Clamshell is built to collect as little as possible. It has no user accounts, advertising, or cross-site tracking. We use cookie-free, aggregate website analytics and the minimum data needed to license and secure the app. This policy explains that processing and your rights.
Who is responsible
The data controller for Clamshell is Clamshell Korlátolt Felelõsségű Társaság (Clamshell Kft.), registered seat 1021 Budapest, Völgy utca 27/B B. ép. I. em. 4. ajtó, Hungary. For any privacy question or request, contact hello@clamshell.dev. We are not required to appoint a data protection officer and have not done so.
What leaves your Mac
When you activate or validate a license, the app sends two things to our licensing service at api.clamshell.dev:
- your license key; and
- a device identifier: a one-way, salted SHA-256 hash of your Mac's hardware identifier. Your actual hardware identifier never leaves your device, and the hash cannot be reversed by us or correlated with other apps.
We use these only to confirm your license is valid and to bind it to a device "seat" so a single license is not used on more machines than your plan allows. Our service stores, per license, a mapping from that device hash to a random activation id, plus short-lived technical records used to process purchase notifications. For abuse prevention, Cloudflare supplies the request IP address; our application converts it immediately to a product-scoped one-way hash used to serialize a one-minute request counter. We do not store the raw IP address in our application state.
This device hash is a pseudonymous identifier and is treated as personal data under the GDPR.
What stays on your Mac
The following are kept locally on your device and are never transmitted to us: your trial start date and related timestamps, a cached copy of the device identifier, and a local diagnostic log and process file used for crash recovery. The licensing record is also stored in macOS Keychain and intentionally survives an ordinary app reinstall, so deleting the app alone does not remove every local record. You can remove the Clamshell Application Support folder and its Keychain items, or contact us for exact deletion instructions.
Payments
Purchases are handled by Lemon Squeezy as our Merchant of Record, on its own hosted checkout. Lemon Squeezy collects and processes your name, email, and billing and payment information, and acts as an independent data controller for that data. We never see your card details. We receive your name and email from Lemon Squeezy only to deliver your license key and provide support. See Lemon Squeezy's Privacy Policy.
Legal basis
We process the license key and device hash to perform our contract with you (Article 6(1)(b) GDPR): we cannot deliver a licensed product without verifying your entitlement. Delivering your license key and providing support by email rests on the same basis. We process the short-lived pseudonymous request counter and aggregate website measurements under our legitimate interests (Article 6(1)(f) GDPR) in protecting the licensing service from abuse and understanding whether the site works reliably, without cookies or cross-site profiles.
Who we share data with
- Cloudflare hosts our licensing service and website, protects them from abuse, and provides cookie-free Web Analytics. It processes standard request and browser data under our instructions and returns aggregate website measurements.
- Lemon Squeezy processes payments as described above, as an independent controller.
We do not sell your data and do not share it with anyone else, except where required by law.
International transfers
Cloudflare and Lemon Squeezy are established in the United States, so some data may be processed outside the European Economic Area. Where this happens, those transfers are covered by the safeguards each provider relies on, such as the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as described in their respective policies.
How long we keep it
The device-hash and activation records are kept for as long as your license exists, plus a short period for cleanup. Rate-limit counter state expires after one minute and purchase-notification dedupe state after one day. Aggregate website analytics are retained according to our Cloudflare account settings. Local files remain until you remove them; the Keychain licensing record remains until you delete the corresponding Keychain items. Lemon Squeezy retains payment and tax records under its own policy and applicable tax law.
Your rights
Under the GDPR you have the right to access, correct, erase, restrict, or object to the processing of your personal data, and the right to data portability. Because we hold only an opaque device hash with no name attached, we may need your license key to locate your records. To exercise any right, email hello@clamshell.dev; we aim to respond within one month.
Complaints
You have the right to lodge a complaint with your local data protection authority. In Hungary this is the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvedelmi es Informacioszabadsag Hatosag, NAIH), 1055 Budapest, Falk Miksa utca 9-11, Hungary, ugyfelszolgalat@naih.hu, naih.hu.
Cookies and tracking
This website uses Cloudflare Web Analytics, a cookie-free measurement script, to produce aggregate traffic and performance statistics. It is not used for advertising or cross-site tracking. Cloudflare may also set strictly necessary security cookies. Because we use no non-essential cookies, there is no consent banner.
Children
Clamshell is not directed at children, and we do not knowingly collect data from children.
Changes
We may update this policy from time to time. We will post the revised version here with a new "last updated" date, and we will give reasonable notice of any material change.