Privacy Policy

1. Introduction

This Privacy Policy explains how OverClean ("the Application", "we", "our") handles information when you use our macOS disk space analyzer application. We are committed to protecting your privacy and being transparent about our data practices.

Key Point: OverClean's core disk-scanning functionality is fully offline and never transmits your file data. The Application does make automatic network requests to activate and periodically verify your license key (see Section 3.5), and it sends data if you choose to submit the optional in-app Feedback or Review form (see Section 3.4) or the Contact/Feedback forms on our website (see Section 3.6).

2. Data Controller Information

OverClean is proprietary, closed-source software. The data controller responsible for the processing described in this Privacy Policy is:

Oleksii Radetskyi, a self-employed sole trader (autónomo) registered in Spain (NIF/NIE: Z2645740D)
Registered address: Paraje Peñones, 35, 29788 Frigiliana, Málaga, Spain
Contact: [email protected]

For privacy inquiries, you may also use the contact form on our website. See also our Legal Notice.

3. Data We Collect

3.1 File System Metadata

When you perform a scan, the Application collects the following metadata from your file system:

• File paths and names
• File sizes
• Creation dates
• Modification dates
• File owner information
• File extensions and types

3.2 Application Information

When scanning for applications and leftovers, the Application collects:

• Application bundle identifiers
• Application names and versions
• Application bundle locations and sizes

3.3 What We Do NOT Collect

• No file contents: We only read file metadata, never the actual content of your files
• No usage analytics or crash reporting: The Application does not include any analytics or crash-reporting SDK, and does not track how you use its features
• No transmission of your scanned file or directory data: The Application never sends your scan results anywhere
• No account information: The Application does not require registration or sign-in beyond entering a license key

About the automatic license check: On every launch, the Application sends your license key and a hashed hardware identifier to our license server to verify your license (Section 3.5). This is not usage analytics in the sense that we do not log or analyze how you use the Application's features — but as with any network request, our server infrastructure (and Cloudflare, our infrastructure provider) unavoidably processes connection-level data such as your IP address and the request timestamp as part of handling the request. We do not use this data to build a usage profile, and we do not retain server access logs beyond what Cloudflare retains for security purposes by default (see Cloudflare's Privacy Policy). See Section 11 for more on Cloudflare's role.

3.4 Optional Feedback & Review Data

The Application includes an optional in-app Feedback form and an optional in-app Review form. Nothing in this section is collected unless you actively open one of these forms and press "Send"/"Submit."

The Review form prompt appears automatically after every 3rd scan you complete in the Application, until you either submit a review or the prompt is otherwise dismissed permanently; reaching that point only displays the prompt, it does not send anything by itself. The Feedback form is never shown automatically — it is only accessible via the toolbar button, the Help menu, or the About tab.

Feedback form, if you choose to submit it, sends:

• Your star rating
• Any feature request or problem description you typed
• Your macOS version and Mac model (auto-filled, editable)
• Your email address, if you choose to provide one (optional, used only to follow up on your report)

Review form, if you choose to submit it, sends:

• Your star rating
• The testimonial text you typed
• The name you choose to display if we publish your review (e.g. "Oleksii R.")
• Your email address (used only to contact you about your review, not published)

Submitting the Review form requires you to check a consent box agreeing that the testimonial and display name may be published on our website, as-is, and translated into other languages. Your email address is never published.

Both forms are submitted directly to Google Forms (operated by Google LLC), our form provider — see Section 11 for details.

3.5 License Activation Data

If you activate a paid license, the Application collects and transmits to our license server:

• The license key you enter
• A hashed hardware identifier derived from your Mac's serial number and network MAC address (SHA-256, one-way — we cannot recover your original serial number or MAC address from it)

When you activate a license, the Application version is also sent, to help us provide support and detect compatibility issues. When you deactivate a device or when the Application performs its automatic launch verification, only the license key and hashed hardware identifier are sent — the Application version is not included in those requests.

Verification happens automatically each time the Application launches, to confirm your license is still valid. If verification fails (e.g., no internet connection), the Application permits offline use for up to 14 days based on the last successful check, after which premium features are locked again until you reconnect.

License purchases themselves are handled by Creem, our payment processor — see Section 11.

3.6 Website Contact and Feedback Forms

Our website (not the Application) has a Contact form (/contact/) and a Feedback form (/feedback/). Nothing in this section is collected unless you actively fill in and submit one of these forms.

If you submit either form, we receive:

• Your email address (required, so we can reply)
• The message you typed
• For the Feedback form, the category you selected (Bug report, Feature request, or General feedback)

Both forms use Cloudflare Turnstile, a bot-detection check, before a submission is accepted; Turnstile processes your IP address and browser signals to determine whether the submission is likely automated. To prevent abuse, submissions from the same IP address are also rate-limited: your IP address is converted to a salted SHA-256 hash (a one-way transformation we cannot reverse back to your original address) and that hash, not your raw IP address, is stored for up to one hour before being automatically deleted.

