Clamshell is built to collect as little as possible. It has no user accounts, no analytics, no advertising, and no third-party tracking. This policy explains the little data that is involved and your rights over it.
Who is responsible
The data controller for Clamshell is Matyas Rathonyi, a sole trader established in Hungary. For any privacy question or request, contact [email protected]. We are not required to appoint a data protection officer and have not done so.
What leaves your Mac
When you activate or validate a license, the app sends two things to our licensing service at api.clamshell.dev:
- your license key; and
- a device identifier: a one-way, salted SHA-256 hash of your Mac's hardware identifier. Your actual hardware identifier never leaves your device, and the hash cannot be reversed by us or correlated with other apps.
We use these only to confirm your license is valid and to bind it to a device "seat" so a single license is not used on more machines than your plan allows. Our service stores, per license, a mapping from that device hash to a random activation id, plus short-lived technical records used to process purchase notifications. We do not store your name, email, or IP address.
This device hash is a pseudonymous identifier and is treated as personal data under the GDPR.
What stays on your Mac
The following are kept locally on your device and are never transmitted to us: your trial start date and related timestamps, a cached copy of the device identifier, and a local diagnostic log and process file used for crash recovery. You can remove all of it by uninstalling the app.
Payments
Purchases are handled by Lemon Squeezy as our Merchant of Record, on its own hosted checkout. Lemon Squeezy collects and processes your name, email, and billing and payment information, and acts as an independent data controller for that data. We never see your card details. We receive your name and email from Lemon Squeezy only to deliver your license key and provide support. See Lemon Squeezy's Privacy Policy.
Legal basis
We process the license key and device hash to perform our contract with you (Article 6(1)(b) GDPR): we cannot deliver a licensed product without verifying your entitlement. Delivering your license key and providing support by email rests on the same basis.
Who we share data with
- Cloudflare hosts our licensing service and this website and acts as our data processor. It transiently handles standard request data (such as IP address and browser type) to deliver and secure the service; this is not stored by us.
- Lemon Squeezy processes payments as described above, as an independent controller.
We do not sell your data and do not share it with anyone else, except where required by law.
International transfers
Cloudflare and Lemon Squeezy are established in the United States, so some data may be processed outside the European Economic Area. Where this happens, those transfers are covered by the safeguards each provider relies on, such as the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as described in their respective policies.
How long we keep it
The device-hash and activation records are kept for as long as your license exists, plus a short period for cleanup. The technical purchase-notification records are short-lived. Local data lives only on your Mac until you uninstall. Lemon Squeezy retains payment and tax records under its own policy and applicable tax law.
Your rights
Under the GDPR you have the right to access, correct, erase, restrict, or object to the processing of your personal data, and the right to data portability. Because we hold only an opaque device hash with no name attached, we may need your license key to locate your records. To exercise any right, email [email protected]; we aim to respond within one month.
Complaints
You have the right to lodge a complaint with your local data protection authority. In Hungary this is the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvedelmi es Informacioszabadsag Hatosag, NAIH), 1055 Budapest, Falk Miksa utca 9-11, Hungary, [email protected], naih.hu.
Cookies and tracking
This website sets no cookies of its own and uses no analytics or tracking scripts. Our hosting provider, Cloudflare, may set strictly necessary cookies to keep the site secure and available; these are exempt from consent and are not used to track you. Because we use no non-essential cookies, there is no consent banner.
Children
Clamshell is not directed at children, and we do not knowingly collect data from children.
Changes
We may update this policy from time to time. We will post the revised version here with a new "last updated" date, and we will give reasonable notice of any material change.