Privacy Policy

The short version

ShabuBox collects no personal data. There is no account and no sign-up. All document processing happens on your device, and the developer cannot access your documents or your library.

The one thing the app does send is anonymous usage statistics — which features get used and how often, plus your app and macOS version — so we know what to improve. They contain no document content, no file names, no text you typed, and no account or device identifier, and you can turn them off in Settings › General › Privacy.

Stated plainly: we collect no personal data through the app itself. The only personal information we ever hold is what you send us directly — an email when you write to support or use the contact form, the minimum needed to issue and support your license when you buy, and, for about 7 days, an address you enter to recover a lost license.

Data we do not collect

• No accounts — there is no login, profile, or user identifier.
• No third-party analytics, advertising, or crash-reporting SDKs, and no third-party trackers. The usage statistics below go to our own service and nowhere else.
• No advertising identifiers, device serials, or hardware identifiers.
• No document content is ever transmitted off your Mac.
• No IP addresses are stored, and no location is collected or derived.

Anonymous usage statistics

ShabuBox sends anonymous usage statistics to our own analytics service at api.swiftstats.co, operated by Alan Wizemann, LLC. No third party is involved and the data is never sold, shared, or joined with anything else. You can turn this off at any time in Settings › General › Privacy.

The software that does this is swift-stats, an open-source analytics library we wrote and maintain ourselves so we would never have to put someone else’s tracking SDK in the app. It is privacy-first by construction: opt-out with one switch, a random hashed install ID as the only identifier, no advertising or device identifiers, no IP storage, no free text — and the list of things it will never collect is written into its published data contract, which anyone can read and audit. We use what it reports to debug problems and decide what to improve; nothing else.

What is sent

• Which screens and features you use, and how often — chosen from a fixed, published list of event names such as view_shown, files_imported, or search_run.
• A few coded details about each event, all drawn from fixed sets of values: which view, whether a search returned results, whether an action succeeded, and counts rounded into ranges (“2–5”, “20+”) rather than exact numbers.
• How well on-device features worked, as the same kind of coded values: whether a chat answer found a source in your documents, a rough response-time range (such as “2–10 seconds”), and whether a filing suggestion was taken. Never the question, the answer, or the folder.
• Basic environment: app version and build, macOS version, Mac model identifier, processor architecture, language and region, and whether the build is a debug or pre-release one.
• A random install ID, generated on your Mac at first launch and cryptographically hashed before it is sent, so events from one install can be counted as one install.

What is never sent

• Your documents, or anything read out of them.
• File names, folder names, or file paths.
• Note text, search queries, tag names, entity names, addresses, chat messages, or any other text you typed.
• Your name, email address, or license details.
• IP addresses, location, or timezone. Region comes from your Mac’s language and region setting, not from your network.
• Error messages, stack traces, or logs. When something fails, only a coded category is sent — never the underlying message, which could contain a path or a file name.

This is structural, not just a promise: the app can only emit events from a closed, reviewable list, and every value attached to them is a fixed code, a true/false flag, or a bucketed count. There is no code path that can put text you typed into a usage event.

Why

To debug problems and improve the app: to see which features are actually used, which macOS versions and Mac models to support, where an action fails, and where people get stuck — so development effort goes where it helps. Nothing more.

How long it is kept

Raw events are kept for 90 days. After that they are reduced to daily aggregate counts, which contain no per-install rows, and the raw events are deleted.

Turning it off, and deletion

Turn off Share anonymous usage statistics in Settings › General › Privacy. Collection stops immediately and anything queued but not yet sent is discarded.

Because the install ID is anonymous by design, it is not shown anywhere in the app and we have no way to connect it to you, an email address, or a license. That is what makes the data anonymous, and it is also the honest limit on deletion requests: we cannot look you up. If you want your data removed, contact us and turn the toggle off — that stops any further collection, and your existing events age out within 90 days. Reinstalling the app generates a brand-new random ID with no link to the old one.

On-device processing

OCR (Apple Vision), document-type identification, entity extraction (GLiNER2), auto-filing, and document chat (Apple Foundation Models and local MLX models) all run on your Mac inside Apple’s App Sandbox. Your documents are read and understood locally.

