← attach.sh

Website Privacy Notice

Last updated: May 28, 2026

1. Scope

This notice applies to the attach.sh marketing website and related static pages. It does not cover the Attach iOS app, which is covered by the separate App Privacy Policy.

The data controller is Arbiter Technologies Ltd. (UIC 207164164), Prof. Krastyo Mirski Str., Bl. 10, Ent. A, Apt. 8, Sofia 1407, Bulgaria.

2. Website Request Data

When you visit attach.sh, standard web request data may be processed by our hosting or delivery infrastructure to load the site and keep it secure. This may include your IP address, browser and device information, requested URL, referrer, and timestamps.

3. Google Fonts

The website currently loads fonts from Google Fonts. When those fonts are requested, your browser may connect to Google-controlled domains such as fonts.googleapis.com and fonts.gstatic.com.

• Those requests may reveal your IP address, browser information, and the fact that you visited attach.sh.
• Google processes that data under Google's own terms and privacy policies.

4. Analytics (PostHog)

We use PostHog to understand how visitors use the website (which pages are read, which links and buttons are clicked, basic browser and device information). Analytics requests are routed through a first-party endpoint on our own domain (attach.sh/ph) and processed on PostHog's EU infrastructure (eu.i.posthog.com, Frankfurt, Germany), so your data is processed inside the European Union.

PostHog is loaded only after you accept the cookie banner shown on your first visit. If you decline, no PostHog script is initialised, no analytics events are sent, and no PostHog identifier is stored on your device.

When you accept, the following is processed:

• A pseudonymous visitor identifier stored in your browser's localStorage so we can tell returning visits apart from new ones. It is not linked to your name, email, or any account.
• Page URLs you visit on attach.sh, page-load timing, and basic Web Vitals.
• Automatically-captured page interactions (such as clicks), plus two specific actions we track: clicking the App Store download button (we record whether it was the hero or pricing button) and copying the push-notification install command on the /notifications page.
• Browser, operating system, device type, language, screen size, and referring URL.
• Approximate location (country / region) derived from your IP address. Your IP address itself is anonymised on ingestion and is not stored.
• Reports of unhandled JavaScript errors on the site, so we can find and fix bugs.

We do not use PostHog session replay, heatmaps, surveys, feature flags, or A/B testing on this site. We do not use advertising networks or marketing pixels, we do not enrich visitor data with information from other sources, and we do not sell or share it.

5. Push Notification Relay Endpoint

The attach.sh domain also hosts a push notification relay API endpoint (attach.sh/api) used by the Attach iOS app. This endpoint processes pairing tokens (random UUIDs) and Apple Push Notification device tokens to route encrypted notifications. It does not process website visitor data and is covered in detail by the App Privacy Policy.

6. Purpose and Legal Basis

We process website-related data to serve the site, secure it, troubleshoot issues, and deliver its visual assets. The legal basis is our legitimate interest in operating the website (GDPR Art. 6(1)(f)). We do not use the website to build advertising profiles.

For the optional PostHog analytics described in Section 4, the legal basis is your consent given through the cookie banner (GDPR Art. 6(1)(a) and the Bulgarian Electronic Communications Act implementing the ePrivacy Directive). You can withdraw your consent at any time as described in Section 8.

7. Retention

Any server or CDN logs that exist for attach.sh are controlled by our hosting stack and may be retained for operational or security purposes for a limited period. Actual retention periods may vary by provider and deployment configuration.

PostHog analytics events are retained for up to 7 years on PostHog's EU infrastructure under PostHog's standard retention policy. The pseudonymous identifier stored in your browser persists until you clear your browser storage or withdraw consent.

8. Your Choices

You can avoid Google Fonts requests by not loading the website, by blocking those domains in your browser or network tools, or by using privacy tools that restrict third-party requests.

For PostHog analytics, you have full control:

• You can decline the banner on your first visit. No analytics will be loaded.
• You can change your decision at any time by clicking the button below. This clears the stored choice and reloads the page so the banner reappears.
• You can also clear your browser's localStorage for attach.sh, which removes both the consent flag and the pseudonymous identifier.

Change cookie preferences

9. Changes to This Notice

We may update this Website Privacy Notice from time to time. Changes will be posted on this page with an updated revision date.

10. Your Rights Under EU Law

Arbiter Technologies Ltd. is the data controller for any personal data processed through the attach.sh website. The legal basis for processing website request data is our legitimate interest in serving and securing the site (GDPR Art. 6(1)(f)).

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or with the supervisory authority in your country of residence. For questions, contact support@arbt.tech.