Submissions are delivered to a private Slack workspace channel that only we have access to — see Section 11.

4. How We Use Data

All collected data is used exclusively for:

• Displaying file and directory information in the Application interface
• Calculating disk usage statistics
• Categorizing files by type
• Identifying applications and their associated data
• Detecting orphaned application data (leftovers)
• Verifying your license and unlocking premium features (Details, Applications, Leftovers)

All disk-scanning data processing occurs entirely on your local device. License data is the only category described in this policy that is transmitted off-device as a normal part of using the Application.

5. Data Storage

5.1 Local Database

Scan results are stored in a local SQLite database on your Mac at:

~/Library/Application Support/Overclean/overclean.db

5.2 License Key Storage

Your license key is stored locally in the macOS Keychain (not in the SQLite database described above), where it is protected by the operating system. A record of your activation (license key, hashed hardware identifier, activation timestamp) is also stored on our license server while your license is active, and for up to 12 months after deactivation for fraud-prevention and support purposes, after which it is deleted — see Section 3.5 and Section 7. We do not receive or store your payment or billing details; those are held by Creem, our payment processor (see Section 11).

5.3 No Cloud Storage of Scan Data

• Your scanned file, directory, and application data is never uploaded to any cloud service or external server
• All scan data remains on your local device
• The only data stored outside your device is the license activation record described in Section 5.2

5.4 User Control

You have complete control over the stored data:

• You can delete the local database file at any time
• You can deactivate a device's license at any time from Options, which removes the activation record from our server and the key from your Keychain
• Uninstalling the Application (e.g., moving it to the Trash) does not, by itself, delete the local database or other files it created. To remove all locally stored data, also delete ~/Library/Application Support/Overclean/ after uninstalling
• No residual scan data is retained on our servers

6. Data Sharing

Your scanned file data is never shared with third parties.

• No file, directory, or application scan data is ever transmitted over the internet
• No data is sold to advertisers or data brokers
• No data is shared with analytics providers
• Your license key and hashed hardware identifier are sent to our license server solely to validate your purchase and enforce the 3-device activation limit — see Section 3.5
• If you voluntarily submit the Feedback or Review form (Section 3.4), that content is sent to Google Forms, our form provider — see Section 11
• If you consent when submitting a Review, your testimonial and chosen display name may be published on our website
• If you purchase a license, your payment details are collected and processed directly by Creem, our payment processor — see Section 11
• If you submit the Contact or Feedback form on our website (Section 3.6), that content is sent to a private Slack channel — see Section 11

7. Data Retention

• Local scan data is stored only for as long as needed to display scan results
• You can clear scan data at any time by deleting the database file
• Uninstalling the Application does not automatically delete this data — see Section 5.4
• License activation records (key, hashed hardware identifier, activation timestamp) are retained on our license server while your license remains active, and for up to 12 months after deactivation, to enforce the device limit, support deactivation requests, and prevent fraud
• We do not retain any backup copies of your scan data
• Feedback and Review form submissions are retained by Google Forms and by us for as long as reasonably needed to act on them (typically no more than 24 months), unless you ask us to delete them sooner
• Website Contact/Feedback form submissions (Section 3.6) are retained in our Slack workspace for as long as reasonably needed to act on them (typically no more than 24 months), unless you ask us to delete them sooner; the salted IP hash used for rate limiting is automatically deleted after one hour

8. Your Rights (GDPR Compliance)

Under the General Data Protection Regulation (GDPR) and other applicable privacy laws, you have the following rights regarding the license and form data described in this policy (your local scan data, which we do not hold, is entirely within your own control — see Section 5.4):

8.1 Right of Access (Article 15)

You can ask us to confirm what license activation data or form submissions we hold about you, and request a copy.

8.2 Right to Rectification (Article 16)

You can ask us to correct inaccurate license or form data we hold about you.

8.3 Right to Erasure (Article 17)

You can ask us to delete your license activation record from our server (deactivating your license does this automatically — see Section 5.4) and your Feedback/Review submissions.

8.4 Right to Restriction of Processing (Article 18)

You can ask us to restrict our processing of your data in certain circumstances, for example while we verify a rectification request.

8.5 Right to Data Portability (Article 20)

You can ask us for a copy of your license activation record in a structured, commonly used format. The local SQLite database on your device is already in a standard, open format you can access directly with any SQLite-compatible tool.

8.6 Right to Object and to Withdraw Consent (Article 21, Article 7(3))

Where our processing is based on your consent (e.g., submitting a Review), you may withdraw that consent at any time by contacting us; this does not affect the lawfulness of processing before withdrawal, and previously published testimonials will be removed on request. Where processing is based on our legitimate interest, you may object to it.

