2 MStV
Noah Mirwaldt, address as above.
Consumer dispute resolution
Note according to the VSBG
The provider is neither willing nor obliged to take part in dispute resolution proceedings before a consumer arbitration board.
Second contact method
Contact form
Write directly to RunsOnMac. Required fields are marked with *.
Data protection information for the contact form
Noah Mirwaldt is responsible under the above contact details. Name, email address, topic, message and time of receipt are processed to process the request. The legal basis is Article 6 Paragraph 1 Letter b GDPR for pre-contractual or contractual concerns, otherwise Article 6 Paragraph 1 Letter f GDPR; the legitimate interest lies in answering and documenting inquiries.
The data is processed via the hosting and cloud service providers used for RunsOnMac and deleted after the request has been completed as soon as there are no longer any legal retention or proof obligations. In accordance with the GDPR, data subjects have rights to information, correction, deletion, restriction, data portability and objection, as well as the right to lodge a complaint with a data protection supervisory authority.
Privacy: website and current features
The controller is Noah Mirwaldt, trading as NGM Web & App Studios, at the address and email shown above. These notices supplement the contact-form and account-data information. Privacy requests can be sent by email or through the contact form.
Browser storage and the first-visit notice
Dismissing the development notice stores runsOnMacDevelopmentNoticeSeen with value 1 in localStorage and, as a fallback, sessionStorage, so the notice does not appear on every visit in that browser. The acknowledgement is not sent to a server and does not accept terms or give marketing consent.
The localStorage entry has no automatic expiry and remains until website data is cleared in the browser; sessionStorage lasts for the browser session. Sort preferences and timestamps for the 72-hour new-game marker are also stored locally; ending the marker does not automatically delete its timestamp. These functional data are not used to create an advertising profile. Section 25 TDDDG applies to device access in addition to the GDPR; no blanket exemption from consent is claimed for all storage.
Feedback and contact
Feedback uses the existing contact form. Name, email, subject, message and receipt time are stored to handle the request. A SHA-256 value of the email is additionally stored to limit repeated requests. This value is pseudonymous, not anonymous; the email is also stored. No account is required. Messages and email addresses are not published as website feedback.
The contact-form legal bases apply: GDPR Article 6(1)(b) for contractual enquiries, otherwise Article 6(1)(f) for answering and documenting requests; abuse prevention serves the legitimate interest in a secure contact service. Checking requests from the last 15 minutes is a sending limit, not an automatic deletion period. Retention follows the handling purpose and applicable legal obligations as explained in the contact notice.
Public catalogue, crawls and search engines
Approved public game and benchmark information, including hardware, settings, FPS and sources, is also delivered on directly accessible game pages and may be indexed by search engines. Private account data, email addresses, private libraries and withheld raw reports are not included in the public SEO export. Intended profile and hardware details may be visible on your public contributions; see the account information.
Public sources are analysed automatically. Where source information contains personal data such as public author names, GDPR Article 6(1)(f) supports traceable source attribution and a reliable catalogue. Native Intel and Apple Silicon releases are checked separately. The first check may publish preliminary source measurements; confirmed benchmarks require a further independent comparison. Errors and objections to processing can be raised through the contact route. Search engines may retain their own copies and update them on their own schedules.
Operational monitoring and operator alerts
To protect the catalogue, we retain technical crawl and validation decisions, source references, error classes and incident and recovery times. This diagnostic history is available only to the signed-in operator. Public source authors and origin references help identify reused measurements; an author name or domain alone does not prove independence.
When email alerts are enabled, delivery uses the confirmed operator account email address and Resend. Messages contain technical incident data, no private benchmark source reports or contact requests. Sender acceptance and confirmed delivery are recorded separately. Processing serves the legitimate interest in reliable operation (GDPR Article 6(1)(f)). This does not guarantee a fixed deletion period, contractual safeguards or a hosting region; those operational details remain to be clarified.
Sign-in and the operator-owned backend
Account data, contact requests, benchmarks and technical validation logs are processed in the operator-owned Supabase project; its configured database region is Ireland. Website hosting remains with Lovable. Google sign-in uses the Google ID and the basic profile data Google provides, including name, email and any profile image. RunsOnMac does not receive your Google password or request Gmail, Drive or Calendar permissions.
Browser sessions are stored in localStorage under runsonmac.auth.v1.lnjeysgwjhjjxuehfttt. The sign-in window temporarily keeps state, a PKCE verifier and session data in sessionStorage; these are removed when the flow finishes or the window closes. State validation accepts sign-in attempts for at most five minutes; this is not a general deletion period. The Mac app stores its session in macOS Keychain. You may need to sign in again after the transition. Processing supports the requested account feature (GDPR Article 6(1)(b)). Contracts, international transfers and binding retention periods require separate review; the database region does not guarantee that all processing takes place there.
Technical recipients and your rights
Loading external game images or trailers may send IP addresses and technical browser information to the source provider, such as Steam/Valve. Without an available country header, the region service may send the IP address to api.country.is to determine the country; the resulting country is stored in browser session storage with cache validity up to six hours. Cache expiry does not establish a provider's log retention period.
Subject to the GDPR, you have rights of access, correction, erasure, restriction, portability, withdrawal of consent and objection to processing based on legitimate interests, and may complain to a supervisory authority. Contact the controller identified above. Further information about providers, hosting region, international transfers and retention periods can be requested from the controller.