Privacy Policy

1. Who we are

Sweatpea is a macOS app and the website at sweatpea.app, made and operated by Aayush Kedawat, an individual based in India, trading as "Sweatpea" ("we", "us", "our").

For the personal data described in this policy, we are the controller under the EU and UK General Data Protection Regulation (GDPR) and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act), except where we say a provider acts as an independent controller, as Dodo Payments does for checkout.

Contact: support@sweatpea.app.

2. What this policy covers

This policy covers the Sweatpea app for macOS (free, trial and Pro), the website at sweatpea.app, the app's update feed, Pro licence activation, and emails you send us. It does not cover websites or services we link to, including Dodo Payments' checkout, which has its own privacy policy.

3. Data that stays on your Mac

To do its job, the app reads the following locally. It is processed on your Mac, stored on your Mac, and is never sent to us or anyone else. We have no way to see it.

• System load: CPU use, thermal state, memory use and pressure, swap, and disk space.
• Running apps: the names, icons and resource use of apps and processes, so the pea can name the one working your Mac hardest.
• Folder sizes (Pro): the total size of your Downloads, Desktop and Documents folders. macOS asks for your permission first. The app adds up file sizes; it does not open, read or copy the contents of your files.
• Presence signals: how long since you last used the keyboard, mouse or trackpad (a number of seconds, never what you typed or clicked), whether the screen is locked or asleep, whether an app is using the microphone (a yes/no, never audio), and whether the front app is full-screen. These pause break prompts during calls and presentations.
• Your history and settings: daily heat, breaks and top apps for up to about 400 days, fourteen days of memory and storage readings, your challenge progress, reminders, quiet hours and preferences. These are kept in ~/Library/Application Support/Sweatpea and the app's preferences file.
• Your trial and licence state: when your trial began and, if you buy Pro, your licence key and activation id, kept in the app's preferences.

When you choose to share. Report cards, roast cards, Sweat Wrapped images and CSV exports are created on your Mac and go only where you send them: a file you save, or an app you pick in the macOS share sheet. What happens next is governed by that destination, not by us. A card can include app names and your stats, so look at it before you post it.

macOS permissions. The app may ask for Notifications (break and reminder alerts), Files and Folders (Pro's folder sizes) and Login Items (to start with your Mac). You can change any of these in System Settings at any time.

4. Data we or our providers receive

4.1 When you buy Pro (Dodo Payments checkout)

Pro is sold through Dodo Payments, which acts as Merchant of Record: it is the reseller that sells you the licence, charges you, issues your receipt and handles sales tax, VAT and GST. At checkout Dodo collects your name, email address, billing address and country, payment method details and technical data such as your IP address. Dodo processes that data as an independent controller under its Privacy Policy and Buyer Terms.

We never receive your full card or bank details. Dodo shares with us the order information we need to run the business: your name, email address, country, the product, price and taxes, the payment and order identifiers, payment and refund status, and the licence key issued to you.

4.2 When you activate, check or deactivate a Pro licence

The app talks to Dodo Payments' licence service directly. It sends:

• your licence key;
• the activation id Dodo issued for this Mac (after activation); and
• on activation only, your Mac's model identifier (for example "Mac (Mac14,2)"), as a label so you can tell your activated Macs apart. It describes the hardware, not you: the app never sends your Mac's own name, which often contains its owner's.

This happens when you activate, about once a week to confirm the licence is still valid, and when you deactivate a Mac. Like any internet request, Dodo also sees your IP address. No CPU data, app names, usage or history are ever sent.

4.3 The update check

About once a day the app fetches https://sweatpea.app/appcast.xml to see if a new version exists, using the open-source Sparkle framework. The request carries no identifier and no system profile. Our host necessarily receives your IP address, the time of the request and the app's user-agent (the app name and version and the Sparkle version). You can turn this off in Sweatpea's Settings ("Check for updates automatically"). Every update is verified against a signing key built into the app and installs only when you confirm it.

4.4 Visiting sweatpea.app

The website is hosted on Google Firebase Hosting. Like every web server, it receives your IP address, browser user-agent, the page requested, the referring page and the time, and Google may keep these in server logs for security and operation. The site sets no cookies, runs no analytics or advertising scripts, loads no third-party fonts or trackers, and stores nothing in your browser. The download links go straight to the file, and the buy buttons open Dodo's checkout in a new tab.

4.5 When you email us

If you write to us we receive your email address, your name if you include it, the content of your message and anything you attach, such as a licence key or a screenshot. We use it only to answer you, to handle refunds, licence and legal requests, and to keep a record of what was agreed.

5. What we never do

• We do not include analytics, telemetry, crash reporting, advertising or attribution SDKs in the app or the site.
• We do not create user accounts or profiles.
• We do not sell personal data and do not share it for cross-context behavioural or targeted advertising, as those terms are used in California and other US state privacy laws.
• We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
• We do not collect sensitive or special-category data, such as health, biometric or financial account data. Break reminders are wellbeing nudges, not health monitoring, and record nothing about your body.
• We do not use your data to train machine-learning models.

6. Purposes and legal bases

Where GDPR, UK GDPR or similar laws apply, we rely on these legal bases. Under India's DPDP Act, personal data you give us for a specific purpose (such as buying and activating Pro, or emailing support) is processed for that purpose as a legitimate use under section 7, and otherwise on the basis of your consent, which you can withdraw at any time.

Where we rely on legitimate interests, we have weighed them against your rights; you may object at any time (see section 11).

