Privacy Policy

Effective date: 2026-05-13 · Last updated: 2026-05-13

This Privacy Policy explains what personal information MacTransfer ("MacTransfer", "we", "our", "us") collects, why, how long we keep it, who we share it with, and what rights you have. We've kept it specific because there's not much to say — MacTransfer is a peer-to-peer file transfer tool that does not route your files or activity through any server we operate.

This policy covers both the MacTransfer desktop application for macOS and the MacTransfer Companion mobile application for Android, as well as the website at mactransfer.app.

1. Plain-language summary

If you only read one section, read this one:

• We do not collect your files, file metadata, browsing within the app, analytics, telemetry, crash reports, device fingerprints, advertising IDs, or location.
• If you buy a Pro license, our payment provider (LemonSqueezy) collects your email and billing details so they can process the payment and send you the key. We can see your email and license status in their dashboard.
• If you email us for support, we keep the email until the issue is resolved, then archive or delete it.
• Your files transfer directly between your devices over your local Wi-Fi network or USB cable. They never touch any server we operate, because we don't operate any.
• We don't sell or share your data with anyone for advertising or any other purpose.

2. What we do not collect

• The contents of any file you transfer. Files move directly between your Mac and your phone over your local Wi-Fi network or USB cable.
• Filenames, file sizes, file types, modification dates, or any other metadata about your transfers.
• Browsing history within the app — which folders you opened, which files you viewed, which devices you paired with.
• Any analytics, telemetry, crash reports, performance metrics, or usage data.
• Your device's serial number, hardware specs, MAC address, IMEI, advertising ID, or other device fingerprint.
• Cookies, tracking pixels, or third-party advertising identifiers.
• Geolocation data of any kind.
• Contacts, calendars, photos, SMS, call logs, or any data unrelated to the file you choose to transfer.
• Audio or video from your camera or microphone (the camera is used briefly to scan a QR code; the image is processed locally and not stored or transmitted).

3. What we do collect, and why

3.1 Purchase information (only if you buy Pro)

If you purchase a Pro Annual or Pro Lifetime license, our payment processor LemonSqueezy (acting as Merchant of Record) collects on our behalf:

• Your email address — so we can send you the license key and receipts.
• Billing details required by your card issuer — handled directly between you and LemonSqueezy / Stripe. We never see your card number, expiry, or CVC.
• Country of purchase — for sales tax / VAT / GST compliance.
• Optional name if you provided it at checkout.

LemonSqueezy's own privacy policy applies to this data: lemonsqueezy.com/privacy. We can view your email, country, and license activation status in the LemonSqueezy dashboard for the purpose of providing support, processing refunds, and confirming purchases.

3.2 License validation requests

When you activate or periodically revalidate a Pro license (approximately every 7 days), the MacTransfer Mac app sends the following to LemonSqueezy's licensing API at api.lemonsqueezy.com:

• Your license key
• An "instance name" — by default the friendly name of your Mac (e.g. "Stuart's MacBook Pro"), used to identify which device is using the seat
• Your IP address (visible to LemonSqueezy as part of normal HTTP request handling)

LemonSqueezy returns whether the key is valid. We do not see this request directly — it goes from your Mac to LemonSqueezy.

3.3 Support correspondence

If you email [email protected], the email you send (your address, your message, any attachments you include) is delivered to our mailbox. We use this only to respond to your enquiry and provide support.

3.4 Server logs (website)

Like virtually all websites, our web server records standard access logs when you visit mactransfer.app. These contain your IP address, the URL you requested, the date/time, your browser's user-agent string, and the HTTP status code. Logs are used solely for security (detecting attacks) and basic operational diagnostics. We do not use them for analytics or to build user profiles. Logs are automatically rotated and deleted within 30 days.

4. Android & macOS permissions

Both apps request the minimum permissions needed to function. Each permission is explained below.

Android (MacTransfer Companion)

macOS (MacTransfer)

5. Data stored locally on your devices

The following items are stored entirely on your Mac or your phone — they never leave your device and are never transmitted to us:

• License key — stored in your Mac's Keychain (encrypted at rest by macOS).
• Paired phone metadata — device name, IP address, port, last-connected timestamp. Stored in macOS UserDefaults; auth tokens stored separately in Keychain.
• Daily transfer counters (free tier only) — number of transfers and bytes transferred today, reset at midnight local time. Stored in macOS UserDefaults.
• Companion session tokens — short-lived auth tokens are stored in the Companion app's private SharedPreferences (sandboxed to the app's UID).
• App preferences — your interface settings, language, last-opened folders.

