Clamshell is built to collect as little as possible. It has no user accounts, advertising, or cross-site tracking. We use cookie-free aggregate website measurements, optional consent-based direct-app analytics, download-source measurement, and the data needed to license and secure the app. This policy explains that processing and your rights.
Who is responsible
The data controller for Clamshell is Clamshell Korlátolt Felelõsségű Társaság (Clamshell Kft.), registered seat 1021 Budapest, Völgy utca 27/B B. ép. I. em. 4. ajtó, Hungary. For any privacy question or request, contact hello@clamshell.dev. We are not required to appoint a data protection officer and have not done so.
What leaves your Mac
When you activate or validate a license, the app sends two things to our licensing service at api.clamshell.dev:
- your license key; and
- a device identifier: a one-way, salted SHA-256 hash of your Mac's hardware identifier. Your actual hardware identifier never leaves your device, and the hash cannot be reversed by us or correlated with other apps.
We use these only to confirm your license is valid and to bind it to a device "seat" so a single license is not used on more machines than your plan allows. Our service stores, per license, a mapping from that device hash to a random activation id, plus technical records used to process purchase notifications and the separate purchase-reporting records described below. For abuse prevention, Cloudflare supplies the request IP address; our application converts it immediately to a product-scoped one-way hash used to serialize a one-minute request counter. We do not store the raw IP address in our application state.
This device hash is a pseudonymous identifier and is treated as personal data under the GDPR.
What stays on your Mac
The following normally stay on your device: your trial start date and related timestamps, a cached copy of the device identifier, and a local diagnostic log and process file used for crash recovery. If you explicitly enable optional app analytics in the direct-distribution app, the original trial start date and the bounded events described below are transmitted. Raw diagnostic logs are never transmitted. The licensing record is also stored in macOS Keychain and intentionally survives an ordinary app reinstall, so deleting the app alone does not remove every local record. You can remove the Clamshell Application Support folder and its Keychain items, or contact us for exact deletion instructions.
Payments
Purchases are handled by Lemon Squeezy as our Merchant of Record, on its own hosted checkout. Lemon Squeezy collects and processes your name, email, and billing and payment information, and acts as an independent data controller for that data. We never see your card details. We receive your name and email from Lemon Squeezy only to deliver your license key and provide support. See Lemon Squeezy's Privacy Policy.
Download-source measurement
Downloads from distribution links, such as Product Hunt, contain a shared campaign label. Clamshell saves that label with its local licensing record on first launch and keeps it through updates and the trial. This happens automatically in the background. It does not read browser history or use a browser cookie. Everyone downloading the same campaign package receives the same label.
When you open checkout, the app passes that shared label to Lemon Squeezy. Website checkout links can instead supply the shared discovery-source label described below and the location of the Buy button. No installation or analytics identifier is placed in checkout custom data. Our purchase reporting database stores the order number, source label and capture method when available, checkout button location when supplied, purchase and update dates, currency, amount, refund amount, payment status, and whether the order is a test. It does not store customer names, email addresses, installation identifiers, license keys, card details, or full browsing URLs. We use these records to count purchases by source and account for refunds.
To ask about or object to download-source processing, contact hello@clamshell.dev. Include your order number if your request concerns an existing purchase. Source measurement does not change your license or trial.
Optional app analytics
The direct-distribution app offers analytics during its existing onboarding and in Settings. Analytics is off unless you choose Share analytics & continue or later enable Share analytics. Continuing without sharing does not grant consent, existing users remain opted out, and your choice never affects app operation, licensing, safety behavior, or the seven-day trial.
When enabled, Clamshell creates a random analytics identifier that is separate from your hardware identifier, device hash, license key, and licensing seat. It can send these bounded events:
- analytics enrollment, distinguishing a fresh trial, an existing or expired trial, and an already-paid user;
- trial start, the assigned trial duration, consent version and time, event time, and app version;
- one usage event per elapsed trial day when Clamshell receives a real lid-close transition while it is confirmed armed. This means the lid closed while the app was armed; it does not prove that your work or agents succeeded;
- an expired-trial purchase window actually shown, and checkout requests with the requesting surface;
- bounded safety-intervention categories, such as thermal or low-battery disarming, separately from bounded technical-failure categories, at most once per category per UTC day; and
- the purchased product variant, purchase time, payment status, and refunds when a consenting license activation can be matched to a verified live order.
We do not collect files, work content, prompts, commands, process lists, window titles, raw diagnostic logs, license keys, hardware identifiers, customer names, email addresses, payment-card details, or full browsing URLs through app analytics. Test purchases, development builds, and Setapp builds are excluded. An unmatched purchase remains unattributed, and repeated device activation does not count as another purchase.
On a consenting license activation or validation, Clamshell sends its separate random analytics identifier to our licensing service. The service checks the license's order number against its signed purchase record and verifies the order's live status with Lemon Squeezy before linking that order to analytics. It does not send the analytics identifier to Lemon Squeezy or store your license key or device hash in analytics records. A purchase with no matching verified activation remains unattributed.
You can withdraw in Clamshell Settings as easily as you enabled sharing. Withdrawal immediately stops new collection, clears unsent events, removes the local analytics identifier, and sends a deletion request. We delete identifiable analytics events and remove the analytics link from purchase-reporting rows. We preserve independently required transaction, refund, tax, fraud-prevention, license, and seat records. Irreversibly aggregated statistics that can no longer be connected to you may remain.
