Privacy Policy

1. Who we are

Cupola and trycupola.com are run by Venzpire ("we", "us", "our"), which is responsible for the personal data described here. You can reach us at [email protected].

2. This website

Fonts, icons, the site's own code and almost all images load from our own server. The exception is the row of badges at the bottom of the homepage, some of which load from the sites they belong to. There are no ads and no social media buttons. Four things happen without asking first: Cloudflare, our content delivery network, sits in front of trycupola.com and can see every request as it passes through; any page that shows a price asks our server which country you're in and that server asks a small pricing service of ours on Google Cloud Functions what Dodo Payments charges there, described under "Prices in your currency" below; the homepage adds one to a running total of where visitors come from, described under "Where visitors come from" below; and the homepage loads those badges, described under "Badges from sites that list Cupola" below. Beyond that, a page talks to another company only if you allow visit statistics, use the waitlist or play the video, all described below.

Visit statistics (off unless you allow them)

If you tick "Count my visit" in the storage card, the site loads Google Analytics for Firebase, a Google service, whose tag (gtag.js) comes from Google's servers. It records which pages you view and when, how long you stay, the page or site you came from, and things it notices on its own, such as scrolling to the end of a page or following a link to another site. Google adds your browser, operating system, device type, screen size, language and approximate location, worked out from your IP address; Google Analytics doesn't store the IP address itself. To tell a new visitor from a returning one, it sets the cookies and keeps the random identifier listed in section 3. The page address it reports never includes the one-time code from a waitlist link. We see counts and trends, never who you are, and Google's advertising features are turned off. You can take your OK back at any time with Cookie settings: the site then stops sending statistics and deletes those cookies.

Where visitors come from (counted without cookies)

We list Cupola on sites such as app directories and launch boards, and we want to know which of them are worth it. So when you open the homepage, it sends a small request to a service of ours on Google Cloud Functions that says only where the visit came from and what happened: a short tag such as "macnotch" taken from the link you followed (its ref or utm_source part), or else the name of the site that sent you (just the domain, like "reddit.com"), or "direct"; plus one of three things: you opened the page, you pressed Install or Try it free (or copied the install command), or you pressed Continue to checkout. Each of the last two is sent at most once per page view.

The service adds one to a total for that day, that tag and that event, and that's all it stores: a count per day, such as "12 visits and 3 installs from macnotch on 1 October". It doesn't store your IP address, your browser details, the full address of the page or of the site you came from, and it sets no cookies and saves nothing in your browser, so it can't recognise you on a later visit or tell one visitor from another. To stop the service being flooded, it keeps a scrambled (hashed) form of your IP address for about an hour, then deletes it automatically. Like any request, this one reaches Google with your IP address and browser details, which Google uses to run and protect its service.

This isn't behind an opt-in because it records nothing about you. If your browser sends Global Privacy Control or Do Not Track, the homepage doesn't send it at all.

Badges from sites that list Cupola

The bottom of the homepage shows badges from sites that list Cupola, such as Product Hunt. Some of them are images we keep on our own server; others are loaded straight from the site they belong to whenever the homepage opens, and a few of those sites ask for exactly that in return for listing Cupola. When your browser loads a badge from another site, that site receives your IP address, your browser details and the fact that you're on our homepage, and depending on your browser's settings it may read or set its own cookies. Those sites decide what they do with this under their own privacy policies; we don't receive anything from them. Following a badge's link takes you to that site.

The waitlist

Before Cupola launches, you can join a waitlist to get one email on launch day. Here's exactly what happens:

• When you ask for a magic link, your email address goes to our small waitlist service, which runs on Google's Firebase (Cloud Functions). It gets a one-time sign-in link from Firebase Authentication, also Google, and has Resend, our email provider, send it to you from [email protected]. Firebase keeps a sign-in record for your address with the date it was created and last used, and Resend keeps a delivery record of the email (address, subject and whether it arrived) for a limited time.
• To stop the form being misused, the service limits how many links an address, a network and the whole site can ask for. For that it stores a scrambled (hashed) form of your address and of your IP address with the times links were sent, never the address itself. These are deleted automatically within 2 days.
• When you open the link, the page loads Google's Firebase code, served from our own server, and the link proves the inbox is yours. Only then is your address added to the list, stored in Cloud Firestore (also Firebase) together with your place in the queue and the time you joined. Addresses that are never confirmed are never added.
• What we use it for: one email when Cupola launches. We won't send newsletters or marketing, share the list, or sell it.
• Leaving: "Leave the waitlist" on the page sends you a link to confirm it's you. Opening it deletes your entry and your Firebase sign-in record. You can also email us and we'll delete it by hand.
• Limiting repeat sign-ups: to stop the same address from joining and leaving over and over, Cloud Firestore also keeps a small marker for each address that has ever joined, with a count of how many times it's joined. This marker is kept even after you leave, but it holds nothing beyond the address and that count, and it's used only to cap an address at 3 joins.

