Privacy

What the app sends

An update check Only after you turn updates on, then once a day.

Sparkle fetches an appcast from GitHub. `SUSendProfileInfo` is false and `SUEnableAutomaticChecks` is present-and-false in the Info.plist rather than absent, because an absent key is what makes Sparkle ask on second launch — this way a fresh install has already answered, and the answer is no.

That is the only connection the app opens on its own. The app sends no analytics, no telemetry, no crash reporter and no first-run ping. (The website is a separate matter, and counts page views — see This site below.) scripts/audit-listener.sh asserts the gateway binds loopback and nothing else; the update check is off until you switch it on.

Installing a server, or pressing Check for Updates on one, reaches the npm registry for that package. That happens when you press the button and never on a timer, at launch or on a schedule.

Help ▸ Send Feedback is not a second entry. It opens the feedback form in your browser with the app version, macOS version, Mac model and language in the address bar, and the app sends nothing itself. Whether anything is sent after that is up to you and the Send button.

What never leaves

Your credentials

They are in the Keychain, handed to a child process at spawn and never anywhere else. Nothing in the app and nothing any client can call returns one once it is set. The built-in server can say which secrets a profile has; it cannot say what they are.

The activity log

A ring buffer in memory, cleared when the app quits. No argument and no result is written to disk unless you turn on the audit log in Settings › Activity, which keeps hash-chained segments under Application Support readable only by you — and nothing uploads it either way. Arguments are redacted before a row is recorded rather than filtered out afterwards.

Your usage statistics

Bastion keeps a usage rollup on disk, on by default, and it holds counts rather than content: per day, per profile and per tool, how many calls, how many bytes came back, how long they took, how many failed, how many times a server restarted. No arguments, no results, no resource paths, no identifiers. Tens of kilobytes a day at most, readable only by you, kept ninety days, never uploaded. Settings › Activity turns it off and deletes it.

Everything the servers do

A supervised server talks to whatever API it is for, using the credentials you gave that profile. Bastion is the process holding the credential, not a proxy for the traffic — it never sees or forwards a response body to anyone but the client that asked.

Your licence key

Verification is an Ed25519 signature check on your own Mac. There is no activation call, no licence server, and nothing that phones home to count installs.

Buying a licence

Apart from anything you choose to write to us, this is the one place personal data exists at all, and it exists because a licence has to be deliverable and a refund has to be traceable back to a sale.

Checkout is handled by Stripe, who take the payment details — this site never sees a card number. What is kept afterwards is your email address, the Stripe session and payment identifiers, and the licence issued against them. The email is used to send you the key and to find the licence again if you ask for it or if a refund or dispute has to revoke it. It is not used for anything else, and there is no mailing list to be added to.

The app itself never sends your email anywhere. A key is checked offline, so an installed copy has no idea who bought it.

This site

Static files on Cloudflare, with no cookies and no third-party embeds. It loads no fonts and no images from anywhere else: the content security policy in astro.config.mjs names the two third-party origins this site is allowed to reach, and any other request would not merely be absent, it would be refused by the browser. Cloudflare keeps its own request logs, as any host does.

The first is Cloudflare Web Analytics, which counts page views. It sets no cookie and stores nothing on your device, so there is no banner asking you to accept it. What it records is the page address, the referring page, your browser and operating system, your screen size, how long the page took to load, and the country the request came from. It never receives your IP address, and there is no identifier that would let one visit be joined to another or to you. You can block it with any content blocker and the page works unchanged.

The second is feedback.mgcrea.io, a small worker of ours that the feedback form posts to. It receives what you typed and the four diagnostic fields shown beside it, only when you press Send, and it keeps the report so it can be answered. The email address is optional and used only to reply to you. No other page on this site talks to it.

Asking

To get a copy of what is held against your email, or to have it deleted, write to support@mgcrea.io. Deleting the record revokes the licence it belongs to, because the record is the licence — there is nothing else it could mean.