Privacy Policy

Overview

NotchPad is designed as a local-first Mac app. Your notes, snippets, clipboard history, files, and AI content are stored on your Mac, not in a NotchPad cloud account. When you enable AI Connections, selected content is available to the connected AI apps as described below. This policy also explains the limited cases where non-content data may leave your device: optional anonymous app diagnostics, website analytics, mobile download-link emails you request, checkout attribution, Polar payments, license verification, Apple Notes sync that you enable, and software update checks.

App Data

The NotchPad Mac app does not include advertising or third-party crash-reporting SDKs. It includes optional anonymous usage and reliability diagnostics through TelemetryDeck. Diagnostics are enabled by default and can be disabled at any time with Share Diagnostics in Settings. We do not operate a NotchPad account system.

• Notes, snippets, and clipboard history are stored on your device. Exported or shared content can leave your device through the destination you choose.
• Unlocked notes and regular clipboard items are stored locally in Application Support.
• Locked notes and detected sensitive clipboard items are encrypted locally using keys stored in the macOS Keychain.
• The eye control masks body content in the interface and requires authentication to reveal it. It remembers your choice; this is separate from encrypting a locked note.
• Trial start and observed time are stored in the macOS Keychain. Trial expiry does not remove saved notes, snippets or clipboard history.
• Exported library backups are encrypted with your chosen backup password. Optional clipboard contents are included only when selected. Keep the password safe; it is required to restore the backup.
• You can delete local app data from within the app where available, or by removing NotchPad data from your Mac.

AI Connections (MCP)

AI Connections is disabled until you enable it in Settings. You choose shared folders, unfiled notes, snippets, and read or write permissions for each connection. Connected apps can read shared unlocked local notes; write permission also allows creation, appending content, and opening notes. Locked notes, Apple Notes-linked notes, clipboard history, and unshared content are excluded.

NotchPad serves MCP requests through a private local connection and does not upload your content to a NotchPad server. A connected AI app may send the content it reads to its provider. Its own settings and privacy policy govern that processing. You can change sharing, revoke individual connections, or disable AI Connections in NotchPad at any time.

Optional App Diagnostics

When Share Diagnostics is enabled, NotchPad sends anonymous event names and coarse categories that help us understand usage and reliability. These may include app activity, onboarding completion, feature usage, success or failure outcomes, broad duration buckets, free or Pro status, feature-limit and upsell impressions, checkout opens, and license activation outcomes.

• Diagnostics never include notes, clipboard content, snippets, files, AI prompts or results, Apple Notes content, license keys, customer email, or payment details.
• TelemetryDeck may process an anonymous per-install identifier, rounded event time, and basic app or device metadata such as app version, macOS version, device type, and language.
• TelemetryDeck states that it does not store IP addresses, cookies, or persistent identifiers traceable to an individual. See TelemetryDeck's Privacy Policy and Privacy FAQ.
• You can stop future diagnostic events at any time by turning off Share Diagnostics in NotchPad Settings.

Website Analytics and Attribution

Our website uses analytics and checkout attribution to understand which pages and sources lead to downloads, checkout clicks, completed purchases, or checkout drop-offs.

• Vercel Analytics and Speed Insights collect aggregate website performance and visitor information. Vercel Analytics is designed to be cookieless and anonymized. See Vercel Web Analytics.
• Google Analytics 4 (GA4) loads when you visit the website so we can understand page views, referral sources, downloads, checkout clicks, and checkout drop-offs. Unless you reject analytics, GA4 may process page views, referral source, approximate location, device/browser information, IP-derived data, and analytics cookies. If you reject analytics, we set Consent Mode to deny analytics storage and remove existing GA cookies where possible; GA4 may still receive limited cookieless measurement pings. See Google's Privacy Policy.
• Checkout attribution stores app, product, clean landing path, clean checkout path, CTA identifier, UTM source/medium/campaign, referrer host, generated intent ID, and purchase/drop-off status. We intentionally strip arbitrary query strings from page paths.
• Founder alerts may be sent to Telegram for completed sales and checkout drop-offs. These alerts intentionally exclude customer name, email, billing address, license key, notes, clipboard content, and Apple Notes content.

Checkout attribution records are stored in our private Vercel/Upstash storage with limited retention so we can understand aggregate landing-page and checkout performance.

Download Link Emails

If you request a Mac download link from the mobile website, we collect the email address you enter and send it to Resend so Resend can deliver the requested transactional email from the TinyThings domain. The email contains the official NotchPad download page URL. We do not use this form to subscribe you to marketing emails.

We may use a hashed combination of your email address and request metadata in Vercel/Upstash storage for short-term rate limiting and abuse prevention. The hash is not used to build a mailing list.

