Who is responsible
Stormberry AS, a Norwegian limited company (aksjeselskap) registered in Askøy, Norway, organisation number NO 937 751 249, publishes GDPRLetterBuilder and is responsible for it. Contact: info@stormberry.as
Everything happens on your device
The details you type, the letter and the deadline are worked out on your own device. Nothing you type is sent anywhere, to us or to anyone else, and nothing is logged. There is no server that receives it, and the page never looks anything up: there is no company search and no address lookup.
The page carries a security policy that lets it load only its own files, and blocks every connection its code could open and every form submission. It has no form to submit, and it never reads anything from the address in your browser's address bar, so a link cannot fill in a letter for you. You can test the first claim yourself: disconnect from the internet and use it.
Spell checking is switched off in every field, because some browsers can send what you type to an online spelling service when their enhanced spell check is turned on.
Copy, print, save, email and share
Your letter, a follow-up letter and the cover note leave the page only when you press a button, and only to where you send them:
Copy letter and Copy note put it on your device's clipboard, where a clipboard history or a clipboard synced between your devices may keep it. Send using email app opens a draft of the letter in your own email app, which may be a webmail service, addressed to the company's privacy email and, if you gave your own email address, with that address as Cc; nothing is sent until you press Send there. Save as PDF opens your browser's print window, which hands it to the PDF file or the printer you choose. Save as text file saves a file named only after the kind of request, or "follow-up" or "timeline", and the date, never after the company, to where your browser saves files. Share, where your browser offers it, hands it to the app you choose. Once it is there, it is in the hands of that app, that printer or the people you send it to.
The reminder file
Save a reminder saves a calendar file that you open in your own calendar. It holds the deadline, how it was counted, what to do next and, unless you tick "Leave the company name out of the reminder", the company's name. It never holds your name, your contact details, the details that help the company find you, or your letter. A calendar often syncs to a cloud service, which is why it holds so little.
What is kept on your device
GDPRLetterBuilder keeps nothing you type, and no history of letters, follow-ups, events or companies. Reloading or closing the page empties every field, and Clear everything does it on demand.
One thing is stored: when you close the first-run notice, your browser stores the date and time in its local storage, so that the notice does not show again. It never leaves your device, and we cannot see it. Clearing your browser's data for the site removes it.
Every field on the page is marked so that browsers do not save or fill in what you type. Some browsers may still offer to fill in your name or address from their own saved details; those details stay with your browser. Firefox, with its standard settings, keeps the options you tick or choose on the page in its own session-restore file, so that a page can be brought back after a crash. What you type into the fields was left out of that file in our tests, and the page puts the options back to their defaults when a browser restores them as the page opens. Other browsers may behave differently. That file stays on your device, in your browser's profile, and we cannot see it.
Links to other sites
The page links to its sources: EUR-Lex, Lovdata, the European Data Protection Board, the Court of Justice of the European Union, the Norwegian Data Protection Authority (Datatilsynet) and others. They open in a new tab only when you press them, and those sites work under their own terms.
How the page reaches you
The website is stored by GitHub (GitHub Pages) and delivered through Cloudflare, like the rest of stormberry.as. As with any website, they see each request for the page's own files: your IP address, the address of the page and what your browser sends with it, such as its name and version. They never see what you type, because it is never sent. Cloudflare does this on our behalf; GitHub keeps its own logs for its own security purposes. Who these providers are and what each keeps is set out in our company privacy policy.
The Android app
The Android app runs this same page inside it, offline, and everything above applies to it too. It asks for no Android permission at all and has no internet access, so it cannot send anything anywhere. It also tells Android's built-in web view, which shows the page, not to send usage statistics to Google, and not to look up addresses in Google's lists of harmful sites.
In the app, Copy letter and Copy note mark what they put on the clipboard as sensitive, so Android 13 and later hide it in the clipboard preview. Send using email app opens a draft in your email app, as on the website. Save as PDF opens Android's print screen, where you choose Save as PDF or a printer. Save as text file and Save a reminder open Android's save screen, where you choose where the file goes. Share opens Android's share sheet. Add to calendar app hands the reminder, with what the reminder file holds, to your calendar app, which opens a new event for you to save or not; the app never reads or writes your calendar itself. Links to other sites open in your own browser.
The app asks your keyboard not to learn from what you type, as a browser's private window does, and keeps the fields out of Android's autofill. Closing the app empties every field. One thing is stored: when you close the first-run notice, the app stores the date and time in its own storage. Android's backups leave it out, and uninstalling the app, or clearing its storage in Android's settings, removes it. The app carries the copy of this page that was current when that version was built.
Where you got the app
Zapstore. Zapstore finds the app through our signed listing on Nostr, an open network of relays, downloads the file from the releases page of GDPRLetterBuilder's repository on GitHub and checks it against our signed listing. GitHub sees that download as it sees any other, under its own privacy statement, and counts how often each file is downloaded; that count is all we can see. Zapstore and the relays it uses work under their own terms. We receive nothing else.
Google Play. A separate Google Play edition is built from the same source, with the same features and the same lack of permissions. If you install it from Google Play, Google handles the download and the installation under its own privacy policy. Google gives us statistics in its console for developers, such as the number of installs and reports of crashes, in a form that does not tell us who you are. The app itself has no internet access and sends nothing, to Google or to us.
Your rights
Because we receive nothing from your use of GDPRLetterBuilder, we hold no data about you from it to give you, correct or delete. If you write to us, our company privacy policy explains what happens to your message, and your rights under the GDPR and the Norwegian Personal Data Act (personopplysningsloven). You can also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no). Questions about this page: info@stormberry.as
Changes to this page
If anything here changes, we update this page and the date below. The latest, with every change to it, will be in GDPRLetterBuilder's repository on GitHub once it is published.
Last updated: 30 October 2026