Privacy Policy · ClickyDots
The short version
ClickyDots is a local-first Mac app. Your notes never leave your computer through me. I run no servers that store your notes, I don’t track you, I don’t run analytics or ads, and I don’t sell data. There is no account to create and nothing to log into.
Who I am
ClickyDots is developed by Pawel Krupski (“I”, “me”), a natural person based in Poland, the data controller for the limited processing described below. Contact: click@clickydots.app · Website: https://clickydots.app
What ClickyDots stores, and where
- Your notes are plain Markdown (
.md) files saved in a folder you choose on your Mac (this may be inside your own iCloud Drive if you point the app there). They stay under your control. I never upload, copy, or receive your notes. - App preferences and your license key are stored locally on your Mac (macOS
UserDefaults). They are not transmitted to me. - Accessibility permission (which you grant in System Settings) is used only locally to enable global keyboard shortcuts. It is never transmitted.
Network connections the app makes
ClickyDots is offline by default. It connects to the network only in these cases, and never sends your notes or personal data:
1. Checking for updates (Sparkle). The app periodically contacts the update feed to see whether a newer version exists. This sends the current app version and the standard technical metadata inherent to any web request (such as your IP address, seen by the hosting server). Sparkle’s optional anonymous system profiling is disabled, so no system statistics are collected. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in keeping the app secure and up to date.
2. Sending diagnostics (only if you choose to). If you click “Send Diagnostics”, the app copies technical information (app version, your macOS version, and a recent diagnostic log) to your clipboard and opens a pre-addressed email to click@clickydots.app. Nothing is sent unless you decide to send that email. The diagnostic log may contain technical details including note file names (never note contents). You can review and edit the email before sending. Legal basis: your consent (Art. 6(1)(a) GDPR) by choosing to send the email.
What the app does NOT do
- ❌ No analytics, telemetry, tracking, or advertising in the app. (The website is a separate matter and is covered in *Website analytics* below.)
- ❌ No third-party tracking SDKs. (The only bundled third-party component is Sparkle, used solely for the update check above.)
- ❌ No selling, renting, or sharing of personal data.
- ❌ No account, login, or cloud profile.
- ❌ No automated decision-making or profiling.
Purchases
ClickyDots is sold through Paddle, which acts as the Merchant of Record. When you buy a license, Paddle processes your payment and billing details under its own privacy policy. I receive only the limited order information needed to deliver your license and provide support (for example, your email address and order/license details). I do not receive or store your full card details. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and, where applicable, legitimate interest for support.
Third parties involved
- Apple notarizes the app, which means Apple checks it for malware before your Mac will run it; this happens between me and Apple and does not involve your data. Separately, if you choose to keep your notes folder inside your own iCloud Drive, Apple hosts those files for you under Apple’s privacy policy. That is a choice you make, not something the app does on your behalf.
- Paddle: payments / Merchant of Record (see above).
- Maileroo delivers the waitlist emails you asked for. It processes your address on my instructions as a processor and does not use it for its own purposes.
- Cloudflare hosts everything on the web side: the website (clickydots.app), the app downloads, the update feed the app checks, and the database holding the waitlist addresses. May keep standard server logs (e.g. IP address, timestamp, user-agent) as any web host does. Cloudflare operates a global network; some processing may occur outside the EEA under appropriate safeguards (including Standard Contractual Clauses where required).
Website analytics
The website (clickydots.app) uses Rybbit, a privacy-friendly, self-hosted analytics tool running on my own server in Frankfurt, Germany (EU).
- No cookies or local storage are used.
- IP addresses are used only temporarily to derive country/region and are never stored.
- User identifiers are anonymized and re-salted daily, so visitors are not tracked across days.
- I collect only aggregated, anonymous statistics (page views, referrers, device type, country, etc.).
- No personal data that can identify you is retained.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding how the website is used and improving it.
Launch notifications (the waitlist)
If you enter your email address on the website to be told when ClickyDots is released, here is exactly what happens.
Nothing counts until you confirm. Submitting the form stores your address and sends you a confirmation email. You are not on the list until you click the link in it. If you never click, the entry is deleted automatically after 30 days, so an address entered by mistake, or by somebody else, disappears on its own.
What is stored: your email address, the dates you submitted and confirmed, and a record of the consent you gave: the exact sentence shown next to the checkbox, so that what you agreed to can be shown later rather than merely asserted.
What is not stored: your IP address. It is the conventional way to evidence consent, but the confirmation click proves more than an IP ever could, and I would rather not hold the data at all.
- Legal basis: your consent (Art. 6(1)(a) GDPR).
- Where it is stored: a database hosted by Cloudflare (see *Third parties involved*).
- Who else sees it: Maileroo, which delivers the email on my behalf as a processor. Nobody else. My own signup notification is anonymous and contains no address.
- What you will receive: the confirmation email, a short welcome email, and one email when the app launches. That is all.
- How long: once the launch email has gone out, the whole list is deleted, and in any case no later than 30 days after it. If you want to keep hearing from ClickyDots after that, you will need to sign up again. Consent is tied to the purpose you gave it for, and quietly rolling a launch list over into a newsletter is not something I am willing to do.
- Opting out: every email has a one-click unsubscribe link, which deletes your address rather than flagging it. You can also write to click@clickydots.app and I will delete it and confirm.
No tracking in the emails. Open- and click-tracking are switched off explicitly, so there is no invisible pixel and no rewritten links. The welcome email does load one image from my own website, which produces an ordinary server-log entry at my host in the same way visiting a page does; I do not use those logs to work out who opened what.
Data retention
I hold no database of your notes, and no user accounts. The only list I keep is the email addresses of people who asked to be told about the launch. See *Launch notifications* above, which explains when it is deleted. Otherwise, personal data associated with you sits with:
- Paddle (order records), according to Paddle’s retention policy;
- any support emails you choose to send me, kept only as long as needed to provide support and meet legal obligations (typically no longer than necessary, and deleted on request);
- standard server logs held by the website/update-feed host, according to their respective policies.
Your rights (GDPR / Polish law)
Because I hold almost no personal data, most requests are quickly satisfied. You have the right to:
- access your personal data,
- rectify inaccurate data,
- erase your data (“right to be forgotten”),
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time (where processing is based on consent),
- lodge a complaint with a supervisory authority (in Poland: UODO, uodo.gov.pl).
For payment data, contact Paddle as the Merchant of Record. Requests regarding any data I hold: click@clickydots.app.
Children
ClickyDots is a general-purpose productivity tool, not directed at children under 16, and I do not knowingly collect data from them.
Changes to this policy
If I change how the app handles data, I will update this page and revise the “Last updated” date. Material changes will be noted in release notes.
Contact
Questions about privacy: click@clickydots.app.