The short version
ShabuBox collects no personal data. There is no account and no sign-up. All document processing happens on your device, and the developer cannot access your documents or your library.
The one thing the app does send is anonymous usage statistics — which features get used and how often, plus your app and macOS version — so we know what to improve. They contain no document content, no file names, no text you typed, and no account or device identifier, and you can turn them off in Settings › General › Privacy.
Stated plainly: we collect no personal data through the app itself. The only personal information we ever hold is what you send us directly — an email when you write to support, and the minimum needed to issue and support your license when you buy.
Data we do not collect
- No accounts — there is no login, profile, or user identifier.
- No third-party analytics, advertising, or crash-reporting SDKs, and no third-party trackers. The usage statistics below go to our own service and nowhere else.
- No advertising identifiers, device serials, or hardware identifiers.
- No document content is ever transmitted off your Mac.
- No IP addresses are stored, and no location is collected or derived.
Anonymous usage statistics
ShabuBox sends anonymous usage statistics to our own analytics service at api.swiftstats.co, operated by Alan Wizemann, LLC. No third party is involved and the data is never sold, shared, or joined with anything else. You can turn this off at any time in Settings › General › Privacy.
The software that does this is swift-stats, an open-source analytics library we wrote and maintain ourselves so we would never have to put someone else’s tracking SDK in the app. It is privacy-first by construction: opt-out with one switch, a random hashed install ID as the only identifier, no advertising or device identifiers, no IP storage, no free text — and the list of things it will never collect is written into its published data contract, which anyone can read and audit. We use what it reports to debug problems and decide what to improve; nothing else.
What is sent
- Which screens and features you use, and how often — chosen from a fixed, published list of event names such as view_shown, files_imported, or search_run.
- A few coded details about each event, all drawn from fixed sets of values: which view, whether a search returned results, whether an action succeeded, and counts rounded into ranges (“2–5”, “20+”) rather than exact numbers.
- Basic environment: app version and build, macOS version, Mac model identifier, processor architecture, language and region, and whether the build is a debug or pre-release one.
- A random install ID, generated on your Mac at first launch and cryptographically hashed before it is sent, so events from one install can be counted as one install.
What is never sent
- Your documents, or anything read out of them.
- File names, folder names, or file paths.
- Note text, search queries, tag names, entity names, addresses, chat messages, or any other text you typed.
- Your name, email address, or license details.
- IP addresses, location, or timezone. Region comes from your Mac’s language and region setting, not from your network.
- Error messages, stack traces, or logs. When something fails, only a coded category is sent — never the underlying message, which could contain a path or a file name.
This is structural, not just a promise: the app can only emit events from a closed, reviewable list, and every value attached to them is a fixed code, a true/false flag, or a bucketed count. There is no code path that can put text you typed into a usage event.
Why
To debug problems and improve the app: to see which features are actually used, which macOS versions and Mac models to support, where an action fails, and where people get stuck — so development effort goes where it helps. Nothing more.
How long it is kept
Raw events are kept for 90 days. After that they are reduced to daily aggregate counts, which contain no per-install rows, and the raw events are deleted.
Turning it off, and deletion
Turn off Share anonymous usage statistics in Settings › General › Privacy. Collection stops immediately and anything queued but not yet sent is discarded.
Because the install ID is anonymous by design, it is not shown anywhere in the app and we have no way to connect it to you, an email address, or a license. That is what makes the data anonymous, and it is also the honest limit on deletion requests: we cannot look you up. If you want your data removed, contact us and turn the toggle off — that stops any further collection, and your existing events age out within 90 days. Reinstalling the app generates a brand-new random ID with no link to the old one.
On-device processing
OCR (Apple Vision), document-type identification, entity extraction (GLiNER2), auto-filing, and document chat (Apple Foundation Models and local MLX models) all run on your Mac inside Apple’s App Sandbox. Your documents are read and understood locally.
Limited network use
ShabuBox uses the network for a small, fixed set of purposes — the four below, plus the anonymous usage statistics described above. None of them transmits your document data:
- One-time model downloads
- If you choose a richer local chat model, it is downloaded once from the HuggingFace CDN. Only the model is downloaded; nothing about your documents is sent.
- Local-network scanner discovery
- To find AirScan / eSCL scanners, ShabuBox looks on your local network. This traffic stays within your network.
- Update checks
- Because ShabuBox is distributed from shabubox.com rather than a store, it checks for new versions itself. It fetches a small appcast file from shabubox.com or GitHub and compares it to the version you have. Like any HTTP request, this reveals your IP address and the app version to the server that serves the file. There is no account, no installation identifier, and no document data in the request. You can turn automatic update checks off in the app’s settings.
- Weekly license revocation check
- Your license is validated offline — the app does not phone home on launch to ask whether you’re allowed to run it. About once a week it downloads a small list of revoked license IDs so that refunded licenses stop unlocking the app, and it keeps working for 30 days offline if it can’t reach the list. The list is the same file for everyone; the app downloads it and checks locally. Nothing about your machine, your license, or your documents is sent.
Optional iCloud sync
iCloud Drive sync is optional and off unless you enable it. When enabled, it uses your own Apple iCloud account under Apple’s terms. The developer has no access to it and cannot read synced data.
Calendars & Reminders
ShabuBox accesses Calendars and Reminders only with your permission, and only to provide the reminders feature (including sync with Apple Reminders). This data is not collected by or transmitted to the developer.
Support correspondence
If you email support, the developer receives your message and email address, and uses them solely to respond to you. Along with the purchase details described below, this is the only personal data the developer ever receives.
Our replies to you are sent through Cloudflare's email service (Cloudflare, Inc.), which we use as a processor to deliver mail on our behalf.
Purchases and licensing
When you buy ShabuBox, the payment is handled by Paddle (Paddle.com Market Ltd) as merchant of record. Paddle is the seller of record: it collects and processes your payment and billing details — card information, billing address, tax data — as its own controller, under its privacy policy. We never see or store your card details.
From that transaction we receive only what we need to issue and support your license:
- Your email address, so we can send you the license and you can reach us.
- The transaction or order ID, so a purchase can be matched to a license.
- Your country, which we keep for tax records.
We store those three things to issue your license, to let you recover it if you lose it, and to handle refunds. We don’t use them for marketing or profiling, and we don’t sell or share them.
License delivery emails are also sent through Cloudflare's email service (Cloudflare, Inc.) as our processor.
Contact
Questions about this policy can be sent to hello@shabubox.com. This policy is offered by Alan Wizemann, LLC, a Delaware limited liability company.