Payments and Polar

Purchases are processed by Polar, our merchant of record and authorized reseller. When you buy NotchPad Pro, Polar may collect and store personal data such as your name, email address, billing address, payment metadata, tax or VAT details, IP/device data, and purchase history according to Polar's Privacy Policy and Polar Buyer Terms.

We may access order and customer details in Polar for support, refunds, license delivery, fraud prevention, accounting, and legal compliance. We do not send customer name, email address, billing address, or license keys to GA4, Telegram alerts, or public analytics.

Local Storage

All user content created within NotchPad is stored locally using macOS-native storage mechanisms. This content never leaves your device unless you explicitly choose to export or share it.

Clipboard Access

NotchPad monitors your system clipboard to provide clipboard history functionality. This data is stored locally and is never transmitted externally. You can clear your clipboard history at any time from within the app.

On-Device Dictation

When you choose to dictate into a note, NotchPad requests microphone access and uses on-device Apple speech recognition. The macOS 15 fallback also requests Speech Recognition permission. Audio is not saved or sent to a NotchPad server. Apple may download a language model before first use. The resulting text is saved in your local note; sharing that note through AI Connections follows the sharing rules above.

Apple Notes Access

NotchPad can access your Apple Notes through macOS automation (AppleScript) if you grant permission. This allows you to browse, search, and edit Apple Notes from within NotchPad. Apple Notes content is stored and synced by Apple, not by NotchPad. NotchPad may display Apple Notes metadata, previews, and note content locally while you use the feature, but it does not transmit Apple Notes content to a NotchPad server. Edits made through NotchPad are written directly back to the Apple Notes app. If you have iCloud Notes enabled, changes sync through Apple's infrastructure according to Apple's privacy policy.

Touch ID / Biometric Data

NotchPad uses macOS biometric authentication (Touch ID) to lock individual notes. Biometric data is handled entirely by macOS and is never accessed or stored by NotchPad.

License Verification

When you enter a license key, NotchPad communicates with Polar to verify your license. This transmits your license key and a machine identifier used for activation limits. The app stores your license key in the macOS Keychain and may store license status, activation ID, validation timestamp, and the customer email returned by Polar locally on your Mac. Notes, snippets, clipboard content, and Apple Notes content are not sent to Polar for license verification.

Software Updates

NotchPad checks for software updates using Sparkle. Update checks may contact our appcast hosted through GitHub/Gist and may transmit basic technical information such as app version and macOS version so Sparkle can determine whether an update is available.

Cookies

The NotchPad app does not use cookies. On the website, GA4 analytics is enabled by default. Rejecting analytics switches GA4 analytics storage to denied, keeps GA cookies off, and removes existing GA cookies where possible. Keeping analytics enables GA analytics cookies. We store your analytics choice in local storage for 30 days so you do not have to answer on every page. After it expires, we may ask again and apply the current default analytics behavior unless you reject analytics again.

Manage analytics preference

Data Retention

Local app data is stored on your device until you delete it. Anonymous app diagnostics are retained according to our TelemetryDeck service settings and TelemetryDeck's privacy practices. Checkout attribution records and download-link rate-limit hashes are retained for limited operational periods. Download-link emails are retained according to Resend's email log and account settings. Website analytics data is retained according to Vercel and Google Analytics settings. Polar may retain purchase and tax records as required for payment processing, accounting, tax, fraud prevention, and legal compliance.

Service Providers

Depending on how you interact with NotchPad, data may be processed by TelemetryDeck, Vercel, Google Analytics, Polar, Upstash/Vercel KV, Resend, Telegram, GitHub/Gist, Sparkle, and Apple. These providers process data under their own terms and privacy policies where applicable.

Your Rights

Depending on your location, you may have rights regarding your personal data, including the right to access, correct, delete, or port your data.

• App content: Since your user content is stored locally on your Mac, you have full control — you can view, export, or delete it at any time.
• App diagnostics: You may stop future anonymous diagnostic events at any time by turning off Share Diagnostics in NotchPad Settings.
• Website analytics: You may reject analytics cookies from our cookie banner or manage your analytics preference above.
• California residents (CCPA/CPRA): We do not sell or share personal information for cross-context behavioral advertising.
• EU/EEA residents (GDPR): Our legal bases include legitimate interests for privacy-safe app and site measurement and, where required, consent for GA4 analytics cookies, requested download-link delivery, abuse prevention, checkout attribution, contract performance for licensing and support, and legal obligations for payment, tax, and accounting records.

To exercise any rights, contact us at support@tinythings.app.

Children's Privacy

NotchPad is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

Governing Law

This Privacy Policy is governed by the laws of Singapore.

Changes to This Policy

We may update this policy from time to time. Any changes will be reflected on this page with an updated date.

Contact

If you have questions about this policy, contact us at support@tinythings.app or use our contact form.

See also: Terms of Service · Pricing · How clipboard encryption works