Like any request, these reach Google with your IP address and browser details, which Google uses to run and protect its service.

Server logs

When your browser, the installer or the Cupola app asks our server for a file, the server records the usual details of that request: your IP address, the date and time, the file requested, the page you came from, and the name and version of your browser or app. We use these logs only to keep the site and the installer running and secure, and we delete them once they're no longer needed for that.

Sending the link to your Mac

On a phone, "Send it to my Mac" opens your device's own share sheet or email app. Nothing you share passes through us.

Prices in your currency

To show the price in your currency, every page that shows a price asks our server which country your IP address belongs to (Cloudflare, our CDN, works this out and answers same-origin, so this step doesn't leave our infrastructure), then that page sends only the country code to our small pricing service on Google Cloud Functions, run by Google. Unlike the other features on this page, this check isn't behind an opt-in: it runs automatically wherever a price is shown, because the page can't display the right price without it. The service asks Dodo Payments what checkout charges in that country and how many licenses are left at the launch price, and passes the answer back. Neither the country nor anything else about you is stored, beyond the usual server records described above.

The video

The homepage has a "See how it works" button. Nothing from YouTube loads until you press it. Then the video plays in YouTube's privacy-enhanced player (youtube-nocookie.com), which comes from Google's servers. From then on your browser talks to Google, which receives your IP address and browser details, can save items in your browser under its own address to play the video and count views, and handles all of this under Google's Privacy Policy. Closing the video removes the player from the page.

3. Cookies and browser storage

Unless you allow visit statistics, this site doesn't set any cookies. It saves at most three small items in your browser's local storage, which stay on your device and are never sent to us. If you tick "Count my visit", Google Analytics adds the cookies and the identifier marked "Statistics" below. If you play the video, YouTube may save its own items, as described in section 2. The badges at the bottom of the homepage that load from other sites may read or set those sites' own cookies, as described in section 2; we don't set or read them.

You can change your choice at any time:

Cookie settings

4. The Cupola app

Your calendars, reminders and notes

Cupola reads and edits your events, reminders and notes on your Mac, through macOS and Apple's own apps. They are never sent to us or to anyone else. If you use iCloud, Apple syncs them between your devices; Cupola doesn't. Cupola's own settings, its undo history and its search index are also kept only on your Mac.

Clipboard history

While Cupola is running, it keeps a history of what you copy on your Mac (text, links, images and files) so you can find and copy it again. The history is stored only on your Mac, in Cupola's own database, which only your user account can read. It is never synced or sent to us. Cupola keeps your newest 500 clips plus any you pin, and you can delete any clip, or several at once, whenever you like. Clips that apps mark as concealed or temporary, such as passwords copied from a password manager, are never recorded.

When you copy a web link, Cupola loads that page once, and the preview image it names, the same way a chat app shows a link preview. These requests go straight from your Mac to the website (and wherever it keeps its images), without cookies, so they see your IP address, as they would if you opened the link. Nothing passes through us.

Permissions

macOS asks for your OK before Cupola can use any of these, and you can take it back in System Settings, Privacy & Security.

• Calendars and Reminders, to show and edit your events and reminders.
• Full Disk Access, to read the databases Notes and Reminders keep on your Mac, so Cupola can show things like checklists, tables and tags.
• Automation, to ask Notes and Reminders to make the changes you request, and to show and control what's playing in Music or Spotify in Focus mode.

Crash reports (on unless you switch them off)

If Cupola crashes, it sends a report through Firebase Crashlytics, a Google service, so we can find and fix the bug. A report contains technical details of what the app was doing when it crashed, the Cupola and macOS versions, your Mac's model and a random identifier for this installation. It doesn't contain your events, reminders or notes. Crash reports are on by default; the welcome tour lets you turn them off before they start, and you can switch them on or off any time after that in Cupola's Settings under Privacy. The change applies the next time Cupola starts.

Usage statistics (off unless you switch them on)

If you choose to share them, in the welcome tour or in Settings under Privacy, Cupola sends anonymous usage statistics through Google Analytics for Firebase. They record which part of Cupola you open, which kind of action you take (such as adding a reminder, never what it says) and whether it worked, when you undo something, and when you open the notch or Focus mode. Firebase adds your macOS version, Mac model, Cupola version, approximate country (worked out from your IP address) and a random identifier for this installation. There are no titles, text, dates or names, and we never attach an account or email to them. Switching statistics off stops them at once and resets the random identifier. Google's advertising features are turned off.

Feature switches

Cupola checks Firebase Remote Config, a Google service, to see whether a feature needs to be switched off, for example after a macOS update changes something it relies on (see section 9 of the Terms). This check sends a random installation identifier and basic technical details such as the app version. It carries none of your content.

Update checks

Once a day, Cupola downloads a small list of versions from trycupola.com to see whether an update is out. It sends nothing else; our server log records the request as described in section 2.

