Privacy

Privacy policy

Last updated September 3, 2026

Draft — have this reviewed before launch. It accurately describes how the app and site are designed to work, but it is not legal advice and has not been checked against GDPR, UK GDPR, CCPA or the DPDP Act by a lawyer.

The short version

DevCruft has no accounts, no sign-in and no analytics enabled by default. Scanning your disk happens entirely on your Mac. No file name, path or size ever leaves your machine.

What the app does

The scan reads file metadata locally to build the map. Results stay in memory and in a local cache on your own disk. There is no server involved and no network request made as part of scanning.

The app contacts the network for exactly two purposes:

• Update checks. A request to our update feed containing the app version and your macOS version. No identifier is attached, and you can disable update checks in settings.
• Licence activation. Only if you buy Pro, and only once. See below.

What we hold if you buy

Our payment provider processes the transaction. We never see or store your card details. From the purchase we retain your email address, the licence key issued to you, and the date and amount — because we need them to re-send a lost key, honour a refund, and keep tax records.

Your licence is a signed file verified on your Mac. There is no activation server checking in on launch, so we have no record of when or how often you use the app.

This website

The site is static and sets no cookies. We use privacy-preserving analytics that record page views without cookies, without cross-site tracking and without storing IP addresses. If you email us, we keep the email so we can reply.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email hello@devcruft.com and we will act within 30 days. Deleting your record does not deactivate your licence — it keeps working, because it never depended on us.

Retention

Purchase records are kept for as long as tax law requires. Support email is kept for two years. Analytics are aggregate and retain nothing that identifies you.

Changes

If this policy changes materially, the date at the top changes and we will say so on the blog. Questions: hello@devcruft.com.