8.7 Right to Lodge a Complaint

If you believe our processing of your data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In Spain, this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

8.8 How to Exercise Your Rights

To exercise any of these rights, contact us through the contact form on our website or at [email protected]. We will respond within one month, as required by GDPR Article 12(3).

9. Security Measures

We implement appropriate security measures:

• All scan data is stored locally with standard macOS file system permissions
• Your license key is stored in the macOS Keychain, not in plain text on disk
• Feedback/Review form submissions and license activation/verification requests are sent over HTTPS
• License requests are additionally authenticated with HMAC-SHA256 request signing. This helps detect tampering with requests in transit and discourages casual abuse of the license API, but — like any client-side secret embedded in a distributed application — it is not a guarantee against a sufficiently determined attacker who extracts the signing key from the Application binary
• The Application requests Full Disk Access to scan your file system, but deletes only via the macOS Trash — it never requests administrator privileges to delete anything, and has no permanent-deletion capability. If an item cannot be moved to the Trash, the Application leaves it in place — see Section 5.4 of the Terms of Service

10. Children's Privacy

The Application does not knowingly collect personal information from children under the age of 16. The Feedback and Review forms are optional and intended for adult users of the Application; we do not knowingly solicit or retain data submitted by children.

11. Third-Party Services

OverClean's disk-scanning functionality does not use any third-party services. The Application does rely on the following services for licensing and optional feedback:

• License server (licenses.overcleanmacapp.com), operated by us and proxied through Cloudflare for security and performance: receives your license key and hashed hardware identifier as described in Section 3.5. Cloudflare processes connection-level technical data (such as IP address) as our infrastructure provider; see Cloudflare's Privacy Policy.
• Creem (Creem.io, operated by Armitage Labs OÜ, Estonia), our payment processor and merchant of record: processes your purchase, including your name, email, and payment details, when you buy a license key. We receive only your license key and order confirmation from Creem — we do not receive or store your full payment details. Creem's collection and use of this data is governed by Creem's Privacy Policy.
• Google Forms, used to receive your optional in-app Feedback or Review form submission (Section 3.4), subject to Google's Privacy Policy.
• Slack (operated by Slack Technologies LLC, a Salesforce company), used to deliver Contact and Feedback form submissions made through our website (Section 3.6) to a private workspace channel that only we have access to. Subject to Slack's Privacy Policy.
• Cloudflare Turnstile, a bot-detection check used on our website's Contact and Feedback forms (Section 3.6), processing your IP address and browser signals; also our website hosting and serverless function provider for these forms. See Cloudflare's Privacy Policy.

International Data Transfers

Cloudflare Inc., Google LLC, and Slack Technologies LLC are based in the United States. Where these providers process personal data outside the European Economic Area, that transfer is carried out under a valid transfer mechanism such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses, as offered by each provider. You can request more information about the specific safeguards applied by contacting us.

Beyond these:

• No analytics services (Google Analytics, etc.)
• No crash reporting services
• No advertising networks
• No network connections of any kind other than license activation/verification (Section 3.5), optional Feedback/Review submission (Section 3.4), the website Contact/Feedback forms (Section 3.6), and license purchase via Creem

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be indicated by updating the "Effective Date" at the top of this document. For material changes — such as a new category of data collected or a new third-party recipient — we will make reasonable efforts to notify registered purchasers by email in addition to posting the update. We encourage you to review this Privacy Policy periodically.

13. Legal Basis for Processing (GDPR Article 6)

For file system metadata processed locally on your device, we are not the controller of that processing: it takes place entirely on your own hardware, under your own control, and is never transmitted to us. We describe it in this policy for transparency, not because we determine its purposes or means.

The legal basis for processing Feedback/Review form data (Section 3.4) is:

• Consent: By choosing to fill in and submit the Feedback or Review form, you consent to that data being sent to Google Forms and, for Reviews, to the additional publication described in Section 3.4. You may withdraw this consent at any time — see Section 8.6

The legal basis for processing website Contact/Feedback form data (Section 3.6) is:

• Consent: By choosing to fill in and submit the Contact or Feedback form, you consent to that data being sent to Slack (Article 6(1)(a)). You may withdraw this consent at any time — see Section 8.6
• Legitimate interest: Processing your IP address through Cloudflare Turnstile and the salted rate-limit hash described in Section 3.6 is based on our legitimate interest in protecting these forms from spam and abuse (Article 6(1)(f))

The legal basis for processing license activation data (Section 3.5) is:

• Performance of a contract: Processing your license key and hashed hardware identifier is necessary to deliver the paid features you purchased and to enforce the license terms (Article 6(1)(b))
• Legitimate interest: Retaining activation records for up to 12 months after deactivation, for fraud prevention, is based on our legitimate interest in protecting the license system from abuse (Article 6(1)(f))

14. Contact Information

For questions or concerns about this Privacy Policy or our data practices, contact us at [email protected] or through the contact form on our website.