Analytics reports compare trial-to-first-use, repeat use, usage on days 4 through 7, checkout requests followed by linked purchases within 30 days, and purchase timing through 30 days by trial duration, app version, and fresh or existing trial cohort. Buyers who do not activate while sharing are absent from linked purchase rates. These cohorts represent consenting users and therefore have consent-selection bias. Separate aggregate order totals include consenting and non-consenting buyers. A website download-to-order ratio is not a trial-cohort conversion rate.
Website source and button measurements
On the homepage and guides, a small first-party script recognises a limited set of campaign labels and referring sites, such as Medium or Product Hunt. It carries a shared source label in links between these pages and into download and checkout links. It uses no cookies, local storage, browser-history access, or persistent visitor identifier. It does not send us the full referring URL, search terms, arbitrary campaign text, or other query parameters.
We store daily aggregate counts of page views, entries, download clicks, and checkout opens, grouped by the declared source, capture method, page, and button location. These counts cannot identify a unique visitor or prove that a download was installed. An unknown source stays unknown. A website source is not retained through a generic app download; delayed purchase reporting uses the shared campaign package label when one exists.
These first-party measurements respect Global Privacy Control and Do Not Track signals. We also skip recognised bots and prefetch requests. A short-lived request counter limits abuse using the same one-minute pseudonymous IP-hash mechanism described above. To object or ask a question, contact hello@clamshell.dev.
Legal basis
We process the license key and device hash to perform our contract with you (Article 6(1)(b) GDPR): we cannot deliver a licensed product without verifying your entitlement. Delivering your license key and providing support by email rests on the same basis. Optional direct-app analytics relies on your consent (Article 6(1)(a) GDPR), which you may withdraw at any time without affecting prior lawful processing. We process the short-lived pseudonymous request counter, aggregate website measurements, and download-source reporting under our legitimate interests (Article 6(1)(f) GDPR) in protecting the licensing service from abuse and understanding whether the site works reliably and which distribution links lead to purchases, without cookies or cross-site profiles.
Who we share data with
- Cloudflare hosts our licensing service, analytics database, and website, protects them from abuse, and provides cookie-free Web Analytics. For data it processes on our behalf, it acts as our processor under its Data Processing Addendum.
- Lemon Squeezy processes hosted checkout, payment, tax, fraud, and transaction data as described above, principally as an independent controller. It does not receive the optional app analytics identifier.
We do not sell your data and do not share it with anyone else, except where required by law.
International transfers
Cloudflare and Lemon Squeezy are established in the United States, so some data may be processed outside the European Economic Area, the United Kingdom, and Switzerland. Cloudflare's Data Processing Addendum incorporates the applicable EU Standard Contractual Clauses, the UK Addendum, Swiss adaptations, and Data Privacy Framework coverage where valid for the recipient and service. Lemon Squeezy describes United States and other processing locations and the safeguards it relies on in its privacy and contractual terms. We review the applicable provider role, subprocessor chain, transfer mechanism, and risk assessment for each data flow; end-user analytics consent does not replace those requirements. You may contact us for information about the safeguards relevant to your data.
How long we keep it
Identifiable app-analytics events, purchase links, and withdrawal-prevention records are retained for at most 60 days. We delete active analytics records after 51 days at the latest daily cleanup, allowing for Cloudflare D1's current seven-day point-in-time recovery history within that limit. Withdrawal clears active records sooner; recoverable database history expires within seven days. Irreversibly aggregated analytics may be kept longer. The device-hash and activation records are kept for as long as your license exists, plus a short period for cleanup. Rate-limit counter state expires after one minute and purchase-notification dedupe state after one day. Purchase-reporting records are removed after two years from the purchase date by a daily cleanup. Our daily website source and button counts are removed after 180 days. Cloudflare Web Analytics measurements are retained according to our Cloudflare account settings. Local files remain until you remove them; the Keychain licensing record remains until you delete the corresponding Keychain items. Lemon Squeezy retains payment and tax records under its own policy and applicable tax law.
Cloudflare Worker invocation logging is enabled. It may record request metadata such as the method and URL, and currently retains those logs for three days on our Workers Free plan. The analytics identifier is not put in the URL, and we do not configure raw analytics request-body logging.
Your rights
Under the GDPR you have the right to access, correct, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw analytics consent. The in-app Settings toggle handles analytics withdrawal without requiring you to identify yourself to us. We may need your license key to locate licensing records or your order number to locate purchase-reporting records. To exercise any other right, email hello@clamshell.dev; we aim to respond within one month.
Complaints
You have the right to lodge a complaint with your local data protection authority. In Hungary this is the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvedelmi es Informacioszabadsag Hatosag, NAIH), 1055 Budapest, Falk Miksa utca 9-11, Hungary, ugyfelszolgalat@naih.hu, naih.hu.
Cookies and tracking
This website uses Cloudflare Web Analytics and the first-party measurements described above to produce aggregate traffic, performance, and source statistics. Neither measurement code uses browser cookies. They are not used for advertising or cross-site profiles. Cloudflare may set strictly necessary security cookies. The website has no cookie consent banner.
Children
Clamshell is not directed at children, and we do not knowingly collect data from children.
Changes
We may update this policy from time to time. We will post the revised version here with a new "last updated" date, and we will give reasonable notice of any material change.