Privacy Policy
vaho is built so that what happens on your Mac stays on your Mac. This page lists every case where something does leave it — from the app or from this website — what it is, why, and who handles it.
Last updated: 17 September 2026
The short version
- No accounts, no advertising, no tracking cookies, no selling or sharing of data for marketing.
- Your notifications, clipboard, calendar, reminders, files and what you listen to are processed on your Mac and never sent anywhere.
- We count downloads and active installs anonymously: your IP address is never stored, and the daily counting key is deleted every night.
- A few features need an outside service: weather (Open-Meteo), the Pro license (Polar), the store and updates (GitHub, Cloudflare). They get only what the feature needs.
Who is responsible
The data controller for the vaho app and tryvaho.com (including the download links to bruma, vidrio and sider), and the owner of this website for the purposes of Spanish Law 34/2002 (LSSI), is:
- Owner
- Jorge Martínez, based in Spain
- Tax ID (NIF)
- 49696914D
- Address
- Calle Sierra de Santa Ana 19, 30163 Murcia, Spain
- Contact
- notchvaho@gmail.com
Write to that address for any question about this policy or to exercise your rights.
The app
What never leaves your Mac
Notifications, clipboard history, calendar events, reminders, the files shelf, now-playing information, lock-screen content, themes, launcher entries and all your settings are read and stored locally. macOS asks for your permission before vaho can access calendars, reminders, location, notifications or Accessibility, and you can revoke it at any time in System Settings.
Update checks
Once a day (and when you choose Check for Updates…) the app downloads the list of available versions. That request goes through our statistics service on Cloudflare, which sees your IP address, the app version and the approximate country, and counts one active install for the day without storing the IP (details). Updates themselves are downloaded from GitHub. You can turn automatic checks off in Settings → Software Update.
Weather
Only if you open the weather mode and allow location access, your Mac's approximate coordinates, rounded to about 1 km, are sent to Open-Meteo to get the forecast, and to Apple's geocoding service to show the city name. Results are cached on your Mac for 15 minutes. Nothing is sent if you don't use the weather mode or deny location access.
vaho Pro license
Purchases are handled by Polar, who acts as the merchant of record: they collect your email and payment details, send the license key and handle invoices and refunds. We receive the order and your email address from Polar, but never your card details.
When you activate a key, the app sends Polar the key and your Mac's model identifier (for example, “Mac14,2”) as the activation label, so you can tell devices apart — never your computer's name. It then re-validates the key periodically. The key, the activation id and the email Polar associates with it are stored on your Mac. The free-trial start date is kept in your Mac's Keychain and never sent.
Store: themes and community modes
- Browsing loads the public catalog and bundles from GitHub Pages, which sees your IP address like any website.
- Downloading an item reports only its id to our statistics service, once per Mac, to show download counts. No identifier of you or your Mac is sent.
- Publishing uploads the bundle and the name, author name and description you enter. They are published in a public GitHub repository for anyone to see. Use a nickname if you prefer; you can withdraw the item from the same Mac.
- Reporting an item creates a public GitHub issue with the item and the reason you write. Don't include personal information in it.
Community modes and album artwork
Community modes are made by third parties. A mode can only reach the internet hosts it declares, and vaho shows its permissions before you install it, but what that mode's own servers do with a request is up to their author. Album artwork for what's playing is loaded from the music service's own servers (for example, Spotify).
Support
If you email us or write in the Discord, we use what you send only to answer you. Discord is a separate service with its own privacy policy.
The website
- No cookies and no analytics scripts. The only thing stored in your browser is your language choice (EN/ES), in local storage, which never leaves your device.
- Hosting. Like any web server, our hosting provider (Namecheap) records technical access logs — IP address, browser, page requested, date — for security and operation.
- Download buttons go through our statistics service, which counts the download (which app, which button, the referring website's domain and approximate country) and sends you on to the file on GitHub. Your IP address is not stored (details).
- Third-party content. The page loads the public store catalog from GitHub Pages, which sees your IP address when your browser requests it. Nothing else on the page comes from anywhere else: the fonts, images, video and the LaunchNest and LaunchKiwi badges are all served from our own hosting, so no other company is contacted when you open the page.
- Buying Pro takes you to Polar's checkout. The thank-you page reads the order reference from its own address to show it to you; it isn't sent anywhere.
How the anonymous statistics work
We want to know how many people download and use the apps, without knowing who they are. For each download or update check, our service on Cloudflare computes a one-way key from the day, the IP address and the browser or app identifier, using a secret. That key is used only to count the same Mac once per day. Alongside it we keep the app, the version, the button or referring domain, and the country Cloudflare derives from the connection — never the IP address itself.
Every night the previous day's keys are turned into plain totals (for example, "12 downloads from Spain via the pricing button") and deleted. Because the key changes every day, the same Mac can't be followed from one day to the next. We also save daily snapshots of GitHub's public download counters.
Legal bases
- Performance of a contract (art. 6.1.b GDPR): validating your Pro license, delivering updates, publishing what you upload to the store, answering support requests.
- Legitimate interest (art. 6.1.f GDPR): anonymous download and usage statistics, server logs, security and abuse prevention (for example, handling reports). These are designed to have minimal impact and you can object at any time.
- Your consent, given through macOS permission prompts: location for weather, and access to calendars, reminders, notifications and Accessibility. You can withdraw it in System Settings.
Service providers and transfers
These providers process data on our behalf or provide a service the feature relies on:
| Provider | What for | Privacy policy |
|---|---|---|
| Cloudflare, Inc. | Statistics service, update feed, store uploads | cloudflare.com |
| GitHub, Inc. | App downloads and updates, store catalog and uploads, reports | github.com |
| Polar Software, Inc. | Purchases, invoices, license keys | polar.sh |
| Namecheap, Inc. | Website hosting | namecheap.com |
| Open-Meteo | Weather forecast | open-meteo.com |
| Apple Inc. | City name for the weather location | apple.com |
Some of these companies are based in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
How long data is kept
- Daily counting keys: deleted the following night. The anonymous totals are kept indefinitely.
- Store items you publish: until you or the maintainers remove them. Reports stay in the public issue history.
- Purchase and license data: as long as the license exists, plus whatever tax law requires Polar to keep.
- Hosting logs: according to the hosting provider's standard retention.
- Support emails: as long as needed to help you, then deleted.
- Everything stored on your Mac: until you delete it or uninstall the app.
Your rights
You can ask for access to, correction or deletion of your data, restrict or object to its processing, and request portability, by writing to notchvaho@gmail.com. We'll answer within one month. Keep in mind that anonymous statistics can't be linked back to you, so there's nothing in them we could find or delete. For purchase data you can also contact Polar directly.
If you think your data hasn't been handled properly, you can file a complaint with the Spanish Data Protection Agency (AEPD) or the authority in your country.
Children and changes
The apps and this website are not directed at children under 14, and we don't knowingly process their data.
If this policy changes, we'll update this page and its date. Important changes will also be announced in the app's release notes.