7. Who receives data

• Dodo Payments (the Dodo Payments group, including Dodo Payments Inc. in the United States and Sarvapanchhi Technologies Private Limited in India): Merchant of Record for checkout, tax and refunds, and provider of the licence-key service. Independent controller for checkout data; for licence checks it processes data to provide the service to us.
• Google LLC / Google Cloud (Firebase Hosting): hosts the website, the downloads and the update feed. Processor acting on our instructions.
• Our email provider: delivers and stores mail sent to support@sweatpea.app. Processor.
• Professional advisers (accountants, lawyers) under a duty of confidentiality, where needed.
• Authorities, where the law requires it or to protect rights, safety or property, and only to the extent required.
• A successor, if Sweatpea is sold or transferred, in which case this policy continues to protect your data and we will tell you before it becomes subject to a different policy.

We do not give personal data to anyone else.

8. International transfers

We are based in India, and our providers operate in the United States, India and other countries. Your data may therefore be processed outside the country where you live, including in countries whose data protection laws differ from yours.

Where data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we and our providers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or on the EU–US Data Privacy Framework where the recipient is certified. Transfers from India are made in line with the DPDP Act and any restrictions the Government of India notifies. You can ask us for more information about these safeguards.

9. How long we keep data

• Licence records (key, activations): while your licence exists, and for as long afterwards as needed to handle disputes, refunds and fraud.
• Order and refund records: for as long as tax and accounting law requires, which in India is generally up to eight years.
• Support emails: up to three years after our last exchange, unless needed longer for a legal claim.
• Server logs (website and update feed): kept by Google for its standard log retention period; we do not export or extend them.
• Data on your Mac: until you delete it (see section 12). The app itself trims history older than about 400 days and memory readings older than 14 days.

Dodo Payments keeps checkout and transaction data for the periods set out in its own privacy policy.

10. Security

All network requests from the app and site use HTTPS. The app is signed with an Apple Developer ID and notarized by Apple, and updates are verified with an EdDSA signature before they can be installed. The website uses HSTS and a strict Content Security Policy. No payment card data ever reaches us. Access to the Dodo dashboard and our email is protected with strong authentication.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant authorities as the law requires, including the Data Protection Board of India and, where GDPR applies, the competent supervisory authority within 72 hours of becoming aware of it.

11. Your rights

Whatever the law where you live, you can ask us to tell you what personal data we hold about you, give you a copy, correct it, or delete it, and we will do so unless we must keep it by law. Depending on where you live, you may also have the rights below.

EU, EEA, UK and Switzerland

Access, rectification, erasure, restriction, data portability, the right to object to processing based on legitimate interests, the right to withdraw consent, and the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office).

India

Under the DPDP Act: the right to a summary of your personal data and how it is processed, and of who it has been shared with; to correction, completion, updating and erasure; to grievance redressal; and to nominate someone to exercise your rights if you die or become incapable. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

California and other US states

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws may have the right to know and access the personal information we collect, use and disclose, to correct and delete it, and to opt out of its sale, sharing for targeted advertising or profiling. We do none of those things, so there is nothing to opt out of. We will not discriminate against you for exercising any right. You may use an authorised agent; we may ask them for proof of authority. If we decline a request you may appeal by replying to our decision; if the appeal is denied you may contact your state Attorney General.

Brazil, Canada, Australia and elsewhere

You have the rights your local law gives you, including under Brazil's LGPD, Canada's PIPEDA and Australia's Privacy Act 1988, and we will honour them.

How to make a request

Email support@sweatpea.app from the address you bought with, or include your licence key or order id, so we can confirm the data is yours. We will respond within one month (extendable where the law allows, and we will tell you if so) and free of charge, unless a request is manifestly unfounded or excessive. Because the app's usage data never reaches us, we cannot access or delete it for you; you control it on your Mac (section 12). For data Dodo holds as an independent controller, you can also contact Dodo directly; we will help if you ask.

12. Deleting data on your Mac

1. If you have Pro, open Sweatpea → Pro → Deactivate this Mac. This removes this Mac's activation at Dodo and frees the slot.
2. Quit Sweatpea and move it from Applications to the Bin.
3. Delete the folder ~/Library/Application Support/Sweatpea.
4. In Terminal, run defaults delete app.sweatpea.Sweatpea to remove settings, trial state and the stored licence.

To delete purchase records, email us; we will delete what we are not legally required to keep and ask Dodo to do the same.

13. Children

Sweatpea is a general-audience utility and is not directed at children. We do not knowingly collect personal data from children under 13 (or the higher age set by your local law: 16 in some EU countries and 18 under India's DPDP Act). Pro may only be bought by an adult, or by a minor with the consent and involvement of a parent or legal guardian. If you believe a child has given us personal data without that consent, email us and we will delete it.

14. Cookies and tracking signals

The website uses no cookies, local storage, pixels or fingerprinting, so no cookie banner is needed. Because we do not track you across sites, we treat Do Not Track and Global Privacy Control signals as already honoured. Dodo's checkout pages may use cookies needed for payment security and fraud prevention, described in Dodo's own policy.

15. Changes to this policy

If we change this policy, we will update the date at the top and publish the new version here. If a change materially affects how we handle your personal data, such as a new kind of data leaving your Mac, we will say so in the app's release notes and, where the law requires, ask for your consent before it applies to you.

16. Contact and Grievance Officer

For any privacy question, request or complaint, contact our Grievance Officer, as required by India's DPDP Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011: