Privacy Policy
What the Phoaly app and website collect, what stays on your Mac, and why.
The short version
- Your photos never leave your Mac. The app does not upload originals, thumbnails, EXIF, GPS coordinates, file paths, face vectors, or library statistics.
- No account is needed to download, trial, buy, or activate Phoaly.
- The website collects little: the email address used at Stripe Checkout, messages you send through the contact form, and aggregate usage statistics.
- The app has no telemetry. It uses the network only to activate or validate a license, and to load optional map tiles.
Who we are
Phoaly makes a local-first photo organizer for macOS. This policy covers the Phoaly app, the website at phoaly.com, and the license service behind activation keys. Write to support@phoaly.com with any question about this policy.
What stays on your Mac
Phoaly reads the folders you choose and writes an index and thumbnails to its own application data. Scanning, browsing, and previewing are read-only: your originals are not copied, moved, or rewritten. The app also stores local settings, cull decisions, and the journal used to undo an organize session.
We never receive your index, thumbnails, EXIF, GPS coordinates, file paths, face vectors, or statistics. Any face vectors the app computes stay on your Mac.
If you rotate or crop a photo, or run an organize plan, the app writes only after you confirm. Deletes go to the system Trash and can be undone.
When the app uses the network
- License activation and validation. To activate, the app sends the license key, a random device identifier, the app version, and a device fingerprint used to bind the activation certificate. The server returns a signed certificate. The app checks the license on startup and periodically after that. No photo, library, or usage data is included.
- Map tiles. The map view requests standard tile coordinates from the tile provider, which can see your IP address. You can turn the map off or stay offline; a bundled offline world map is the fallback.
- Nothing else. There is no telemetry, crash reporting, or advertising SDK in the app.
When you buy a license
Checkout is hosted by Stripe. Stripe collects your email address and payment details; we never receive your card number. We store the email address, the Stripe customer, session, and payment identifiers, the plan, amount, currency, status, and timestamps so we can deliver and support the license.
The activation key is emailed to the address used at checkout. On our side the key is stored only as an HMAC-SHA256 hash and a short prefix for support. To show the key once on the checkout success page, we keep a short-lived encrypted copy that expires within 24 hours.
If you receive a gift license, we store the email address the gift was issued to so the recipient can recover the key.
The license portal
The license portal looks up a key without an account. Your browser sends the key in a POST request, so it is not placed in the URL. The response shows the plan, the seats in use, and the Macs that hold them. Releasing a seat frees it for another Mac.
We store the key hash, a device fingerprint and device name, activation and last-seen times, and a salted hash of the caller's IP address for abuse prevention. A license is never linked to your photos or library.
Contact form
If you use the contact form, we receive the name, email address, and message you submit. We use them only to answer you. The message is delivered to our support inbox through our email provider. We do not add you to a mailing list.
Analytics, cookies, and chat
We use analytics to understand which pages are useful: Google Analytics 4, Microsoft Clarity, Umami, and Plausible. Umami and Plausible are configured for aggregate, cookie-free measurement. Google Analytics and Clarity may set cookies. Clarity also records how visitors interact with pages, including sampled session replays and heatmaps. Password fields are masked, but please avoid entering sensitive information outside the checkout flow.
Where the Crisp chat widget is enabled, it loads with the page and stores a session identifier so a conversation can continue across pages. If you send a message there, Crisp processes its content.
Some of these tools set cookies or use local storage. The Cookie Policy lists them, their purposes, and how to block them. We do not sell personal data, and we do not run advertising on this site.
How long we keep data
- License and purchase records — for as long as the license may need support, and afterwards for as long as tax and accounting law requires.
- Contact messages — until the request is resolved, then up to 12 months.
- License events and IP hashes — up to 12 months.
- Analytics — according to each provider's retention setting.
- Server logs — short-lived, typically no more than 30 days.
Who we share with
We share data only with providers that help us run the product:
- Stripe for checkout and payment processing.
- Cloudflare for hosting, the database, storage, and email delivery.
- Google, Microsoft, and the Umami and Plausible hosts for analytics.
- Crisp for live chat, when it is enabled.
We may also disclose data if the law requires it, or to protect our rights, users, or the service. We do not sell personal data.
Security
We use TLS for all traffic, store activation keys as hashes, store IP addresses only as salted hashes, and limit access to production data. No system is perfectly secure; if you believe your data was compromised, contact us.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to receive a portable copy. Email support@phoaly.com; we may ask for the purchase email or key prefix to find your records. You can also complain to your local data protection authority.
Some records must be kept for legal or accounting reasons, and some rights have exceptions. If we refuse a request, we will explain why.
International transfers
Our providers may process data in the United States, the European Union, or other countries. Where required, they rely on contractual safeguards for international transfers.
Children
Phoaly is not directed at children. We do not knowingly collect personal data from children under 13, or under 16 where local law sets that age. If you believe a child sent us personal data, contact us and we will delete it.
Changes
We will update this page when our practices change and revise the date at the top. If a change materially affects you, we will also announce it on the site.
Contact
Questions, requests, or complaints: support@phoaly.com, or the contact page.