Privacy Policy

Effective as of October 23, 2026.

Macotron has no accounts, no analytics, and no telemetry. Almost everything it does happens on your Mac. This page lists the few things that do leave it.

Ian Langworth, an individual (“I,” “me,” or “my”), makes Macotron, a free, open-source macOS app that runs JavaScript plugins. This Privacy Policy describes how I process personal information in connection with the Macotron app and the website at macotron.statico.io (together, the “Service”). The Terms of Use also apply.

State privacy rights notice: see the State privacy rights notice section below for information about your rights under applicable U.S. state privacy laws.

Summary

• I do not sell or share your personal information, and I do not use it for advertising.
• The app has no account, no sign-in, no analytics, no crash reporting, and no usage tracking.
• The website sets no cookies and loads no analytics, ads, fonts, or scripts from other companies.
• The app contacts my website to check for updates and to fetch a list of blocked plugins. Those requests carry your IP address and the app version, like any web request, and nothing else about you.
• Plugins you turn on can contact other services, such as a weather service or an AI provider. Those services have their own privacy policies.

Personal information I collect

The website

The website is a set of static pages hosted by Vercel. When you visit, Vercel receives the data that every web request carries: your IP address, browser and operating system (the user agent), the page you asked for, the referring page, and the time. Vercel may keep this in its server logs to deliver the site and protect it from abuse, and I can view those logs. I do not add analytics, tracking pixels, or advertising to the site.

Downloads of the app come from GitHub Releases. GitHub receives the same kind of request data when you download.

The app

The app sends these requests on its own, with no plugin involved:

• Update checks. Macotron uses the Sparkle framework to check https://macotron.statico.io/appcast.xml for new versions, once a day by default. The request carries your IP address and a user agent that names the app, its version, and the Sparkle version. Sparkle’s optional system profile is turned off, so no information about your Mac’s hardware is sent. When you choose to install an update, the app downloads it from GitHub Releases. You can change how often it checks, or turn checks off, in Settings → General → Updates.
• The plugin blocklist. At launch, the app downloads https://macotron.statico.io/blocked.json, a list of SHA-256 hashes of known-bad plugin code. The request carries your IP address and the user agent Macotron. The app compares the list with your plugins on your Mac. It never sends your plugins or their hashes anywhere.
• Community plugins. When you open the community plugin list in Settings → Plugins, the app searches GitHub (api.github.com) for repositories with the macotron-plugin topic, and caches the result for an hour. When you install or update a community plugin, it downloads the file from raw.githubusercontent.com. GitHub receives your IP address. These requests go to GitHub, not to me.

The built-in plugin catalog ships inside the app. Browsing it sends no requests.

When you contact me

If you open an issue, a discussion, or a pull request on GitHub, or report a vulnerability, I receive what you write and your GitHub username. Issues and pull requests are public. Do not post personal information in them that you do not want to be public.

What stays on your Mac

These stay on your Mac. I never receive them:

• Settings. Plugin settings are in settings.json in your workdir, and app settings are in the app’s macOS preferences.
• API keys and passwords. Password fields in plugin settings, and macotron.keychain, store secrets in your macOS Keychain. settings.json holds only a reference to the Keychain item.
• Plugin approvals. The ledger of approved plugin hashes is in the Keychain.
• Clipboard history. When the Clipboard History plugin is on, history is kept in memory only, and is gone when Macotron quits.
• The file index. File Search uses an index of file and folder names that Macotron keeps in memory.
• Plugin data. Plugin localStorage is a JSON file in your workdir. The chats that AI Chat Window saves are stored there.
• Logs. Macotron writes to the macOS unified log on your Mac.
• Personal data you give plugins access to. Calendars, contacts, reminders, the screen, and other data that macOS permissions protect are read on your Mac by the plugins you turn on.
• Plugin review. The scan that reviews plugin code before you approve it uses Apple’s on-device model and static checks. The code does not leave your Mac.

What plugins send to other services

A plugin runs with Macotron’s access, including the network. When a plugin contacts another service, your Mac connects to that service directly. The data does not pass through me, and I cannot see it. That service’s own privacy policy and terms apply.

AI providers

macotron.ai lets plugins use AI models:

• Apple Intelligence (on-device). Runs on your Mac with Apple’s Foundation Models framework. Prompts do not leave your Mac.
• Claude (Anthropic), OpenAI, and Gemini (Google). The plugin sends your prompt, and any text or images it includes, from your Mac to api.anthropic.com, api.openai.com, or generativelanguage.googleapis.com, with your own API key. Your agreement with that provider governs the data.

The built-in AI Chat Window plugin uses the on-device model by default, and Claude or Gemini if you pick them and enter a key. The Screen Summary example sends the part of the screen you select to Claude. Translate Selected Text uses the on-device model only.

Built-in plugins

These built-in plugins make requests to other services when you turn them on:

• Weather requests the forecast from wttr.in. It sends the location you enter. If you leave the location blank, wttr.in estimates your location from your IP address.
• Radio searches stations at radio-browser.info, and tells it the ID of a station when you play it. It searches podcasts on itunes.apple.com, and loads the stations and podcast feeds you pick from their own servers.
• Now playing artwork. When a plugin such as Now Playing asks for the current track and the player supplies no cover art, Macotron searches itunes.apple.com with the artist, title, and album to find it.
• Park Webcam loads a webcam image from nps.gov.
• Security Checklist loads the update feed that each of your installed apps names, to compare versions. This tells those developers’ servers that a copy of their app checked for updates.
• Web Search and Browser Picker open links in your web browser. Your browser, and the sites it opens, handle those requests.

