Privacy Policy

The Mac app collects nothing

The ShortcutDock desktop application runs locally on your Mac. It has no account system, no sign in, and no telemetry.

• No data collection. The app does not record or transmit which applications you launch, how often you launch them, or how you have arranged your dock.
• Works offline. The app does not need an internet connection to do its job.
• Settings stay on your Mac. Your shortcuts, groups and preferences are stored in the app's own sandboxed preferences on your device. We never receive a copy.

Everything below this point is about the website at shortcutdock.com, not about the app.

The website uses Google Analytics

The live website loads Google Analytics (the gtag.js tag served from googletagmanager.com). It is not a self-hosted or cookieless analytics tool. It runs on the published site; it is switched off in local development builds.

Google Analytics receives, on each page view:

• The page address, path and title.
• The referring page, if you arrived from a link.
• Your IP address, which Google uses to derive an approximate location.
• Standard browser and device details, such as user agent, language and screen size.
• An identifier stored in Google's own cookies so repeat visits can be grouped into a session.

Google sets the _ga cookie family in your browser for this purpose. Those cookies are described in our Cookie Policy, along with how to block them. Google acts as its own controller for this data under its own privacy terms.

Download and checkout records

Separately from Google Analytics, our own server writes a record to our database in two situations: when you start a download, and when you are sent to the checkout page to buy Pro. This happens server side, so it cannot be stopped by a browser tracker blocker.

Each of those records can contain:

• A SHA-256 hash of your IP address, used to tell repeat events apart without reading the address itself.
• Your IP address in plain form. See the retention rules below.
• Approximate location derived from that IP: country, region, city, time zone, the city's approximate coordinates, and the network operator or ISP name.
• Device and browser details taken from your user agent string, plus the raw user agent itself.
• For downloads, the processor type of the build you were sent (Apple Silicon or Intel) and the release version.
• The referring URL and any utm_source, utm_medium or utm_campaign values in the link you followed.
• The time of the event.

We use these records to see how many downloads a release gets, which countries and Mac types to support, and which links actually bring people to the app.

IP addresses and how long we keep them

We want to be exact here, because it is the part most privacy policies get wrong.

• Download and checkout records. The plain IP address is kept for up to 30 days so we can investigate abuse, spot download floods and confirm rate limiting is working. After 30 days a maintenance job clears the plain address on both kinds of record and leaves only the hash and the derived location. The job is run on a schedule or by hand, so the clearing is not instantaneous at the 30 day mark. You can also ask us to delete a record sooner.
• Hashes and location. The IP hash and the country, region and city fields are kept for as long as we keep the statistics.

Rate limiting on the download endpoint and the contact form also keeps a short-lived counter against your IP address in server memory. It is never written to disk and is discarded within minutes.

IP geolocation through IPInfo

To turn an IP address into a country and city, our server sends that IP address to IPInfo, a third-party geolocation service. IPInfo returns country, region, city, time zone, approximate coordinates and the network operator, and we store that with the event record.

• The lookup runs only for download and checkout events, not for ordinary page views.
• Results are cached briefly in memory and reused from our own database when we already have a location for the same address, so the same visitor is not looked up repeatedly.
• Private, loopback and local network addresses are skipped and never sent.

The contact form and Mailgun

If you use the contact form we collect your name, email address, chosen subject and message. That submission is not saved to our database. It is formatted into an email and delivered through Mailgun, an email delivery provider, to our support inbox, with your address set as the reply-to.

• Mailgun processes the content of your message in order to deliver it, and keeps its own delivery logs.
• Your message then lives in our email inbox until we delete it.
• We use your details only to answer you. We do not sell them or pass them to marketing companies.
• You can ask us to delete your message history at any time.

Payments through Polar

Buying the Pro upgrade sends you off our site to a checkout hosted by Polar, our payment provider and merchant of record. Any tracking parameters on the link you clicked are carried through to that checkout page.

Your payment details are entered on Polar's own pages and are never sent to, seen by, or stored on our servers. Polar handles your purchase under its own privacy policy.

Hosting, downloads and server logs

Application builds are not served from this site directly. A download request is redirected to our content delivery network at scd.cdn.shortcutdock.com, which serves the installer file.

Our hosting and CDN providers keep their own technical request logs, typically including IP address, timestamp and user agent, to serve traffic and defend against denial of service attacks. Those logs are held under those providers' own terms and retention periods, not ours.

Cookies

The website's only cookies on public pages are the ones Google Analytics sets. Our own first-party cookies are used in the private administrator area and are never set for ordinary visitors. The Cookie Policy lists each one and explains how to refuse them.

Your choices and your requests

• Opt out of analytics. Block cookies for this site, use a tracker blocker, or install Google's opt-out browser add-on. The site works normally without them.
• Avoid the event logs. Download and checkout records are created by the act of downloading or opening the checkout. If you would rather not create one, do not use those links.
• Ask for a copy or a deletion. Contact us and we will look up records that match your IP address or your email and remove them. An address hash alone is not always enough to find you, so tell us roughly when the event happened.

Nothing on this page applies to the app on your Mac. There is no server-side record of your use of it to request or delete.

Changes to this policy

We may update this policy as the site changes. Updates are posted on this page and the "Last updated" date above is changed to match.

Contact us

Questions about anything above, or a request about your data, can go through our contact form.