You can delete everything by uninstalling the app(s). Keychain entries created by MacTransfer are removed automatically when the macOS app is uninstalled.

6. Third parties we rely on

The only third parties that may receive data linked to you are:

We do not use Google Analytics, Facebook Pixel, advertising networks, A/B testing services, error tracking services (Sentry, Bugsnag, Crashlytics), or any other analytics / tracking SDKs.

7. Network behaviour of the apps

The MacTransfer Mac app makes network requests in only these situations:

• To LemonSqueezy (api.lemonsqueezy.com) when activating, validating, or deactivating a Pro license.
• To your paired phone on your local Wi-Fi network, when transferring files or browsing folders. These requests stay on your local network.
• To download updates only if you click a download link in the app's About window — no automatic update downloads.

The MacTransfer Companion app on your phone makes network requests in only these situations:

• UDP broadcasts on your local network so paired Macs can discover the phone's IP and port. The broadcast contains the phone manufacturer/model name, IP, port, and pairing-session client ID.
• HTTP requests received from your paired Mac (the phone is acting as a server, not a client). These never leave your local network.

Neither app contacts any of our own servers — we don't operate any application servers.

8. Legal basis for processing (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the legal bases under Article 6 of the GDPR for our limited processing are:

• Performance of a contract (Art. 6(1)(b)) — processing your email, billing details, and license activation data is necessary to deliver the Pro license you purchased.
• Legitimate interests (Art. 6(1)(f)) — keeping minimal server access logs for security purposes; replying to support emails you initiate.
• Legal obligation (Art. 6(1)(c)) — retaining purchase records for tax purposes (handled by LemonSqueezy as Merchant of Record).

We do not rely on consent for processing personal data, because we do not collect any personal data that isn't strictly necessary for the service. We do not engage in profiling or automated decision-making.

9. How long we keep data

10. Your rights

Subject to your jurisdiction's law, you have the following rights regarding personal data we (or LemonSqueezy on our behalf) hold about you:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — ask us to delete your data, subject to legal retention obligations.
• Restriction — ask us to limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent (note: we don't currently rely on consent for any required processing).
• Lodge a complaint — with your local data protection supervisory authority (see jurisdictional sections below).

To exercise any of these rights, email [email protected] from the address associated with your purchase. We respond within 30 days. For purchase data held by LemonSqueezy, you can also exercise these rights directly via their privacy contact.

11. International data transfers

LemonSqueezy is a US-based company. If you purchase from outside the US, your purchase information is transferred to and stored in the United States. LemonSqueezy relies on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable for transfers from the EEA / UK. Our hosting provider for the website and support mailbox may be located outside your country; the same legal mechanisms apply.

12. Security

We take reasonable steps to protect data we hold:

• Local data on your devices is stored in OS-provided secure storage (macOS Keychain, Android private SharedPreferences) where applicable.
• License validation calls to LemonSqueezy use HTTPS (TLS) end-to-end.
• The website is served over HTTPS only.
• Our support mailbox is protected by industry-standard mailbox authentication (SPF, DKIM, DMARC).
• Access to our LemonSqueezy dashboard is protected by a strong password and two-factor authentication.

No transmission or storage system is perfectly secure. If a data breach affects personal data we control, we will notify affected users without undue delay and notify the relevant supervisory authority where required by law.

13. Children

MacTransfer is not directed at children under 13 (or under 16 in jurisdictions where that is the digital-consent age). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

14. California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, and disclose.
• Right to delete personal information we have collected (subject to exceptions).
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of your personal information. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.
• Right to limit use of sensitive personal information. We do not collect sensitive personal information as defined by the CPRA.
• Right to non-discrimination for exercising your rights.

To exercise any California rights, email [email protected].

15. Australian residents

If you are in Australia, this policy complies with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). You may complain about how we handle your personal information by emailing [email protected]. If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

16. Changes to this policy

If we change this policy, we will update the "Last updated" date at the top of this page. For material changes — for example, if we ever start collecting a new category of data — we will additionally announce the change on our website and, where we have your email (i.e. you are a Pro customer), by email at least 30 days before the change takes effect.

17. Contact

For privacy questions, requests, or complaints, contact us:

• Email: [email protected]
• Web: mactransfer.app/support

We are the data controller for personal data described in this policy. Our payment processor LemonSqueezy is the data controller for purchase information described in section 3.1.