Plugins that control devices on your local network, such as an Apple TV, talk to those devices directly.

Your own plugins and community plugins

Plugins you write or install from other people can send any data they can read to any server. I do not review community plugins. Read a plugin before you approve it, and check the privacy policy of each service it uses.

Cookies and tracking technologies

The website sets no cookies and uses no tracking pixels, analytics, or advertising technology. It saves your color scheme choice (System, Light, or Dark) in your browser’s local storage. That value stays in your browser and is not sent to me.

Do Not Track and Global Privacy Control. There is no tracking to turn off, so these signals change nothing.

How I use personal information

I use the limited information described above to:

• deliver the website, app updates, and the blocklist;
• keep the Service secure, and find and stop abuse;
• respond to issues, questions, and vulnerability reports; and
• comply with the law, and protect my rights and the rights and safety of others.

I do not use personal information for marketing, advertising, or profiling, and I do not use it to train AI models.

How I share personal information

• Service providers. Vercel hosts the website, update feed, and blocklist. GitHub hosts the source code, downloads, issues, and community plugin search. They process request data to provide those services.
• Authorities and others. I may disclose information to law enforcement, government authorities, or private parties when I believe in good faith that the law requires it, or to protect my rights or the safety of others.
• Successors. If I transfer the project to someone else, the information that the project holds can go with it.

I do not sell personal information, and I do not share it for targeted advertising.

Retention

I do not keep a database of users. Request logs are kept by Vercel and GitHub under their own retention policies. Issues and pull requests stay on GitHub until they are deleted there.

Your choices

• Update checks. Set Settings → General → Updates to Never to stop automatic checks. Check for Updates… still works when you choose it.
• Plugins. Turn off or delete any plugin in Settings → Plugins to stop its requests.
• API keys. Clear a key in the plugin’s settings to remove it from the Keychain.
• Website. Clear your browser’s site data to remove the saved color scheme.

Other sites and services

The Service links to, and plugins connect to, websites and services that other people operate, including GitHub, Vercel, Apple, Anthropic, OpenAI, Google, wttr.in, radio-browser.info, and the National Park Service. I do not control them, and I am not responsible for their privacy practices. Read their privacy policies.

Security

Updates are signed, and the app installs only an update whose signature matches the key in the copy you already have. Secrets are kept in the macOS Keychain. No security measure is perfect, and I cannot guarantee the security of any information. See the Security Policy to report a vulnerability.

International data transfer

I am in the United States, and Vercel and GitHub may process request data in the United States and other countries. Privacy laws there may not be as protective as the laws where you live.

Children

The Service is not intended for anyone under 18 years of age. I do not knowingly collect personal information from children. If you believe that a child gave me personal information, contact me and I will delete it.

Changes to this Privacy Policy

I may change this Privacy Policy. When I do, I will update the date at the top of this page. The history of this page is public in the GitHub repository. Changes take effect when they are posted. If you use the Service after a change takes effect, the changed policy applies to you.

How to contact me

If you have questions about this policy, or want to exercise a privacy right:

• Open an issue at github.com/statico/macotron/issues. Issues are public, so do not include personal information in them.
• For a private request, write to Ian Langworth, 495 Jackson Street #1200, Oakland, CA 94607.

State privacy rights notice

This section applies to residents of U.S. states whose privacy laws apply to me and grant the rights below (the “State Privacy Laws”). Not every state grants every right, and the rights are not absolute.

Your rights. Depending on where you live, you can ask me to:

• tell you the categories of personal information I collect, where it comes from, why I collect it, and who receives it;
• give you a copy of the personal information I have about you;
• correct inaccurate personal information;
• delete personal information I have about you; and
• reconsider a decision I made about your request (an appeal).

To make a request, use the contact details above. Because I do not keep user accounts, I may ask you for details, such as the time of a request or a GitHub username, to find the information. I will not discriminate against you for exercising these rights.

What I collect, and from whom. In the past 12 months I have collected identifiers and internet activity information (IP address, user agent, pages and files requested, and time), through the website, update checks, and blocklist downloads; and anything you choose to send me through GitHub. I disclose these to my service providers, Vercel and GitHub, for the purposes in this policy.

Sale, sharing, and targeted advertising. I do not sell personal information, share it for cross-context behavioral advertising, or process it for targeted advertising. I do not knowingly sell or share the personal information of consumers under 16 years of age.

Profiling. I do not use personal information for profiling or automated decisions that have legal or similarly significant effects.

Sensitive personal information. I do not intentionally collect or process sensitive personal information.

Deidentified information. I do not attempt to reidentify deidentified information.

California Shine the Light. I do not disclose personal information to third parties for their direct marketing purposes.

Nevada. I do not sell personal information as defined by Nevada law.

Adapted from General Legal’s Privacy Policy (U.S. Only) template. This template was prepared and made publicly available by General Legal, PC (“General Legal”). It is provided for general reference purposes only and does not constitute, and should not be construed as, legal advice, or an endorsement or review of any particular transaction in which it is used. Use of this template does not create an attorney-client relationship with General Legal. General Legal has not reviewed, and takes no position on, any modifications made to this document or the deal terms it is used to document.