Privacy Policy

What we collect, what we don't, and what happens when the app talks to the network.

Effective 10 October 2026 · Version 1.3

1. Scope

This Privacy Policy describes how Maciej Raciborski, Switzerland (the "Developer") handles personal data in connection with the Swift Salamander macOS application (the "App") and the marketing website at swiftsalamander.app (the "Site"). It complements the Terms of Use; defined terms used here have the meaning given in the Terms.

2. What We Don't Collect

The App contains no telemetry, no analytics SDKs, no crash reporters, no advertising identifiers, and no third-party trackers. The App does not phone home with usage data, file names, file contents, file metadata, directory structure, search queries, or installed-application lists. The one identifier of your Mac it sends is a one-way hash of its hardware UUID, used to count license activations and trials and described in section 4.2; the hardware UUID itself is not sent.

The Site contains no cookies set by us, no analytics scripts (no Google Analytics, Plausible, Fathom, or equivalent), no advertising pixels, and no social-media trackers. The only outbound link from the homepage that leaves a third-party referrer is when you click through to Polar to purchase Pro.

3. What Stays on Your Device

Everything the App needs to do its job is processed locally on your Mac. This includes:

• Your files and folders, file contents, and file metadata.
• Directory listings, search indexes, thumbnail caches, and the mtime-validated directory cache.
• The crash-recoverable operation journal (records of recent copy / move / delete / rename operations, used for undo and crash-recovery).
• App settings, accent colour, density, theme, sidebar pins, tab state, and other preferences.
• Cloud remotes you configure through rclone (S3, Google Drive, Dropbox, B2, OneDrive, FTP, and the other backends rclone supports), including any credentials or sign-in tokens they require. These are written to rclone's own configuration file on your Mac.
• Direct connections to SFTP, SMB and WebDAV servers. The server address, port, username, starting folder and, for SFTP, the location of the key file you chose are stored by the App on your Mac. The password, and the passphrase of an SFTP key, are stored in your macOS Keychain and are never written to the rclone configuration file. A connection that signs in through your SSH agent, or to a WebDAV server that needs no sign-in, stores no secret at all.
• The host keys of SFTP servers you have connected to, recorded by the App the first time so that a changed key can be refused. These are public keys, not credentials.
• Copies of remote files you open or preview. The App downloads them to its cache folder under ~/Library/Caches so your usual apps can open them. At launch the App deletes copies older than seven days, and Reset Thumbnail Cache under Settings › Advanced deletes all of them.
• Your Pro license key, if any, stored in the App's folder under ~/Library/Application Support and in your macOS Keychain.

None of the above is transmitted to the Developer.

How those credentials are protected differs by store. Keychain items are encrypted at rest by macOS. Credentials in the rclone configuration file are obscured rather than encrypted, and obscuring is reversible by anyone who can read that file, unless you have set an rclone configuration password, which encrypts the file as a whole. The file never leaves your machine, but treat it as sensitive.

4. When the App Talks to the Network

The App makes outbound network requests in the following situations, and only in these situations:

4.1 Update Checks

The App periodically requests an updater manifest from the Developer's hosting provider to determine whether a newer version is available. The request includes the current App version and the standard HTTP headers your operating system attaches automatically (User-Agent and your IP address). The hosting provider may log these briefly for abuse-prevention purposes; the Developer does not associate them with any identity. No license key, file data, or settings are sent.

4.2 License Validation

If you have a Pro license, the App checks that the key is still valid by sending the license key (an opaque token issued by Polar at purchase), the Developer's Polar organization identifier and the identifier of this Mac's activation to Polar's license-key endpoint. When you activate or deactivate a key on this Mac, the request goes to a license endpoint operated by the Developer, which passes it on to Polar. The activation request, and the request that asks the Developer's license endpoint to sign a license or trial record kept on your Mac, also carry an identifier of your Mac, which is a one-way hash of the hardware UUID macOS reports for it. Polar keeps that hash as the label of the activation, and the Developer's license endpoint uses it to recognize the same Mac across activations and trials. An activation made by an earlier version of the App keeps the hardware UUID in its label at Polar until that activation is deactivated. These requests do not contain your name, email, payment details, or any file data. The endpoint returns a yes/no and an expiry date.

4.3 Cloud-Storage Operations You Initiate

When you copy to, move to, browse, or sync a remote you have configured (S3, Google Drive, Dropbox, SFTP, SMB, WebDAV, B2, OneDrive, FTP, etc.), the App connects directly to that remote using the credentials you provided. Transfers to rclone remotes go through rclone running on your machine. Direct SFTP and SMB connections go through a copy of rclone bundled with the App, which receives the password for each connection over a private channel on your Mac and does not store it. Direct WebDAV connections are made by the App itself. Either way the connection is between your machine and the remote you chose. The Developer is not in the path and never sees the data, the credentials, or the destination.

