Can be found http://subfiresuite.com/Privacy/
tl;dr summary: I'm not collecting email addresses, I'm not selling email addresses, I will reveal no names or emails that submit support requests or give feedback on public forms (like Amazon store, or this forum here), I have no mailing list and no intentions to make one, I'm doing everything I can to keep your login information off of my own servers (with one feature exception coming soon that I'll describe later, and it is optional), I'm not tracking via google analytics, I have only 1 third-party tracking cookie and that's because of a CDN for bringing in a font from google's servers (and i'm going to see if i can get rid of it), and I have no advertising now nor any intent to serve advertising later. I don't even look at my websites' visit logs from my ISP.
ok, even that was long. oh well.
No idea if that's GDPR compliant, but it is the truth, which should be something, right?
Joe