Limited network use

ShabuBox uses the network for a small, fixed set of purposes — the four below, plus the anonymous usage statistics described above. None of them transmits your document data:

One-time model downloads

If you choose a richer local chat model, it is downloaded once from the HuggingFace CDN. Only the model is downloaded; nothing about your documents is sent.

Local-network scanner discovery

To find AirScan / eSCL scanners, ShabuBox looks on your local network. This traffic stays within your network.

Update checks

Because ShabuBox is distributed from shabubox.com rather than a store, it checks for new versions itself. It fetches a small appcast file from shabubox.com or GitHub and compares it to the version you have. Like any HTTP request, this reveals your IP address and the app version to the server that serves the file. There is no account, no installation identifier, and no document data in the request. You can turn automatic update checks off in the app’s settings.

Weekly license revocation check

Your license is validated offline — the app does not phone home on launch to ask whether you’re allowed to run it. About once a week it downloads a small list of revoked license IDs so that refunded licenses stop unlocking the app, and it keeps working for 30 days offline if it can’t reach the list. The list is the same file for everyone; the app downloads it and checks locally. Nothing about your machine, your license, or your documents is sent.

Optional iCloud sync

iCloud Drive sync is optional and off unless you enable it. When enabled, it uses your own Apple iCloud account under Apple’s terms. The developer has no access to it and cannot read synced data.

Calendars & Reminders

ShabuBox accesses Calendars and Reminders only with your permission, and only to provide the reminders feature (including sync with Apple Reminders). This data is not collected by or transmitted to the developer.

Support correspondence

If you email support, the developer receives your message and email address, and uses them solely to respond to you. The contact form on our support page sends your name, email address, macOS version, topic, and message; it is delivered to our support inbox through Cloudflare's email service, and its delivery is logged as described under Purchases and licensing. Along with the purchase and license-recovery details described below, this is the only personal data the developer ever receives.

Our replies to you are sent through Cloudflare's email service (Cloudflare, Inc.), which we use as a processor to deliver mail on our behalf.

Purchases and licensing

When you buy ShabuBox, the payment is handled by Paddle (Paddle.com Market Ltd) as merchant of record. Paddle is the seller of record: it collects and processes your payment and billing details — card information, billing address, tax data — as its own controller, under its privacy policy. We never see or store your card details.

From that transaction we receive and keep only what we need to issue and support your license:

• Your email address, so we can send you the license and you can reach us.
• Your name, if you gave one at checkout, which appears on your license.
• The Paddle transaction ID, so a purchase can be matched to a license.
• The purchase amount and currency, so a partial refund can be told apart from a full one.
• Your license ID and its status (active or refunded), so a refunded license can be revoked.
• Records of any refund or chargeback on the purchase — the amounts, dates, and status — which decide whether the license stays valid.
• A delivery log of the license and recovery emails we send you, and of support messages sent through our contact form — the recipient, the subject (for a support message, that includes your name if you gave one), and whether it went out — so we can tell when a message was lost.

Payment card details are never stored by us — not the card number, not the last four digits, not the cardholder name. Paddle keeps those, along with your billing address and tax details; as merchant of record it also handles sales tax and VAT, so we keep no tax records of our own.

How long we keep it: your license records — email, name, transaction ID, amount, license ID and status, and any refund or chargeback records — are kept for as long as the license exists, so you can recover it and so a refunded license can be revoked. Paddle also notifies us of each purchase and refund; we keep a stripped-down record of each notification (IDs, amounts, dates, and status) only to avoid processing it twice, and it is deleted after about 90 days, during routine processing. Refund records that turn out not to belong to a ShabuBox purchase are deleted after 30 days. The email delivery log is kept as a record of what was sent and is not currently deleted on a schedule; ask us if you want your entries removed.

If you use the license recovery page, the email address you enter is kept for about 7 days so we can limit how often a recovery email can be requested for it, then deleted during routine processing. It is stored whether or not it matches a license, and is used for nothing else.

We use this information only to issue your license, to let you recover it if you lose it, and to handle refunds. We don’t use it for marketing or profiling, and we don’t sell or share it.

License delivery emails are also sent through Cloudflare's email service (Cloudflare, Inc.) as our processor.

Contact

Questions about this policy can be sent to hello@shabubox.com. This policy is offered by Alan Wizemann, LLC, a Delaware limited liability company.