4.3a Google Drive

When you connect Google Drive, the App asks Google for permission to see and manage the files in your Drive, so that you can browse, copy, move and rename them from the App. The App uses this access only for the operations you start. Files move only between your Mac and your own Drive; nothing passes through the Developer or is stored by the Developer. Swift Salamander's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.4 Waitlist and Contact Form

If you submit your email to the "Get release updates" or contact form on the Site, the form posts to a small server-side endpoint operated by the Developer. See section 6.

4.5 Purchase

If you click "Buy Pro" on the Site, you are sent to Polar to complete the purchase. See section 5.

5. Payments & Polar

Pro purchases (a one-time licence, plus the optional yearly update renewal) are processed by Polar Software Inc. ("Polar"), acting as Merchant of Record. This means:

• Polar, not the Developer, is the legal seller of record for the transaction. Polar handles billing, tax collection, invoicing, chargebacks, and refunds.
• Your payment details (card number, billing address, name on card, etc.) are collected and processed by Polar and Polar's underlying payment processor. The Developer never sees them, never receives them, and cannot retrieve them.
• Polar shares with the Developer only the information needed to issue and manage your licence: your purchase email address, the product purchased, the licence key, the purchase date, the licence status, and country of residence (for tax compliance).
• Polar's processing of your data is governed by Polar's own privacy policy, available at polar.sh/legal/privacy.

If you request a refund within the 14-day window, or wish to manage an optional update renewal, do so through Polar's customer portal (the link is in the receipt Polar sent you), or contact us and we will forward the request.

6. Waitlist & Contact Email

If you submit your email address through the "Get release updates" or contact dialogs on the Site, the Developer stores the address (and optional name) in a small private database operated by the Developer for the sole purpose of:

• Sending occasional release notes when major Pro features ship.
• Replying to a question or feedback message you sent.

The Developer does not share, sell, or rent waitlist or contact addresses to anyone. There is no newsletter platform, no email-marketing SaaS, and no mailing-list provider in the chain: only the Developer's own server. You can request deletion at any time by emailing salamander@codesurfer.ch; addresses are removed within seven (7) days of the request.

7. Website, Cookies & Logs

The Site sets no cookies by default. The only persistent state stored in your browser is a single localStorage key (ss-theme) that remembers your light / dark theme preference for the Site. It is not transmitted anywhere.

The hosting provider that serves the Site keeps standard webserver access logs (timestamp, IP address, request path, User-Agent, response status) for short-term abuse-prevention and operational purposes. The Developer does not analyse these logs for usage statistics, does not aggregate them, and does not link them to any identity.

The home page links to a video hosted on YouTube. The video is not embedded: nothing from YouTube or any other Google service is loaded by the Site, so no request reaches them and no cookie of theirs is set while you are here. Following that link opens YouTube in a new tab, and from that point YouTube's own terms and cookies apply.

8. Retention

• Waitlist / Contact Email: Kept until you ask us to delete it, or until the project is discontinued.
• Server Access Logs: Up to 30 days, then rotated and deleted.
• Update-Check & Licence-Check Requests: Not stored beyond the brief access log above.
• Polar Billing Records: Retained by Polar according to Polar's policy and applicable tax law (typically several years for invoicing). The Developer keeps the minimum customer record needed to support your licence.

9. Your Rights

If you are in the EU, the UK, Switzerland, or another jurisdiction that grants statutory data-protection rights, you have the right to:

• Ask what personal data the Developer holds about you.
• Ask for it to be corrected if inaccurate.
• Ask for it to be deleted ("right to be forgotten").
• Ask for a copy of it in a portable format.
• Object to a particular use, or withdraw consent at any time.
• Lodge a complaint with your national data-protection authority.

To exercise any of these rights, email salamander@codesurfer.ch. For Polar-held billing data, contact Polar directly using the link in your purchase receipt.

10. Children

The App and the Site are not directed at children under 13 (or under 16 in jurisdictions where that is the applicable threshold). The Developer does not knowingly collect personal data from children. If you believe a child has submitted data, contact the Developer and it will be deleted.

11. Changes to This Policy

The Developer may revise this Privacy Policy from time to time. The current version is always published at swiftsalamander.app/privacy with an effective date. Where a change is material (for example, if a new category of data starts being collected), the App or Site will surface the change before the new practice takes effect.

12. Contact

For privacy questions, deletion requests, or data-rights enquiries: salamander@codesurfer.ch.

Postal contact: Maciej Raciborski, Switzerland. (A specific postal address can be provided on request for formal data-protection correspondence.)

Version history

Version 1.3 · 10 October 2026

• Section 4.3a: how the App uses Google Drive access.