Last updated: August 22, 2026
This summary is for convenience only. The full text below is what applies.
This service ("Project LEUC", "we", "us") provides update checking for Blender add-ons. It has two sides: a website where add-on developers register their add-ons, and a Blender add-on that checks whether the add-ons installed on a user's machine have newer versions available.
The data controller is Amandeep, of Bairwal Tech Solutions, Kanganpur Road, Sirsa, Haryana, India. For any question about this policy, or to exercise the rights described in section 10, contact [email protected].
If you create a developer account on the website, we process:
Content you choose to publish: add-on IDs, names, descriptions, icons, version numbers, changelogs, download and repository URLs, and any material you submit in support of an ownership claim or verification request. This is published deliberately and is visible to others.
This is the part that concerns end users rather than developers. When the add-on checks for updates, each request contains:
| Field | Example | Why |
|---|---|---|
| Add-on IDs and version numbers installed on your machine | GeoCables 1.5.0 | To tell you which ones have updates |
| Your Blender version | 4.2 | Compatibility checks, and version-adoption statistics for developers |
| Installation ID | 3f2504e0-4f89-… | To count one machine once instead of once per check |
| Timestamp | 2026-08-17T12:04Z | Statistics, and the abuse checks in section 4 |
Be aware of what this means. The list of add-ons installed on your machine, tied to an identifier that persists across sessions, can say something about you — what you work on and what you have paid for. We consider this the most sensitive thing we hold. It is why reporting can be switched off entirely, and why the installation ID is deliberately unlinked from any account.
The first time the add-on runs it generates a random UUID (version 4) and saves it in your user data directory. Every later update check sends the same value.
It is deliberately boring:
It is stored here:
We keep it outside the add-on's own folder so that reinstalling the add-on does not silently create a second identity and inflate our counts. The trade-off is that it survives uninstalling the add-on, so we are telling you plainly where it is and how to remove it.
Every internet request necessarily reveals an IP address, which is personal data. We handle it as follows.
When a request reaches our server, the IP is read in memory, combined with a secret key held only on our server, and put through an HMAC-SHA256 function. Only the resulting hash is stored. The raw IP is never written to our database or our logs.
The hash is used for exactly one purpose: noticing when a single network suddenly produces an implausible number of new installations, which is how someone would try to fake an add-on's popularity. Hashes are deleted after a few days.
In practice, this cannot be traced back to you. The key is a 256-bit secret that lives only in our server environment — it is never in our source code, never sent to your machine, and never shared with anyone. Working backwards from a stored hash to an IP address is not feasible without it. We also rotate the key, and doing so permanently severs any connection between hashes stored before the rotation and the addresses they came from.
We do not use IP addresses to count users, to build profiles, or to infer your location. We also never treat one IP as one person: shared offices, studios, universities and VPNs make that assumption wrong in both directions.
The add-on can display an announcement — a short message, optionally with an image and links — inside Blender. We use this for service notices, and it may in future carry sponsored or promotional content from us or from third parties. We have not committed to doing so, and this section describes the mechanism either way.
Announcements are not targeted. There is one announcement live at a time and every user receives the identical file. Nothing about you — your installation ID, your add-ons, your location, or your history — is used to decide what you see. We are not told whether you viewed, dismissed, or clicked one, and no advertising network, tracking pixel, or third-party script is involved.
If we ever introduce announcements that are selected using data about you, that would be a material change: we would update this policy, say so plainly, and where the law requires it, ask for your consent first. Until this section says otherwise, announcements are untargeted broadcasts.
You can dismiss any announcement. Turning off update checking (section 11) stops them being fetched at all.
For users in the UK, EU and other jurisdictions applying the GDPR, our legal bases under Article 6(1) are:
| Purpose | Basis |
|---|---|
| Running your developer account and the website | Performance of a contract — Art. 6(1)(b) |
| Answering an update check sent by the add-on | Performance of a contract — Art. 6(1)(b) |
| Aggregate statistics shown to add-on developers | Legitimate interests — Art. 6(1)(f) |
| Detecting and preventing manipulation of our statistics | Legitimate interests — Art. 6(1)(f) |
| Optional emails about the service | Consent — Art. 6(1)(a), withdrawable at any time |
| Responding to lawful requests from authorities | Legal obligation — Art. 6(1)(c) |
Where we rely on legitimate interests, we have weighed them against your rights. The relevant safeguards are that the identifier is random rather than derived from you, that it is never joined to an account, and that the IP signal is keyed and short-lived. You may object to this processing at any time under Article 21 — the simplest and most immediate way is to turn reporting off in the add-on preferences.
