No tracking.

What stays on your Mac

Everything the app knows about you is in files you can open, inside your Library folder:

• ~/Library/Application Support/Contralto/undo-journal.json: the previous value of every setting the app changed, so Restore everything can put it back.
• ~/Library/Application Support/Contralto/clipboard.json: your clipboard history. It is on from the first launch, before Setup is finished; switch Clipboard history off in Setup, on the Clipboard screen or from the menu bar icon and nothing more is recorded. Nothing copied in Apple's Passwords app (or its menu bar item), Keychain Access, System Settings, or the 1Password, Bitwarden, LastPass and Dashlane apps is recorded, and neither is text an app marks as secret when it copies it. Copies from any other app are recorded like any other text, including a password copied from a browser extension or from a password manager not named here. Clear on the Clipboard screen deletes all of it except the items you pinned; Delete all clipboard history in Settings deletes those too.
• ~/Library/Application Support/Contralto/dock-backup.plist, dock-previous.plist, display-journal.json, firewall-journal.json, installed.json, updates.log: the Dock as it was before the app first changed it and before its latest change, the display modes it can restore, whether the firewall and its stealth mode were on before the app turned them on, which apps it installed for you, and a line per update check.
• ~/Library/Application Support/Contralto/trial.json and extended attributes on the Application Support folder: when the trial started and, after you buy, your licence key with its seat id and a code made from this Mac's hardware ID by a one-way function. The code never leaves the Mac; it only tells the app when your files have been moved to another Mac, which then takes a seat of its own. If the licence server ever withdraws the licence (after a refund, say), the reason it gave is kept in a third one until a key is activated in your account again, so the app can tell you why. No keychain entry.
• ~/Library/Application Support/Contralto/diagnostics/: the crash reports macOS delivers, only while "Keep crash reports on this Mac" is on in Settings. They stay there until you turn it off, which deletes them; you decide whether to paste their one-line summaries into an email.
• ~/Library/Application Support/Contralto/snips/: your last twenty screenshots taken with Win+Shift+S, PrintScreen or the Mac's own keys while the app was running, as PNG files, oldest deleted first. Delete any of them in Finder, or set the number kept on the Keyboard screen. Open in Preview in the Snips editor hands Preview a copy of the snip in the Preview folder inside it, and changes you save in Preview go into that copy; the app deletes the copy with its snip (at the next capture if you deleted the snip yourself), so export a picture you changed in Preview to another folder to keep it.
• ~/Library/Caches/Contralto/downloads/: an app you asked to install, while it is being checked. Deleted once the app is installed.

The keyboard engine stores no keystrokes. It looks at each key press only to decide whether it is one of the shortcuts you turned on, rewrites it if so, and forgets it. Window previews for Alt+Tab exist only while the switcher is open. Screenshots are taken by macOS itself, not by the app, which needs no Screen Recording permission for them; Copy text and Quick redact in the Snips editor read the picture with the text recognition built into macOS, on your Mac, and the words go to your clipboard and nowhere else.

Every connection the app can make

Three, each one started by something you do. Nothing runs in the background on its own except the licence confirmation and, if you allowed them, the update check and automatic updates.

1. Activating and confirming a licence

Licences are sold by Polar (Polar Software, Inc.), the payment processor and merchant of record for Contralto: the checkout, the receipt and the licence key come from Polar, and its privacy policy covers what it keeps about your purchase. The app talks to Polar's licence server (api.polar.sh) four ways:

• When you enter a key and click Activate: the key, our store's identifier and the name of this Mac (the computer name from System Settings), so the key can count your user account on this Mac as one of its seats. Every user account on a Mac sends the same name and takes its own seat. If your account already holds a seat on the same key, the key, the store identifier and that seat's id go first, to confirm that seat instead of taking a second one.
• Every 7 days while a licence is active: the key, our store's identifier and your account's seat id, to confirm the licence still stands. Without a connection the app keeps working for 14 days. A confirmation that gets no answer (no connection, a proxy or firewall in the way, a server error) is tried again with the same three every 6 hours, and every 5 minutes once the features have paused for it; Check now, shown then, sends one at once.
• If an activation is refused because every seat is taken: one more request with the key and the store identifier only, to learn how many seats the key has so the message can say so.
• When you click Deactivate this Mac, or when a new activation replaces your account's earlier seat: the key, the store identifier and the seat id, to free the seat.

Nothing else is sent: no serial number, no hardware fingerprint, no email, no account.

2. Checking for updates

If you allow automatic checks, when the app asks at its second launch or later in Settings, the app asks this site (contralto.app) for its update feed about once a day; you can also click Check for updates yourself. The request carries the app's version and the updater's version in its user-agent string and nothing about you or your Mac: system profile reporting is switched off in the app. When you accept an update, the app downloads it from this site and refuses it unless its signature matches the key built into the app. That question at the second launch, and the window that announces a new version, also have a box to download and install updates automatically, unticked at first. If you tick it, a new version downloads from this site in the background, with the same signature check, and installs when you quit the app; turning off Check for updates automatically in Settings stops that too.

3. Installing apps from the Apps screen

When you click Install, the app downloads the chosen program from its maker's own server, the same request a browser would make, identifying itself as "Contralto". Programs hosted on GitHub are looked up through the GitHub API to find their latest release; one entry reads its maker's mirror list first. The maker's server sees a download from your Mac; the app sends nothing about you.

Links

Buy, Support, the privacy policy, the Polar customer portal, an app's Website link and the links in the guide open in your web browser. The app itself never fetches those pages, and the guide inside the app loads no web fonts or scripts.

What we do not do

• No analytics or usage statistics from the app, ever, opt-in or otherwise.
• No crash reports are sent. Kept locally only if you ask.
• No account. The licence key is the only thing that identifies a purchase.
• The privileged helper that turns the firewall on for you never uses the network.
• No cookies on this site, no third-party scripts, no fonts fetched from anyone else's server.

Contact

Questions about this policy: support@contralto.app.