Privacy policy

This Privacy Policy explains what information NotchPop processes locally, what optional online integrations and licensing requests send to their services, and the choices you have when using the website, downloading NotchPop for Mac, purchasing a license, or using optional integrations.

Account and licensing details: Email address and authentication session data when activating a license or managing subscriptions through our verified payment processors (Polar, Stripe, or Dodo Payments).

Local application data: Preferences, quick notes, reminders, timer state, screen-time samples, pinned clipboard items, and drop-shelf references are stored exclusively on your Mac in local application storage. NotchPop does not maintain an advertising or user-tracking database.

Technical metadata: Non-identifying version numbers and OS platform architecture details when checking notchpop.com for software updates.

Trial and license checks: To run the free trial and verify licenses, NotchPop contacts api.notchpop.com about once a day. It sends a salted SHA-256 hash of your Mac's hardware identifier (never the identifier itself), the NotchPop version and the macOS version. We store that hash with when the trial started and when the Mac last checked in, which lets us count installs, active Macs and trial-to-paid conversions. No name, email, IP address, location or usage of any feature is stored with it.

Feedback board: Only if you post an idea from Settings, then Feedback, NotchPop sends what you typed (a title, optional details and an optional display name), your NotchPop and macOS versions, and the same hardware hash used for the trial. The title, details, display name and date are shown publicly on notchpop.com/feedback; the hash is never shown and is used only to limit each Mac to five posts a day. Bugs and questions are not posted: NotchPop opens a pre-filled email to support@notchpop.com in your mail app, and nothing is sent unless you send that email. Votes on the board store a one-way hash of either that Mac hash or a random id your browser keeps, so each voter counts once. To stop automated abuse, the server keeps a keyed one-way hash of the IP address that posts, votes or starts a new trial for one day, separate from the Mac hash, to cap how many of each come from one network. We may hide posts that are abusive or off-topic.

Clipboard monitoring is completely optional and disabled by default. If you choose to enable it, NotchPop observes local pasteboard changes, automatically ignores passwords and transient content marked by password managers, retains no more than 50 recent items in volatile memory, and permanently persists only the specific items you choose to pin.

Clipboard contents and dropped files never leave your Mac. File conversions (such as WebP to PNG or video transcoding) execute 100% offline using local macOS frameworks.

NotchPop connects to external network services only when the related feature is configured or actively invoked:

• Weather: Location detection contacts ipapi.co solely to resolve your rough locality when automatic city detection is enabled; weather forecasts and geocoding query Open-Meteo.
• Currency conversion: Uses the Frankfurter API and caches exchange rates locally on your device.
• Lyrics: Only when you open the Lyrics tab of the music player, NotchPop asks LRCLIB (lrclib.net) for the current track's lyrics. The request carries the track's title, artist, album and duration. No audio is sent.
• Links: To show a saved link's icon, including the links NotchPop starts with, NotchPop asks that site over HTTPS for its touch icon or favicon, follows any redirect the site sends (often to its own CDN), and keeps the image on your Mac. The requests carry only standard details, such as the app and macOS versions in the user agent.
• Connected services: External requests to Stripe, Polar, Dodo Payments, Google Analytics, AdSense, OpenAI, Anthropic, or Grok occur only if you explicitly connect and use those integrations.
• Update checks: NotchPop periodically downloads a signed update feed from notchpop.com to find and install newer versions. The request carries no personal data.

All integration credentials, private API keys, and webhook secrets are stored securely within the encrypted macOS Keychain. OAuth integrations (such as Google Sign-In) utilize local loopback callbacks with state validation and PKCE.

NotchPop does not sell, lease, or distribute credentials, clipboard content, files, or sensitive personal information to third parties.

Certain features require explicit macOS security permissions before functioning:

• Calendar: Access is requested only when you link Apple Calendar or view scheduled events.
• Media controls: Requests macOS Automation permissions to communicate with Apple Music or Spotify via local AppleScript.
• Message replies: Quick message actions may request Full Disk Access, Accessibility, or Messages Automation to interact with system notifications.
• Meeting controls and Playing Next: With Accessibility permission, NotchPop reads the microphone, camera and sharing buttons of an active call in Zoom, Teams or a supported browser, and the queue your music player shows. Both are read on your Mac and are not sent anywhere.
• Microphone: Audio access is limited strictly to features that record voice notes or sound triggers.

You may inspect, modify, or revoke any permission at any time directly in macOS System Settings > Privacy & Security.

Because your data resides on your Mac, you retain complete ownership and control. Disconnecting an integration in NotchPop immediately purges its authentication tokens from your macOS Keychain.

Removing the application clears active memory. Local preferences, cached shelves, and pinned notes stored at ~/Library/Application Support/NotchPop can be removed manually at any time.

For privacy questions, audits, or technical feedback, email support@notchpop.com without including private tokens or confidential personal data.