| Data | Retention |
|---|---|
| Developer account and published add-on data | Until you delete your account |
| Hashed IP abuse signals | 3 days by default, then deleted automatically |
| Individual check events | Aggregated into daily counts, typically within an hour |
| Installation records and per-version counts | While the service operates. These carry no data that identifies you beyond the random installation ID. |
| Daily aggregate statistics | Retained indefinitely; contains no identifiers |
| Record of accepting these documents | Kept while your account exists and for a reasonable period after, as evidence that consent was given |
We do not sell personal data. We do not disclose it to advertisers or advertising networks. We use the following processors to run the service:
| Provider | Purpose |
|---|---|
| Convex | Application database and backend hosting |
| Cloudflare | Content delivery and static update manifests |
| Supabase | Secondary data synchronisation |
| Sign-in, only if you choose Google as your sign-in method | |
| Google Analytics | Website usage statistics, only if you accept analytics cookies |
We may also disclose data where legally required, or where necessary to establish, exercise or defend legal claims. If the service is ever transferred to another operator, we will give notice before your data moves, and this policy will continue to apply until replaced.
These providers may process data outside your country, including in the United States. Where that involves a transfer out of the UK or EEA, it is made under the European Commission's Standard Contractual Clauses or an equivalent approved mechanism.
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a portable copy, and withdraw any consent you have given. Exercising these rights is free and we will respond within one month.
Write to [email protected]. For account data, we will verify that the request comes from the account's registered email address.
A limit worth stating honestly. Update-check data is keyed to a random installation ID and nothing else. If you ask us to produce or erase "your" check data, we have no way to work out which records are yours unless you tell us the installation ID from the file listed in section 3. This is a consequence of designing the system not to know who you are, and under Article 11 GDPR we are not required to collect extra information purely to be able to identify you. You can always erase the link yourself by deleting that file.
If you are in the EEA or UK you may complain to your national data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address it first.
India — Digital Personal Data Protection Act, 2023. We are established in India, so the DPDP Act applies to this service. In its terms we are the Data Fiduciary and you are a Data Principal. You have the right to access a summary of your personal data and how it is processed, to have it corrected, completed, updated, or erased, to nominate someone to exercise these rights if you die or become incapacitated, and to have a grievance heard before approaching the Data Protection Board of India.
Grievance Officer. Complaints about how your personal data is handled go to [email protected], addressed to the Grievance Officer. We will acknowledge within 72 hours and respond substantively within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
California residents. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding twelve months. We do not use personal information for cross-context behavioural advertising — the announcements in section 5 are untargeted and involve no disclosure of personal information to anyone. You have the right to know, delete, correct, and not be discriminated against for exercising these rights. Should we ever begin selling or sharing personal information, we will update this policy first and provide a "Do Not Sell or Share My Personal Information" link as the law requires.
You are not obliged to send us anything. In order of thoroughness:
The website uses strictly necessary cookies for signing in and keeping you signed in. These are always set and need no consent.
We also use Google Analytics to count page views and see which guides get read. Its cookies are only set if you press Accept on the banner shown on your first visit, and are not set at all if you press Reject or ignore it. Until you accept, Google receives only a cookieless signal that a page was viewed and cannot recognise you across visits. Analytics records the pages you view, the outbound links you click, your approximate location from your IP address, and your device and browser type. We use no advertising or ad-personalisation cookies at all. To change your choice, clear this site’s data in your browser and the banner will be shown again.
The Blender add-on uses no cookies at all.
The service is not directed at children. Developer accounts are for users aged 18 or over. We do not knowingly collect personal data from children below that age; if you believe we have, contact us and we will delete it.
All traffic is encrypted in transit using TLS. The key used to hash IP addresses is stored as a deployment secret, never in our source code, and can be rotated — which permanently severs any link between stored hashes and the addresses they came from. Access to production data is limited to those who need it.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where required, and notify you where the law requires it.
We may update this policy. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will give notice on the website and, for account holders, ask you to accept the new version when you next sign in. Continuing to use the service after a change means you accept the revised policy.
[email protected]
Amandeep, Bairwal Tech Solutions, Kanganpur Road, Sirsa, Haryana, India