Price

Until Cupola has a license, it asks our pricing service on Google Cloud Functions for the current price, to show it next to the Buy button. It sends nothing but the request itself, and nothing about it is stored beyond the service's usual request records.

Trial and license

Cupola keeps the date your trial started in your Mac's Keychain and in its own folder on your Mac. So we know how many people try Cupola and how many of them buy it, Cupola tells a small service of ours, run on Google Cloud Functions, once that a trial started on your Mac and, if you buy a license, once that it was activated there. It sends the date your trial started, whether your Mac has a license, your Cupola and macOS versions, and a random code that Cupola makes on your Mac and keeps in its Keychain and its own folder, so each Mac is counted once. When it reports a purchase, it also sends the license key and that activation's ID, only so our service can ask Dodo Payments to confirm the key is genuinely active before counting the purchase; the key isn't stored or logged anywhere, on our side or Dodo's, once that check is done. Otherwise the code isn't your license key, the feedback code below or anything worked out from your Mac's hardware. The service stores a scrambled form of the code with those details and when it heard about them in Cloud Firestore, a Google Firebase service, and adds them to running totals. There's no name, email or account. If your Mac is offline, Cupola tries again the next time it opens or checks for updates. To stop the service being misused, it also keeps a scrambled form of your IP address with the times of recent requests.

When you activate a license key, Cupola sends the key to Dodo Payments, which checks it and records one activation for it under the fixed name "Cupola for Mac". When Cupola opens, and each time it checks for updates (once a day unless you turn automatic checks off, or when you choose Check for Updates), it sends the key and that activation's ID to Dodo Payments to confirm the license is still valid. Deactivating sends the same two things to free the activation. If your key is active on another Mac and you choose Move License to This Mac, Cupola sends the key to a small service of ours run on Google Cloud Functions, which frees the other Mac's activation at Dodo Payments. That service keeps a scrambled form of the key with the times of its recent moves, so a license can move at most 3 times in 30 days, and it briefly counts requests per IP address to stop abuse. These checks send nothing else: not your name, your email address, your Mac's name or any of your content.

Cupola keeps the key and the activation ID in your Mac's Keychain and in its own folder on your Mac. So that a license activated on one Mac doesn't unlock another one set up from its backup, it saves alongside them a scrambled code worked out from your Mac's hardware ID, and compares it only on your Mac. The code and the hardware ID are never sent anywhere.

Bug reports and feedback (only when you send one)

When you send a bug report or feedback from Settings under Feedback, Cupola sends what you wrote (whether it's a bug or feedback, a title and a description), the screenshot if you attached one, and your Cupola and macOS versions to a small service of ours run on Google Cloud Functions. It stores them in Cloud Firestore and the screenshot in Cloud Storage, both Google Firebase services, so we can read them and fix the bug. They go with a random code that Cupola makes on your Mac and keeps in its Keychain and its own folder; the service stores only a scrambled form of that code, so only your Mac can list what it sent. There's no name, email or account, unless you type one in yourself. To stop the service being misused, each Mac can send 5 a day; for that the service also keeps the times you sent them and a scrambled form of your IP address.

5. Buying a license

Checkout is run by Dodo Payments, which sells Cupola to you as merchant of record. It collects what it needs to take the payment, such as your name, email address, billing country and card or other payment details. We never see your full card details.

We receive your name, email address, country, what you bought, the price and tax paid, and your order number. We use them to send your license key, answer your support emails, handle refunds and keep the records tax law requires.

After you pay, Dodo Payments sends you back to our thank-you page (trycupola.com/thanks.html) and puts your order status, order number, email address and license key in the page's address. The page reads them on your device to show you your key, then removes them from the address bar straight away, before anything else on the page runs. Because that first request still carries them in its address, our web server's own request log records that address, including the email and license key, like it does for any request; that log is covered by the retention described in section 2 and isn't used for anything beyond keeping the site running and secure. Once the address is cleaned up, the key isn't stored anywhere else, sent to site statistics, or kept once you leave or reload the page; the email from Dodo Payments keeps a copy.

6. Why we're allowed to use it

Where laws such as the GDPR apply, we rely on:

• Contract, to sell you a license, deliver it and give you a refund;
• Legitimate interests, to keep the site, the installer and the app working and secure, and to know how many people try and buy Cupola and which sites send them: server logs, crash reports, feature switches, trial counts, the running totals of where visitors come from, and showing badges from sites that list Cupola;
• Your consent, for the waitlist, the app's usage statistics, this website's visit statistics and remembering your theme. You can withdraw it at any time, and doing so doesn't affect what happened before;
• Legal obligation, to keep purchase records for tax.

7. Who else handles data

We use a few service providers who handle data only on our behalf:

• DigitalOcean hosts trycupola.com, the installer and the updates, including the server logs.
• Cloudflare is our content delivery network and reverse proxy: every request to trycupola.com passes through it before reaching our server, and it answers the country lookup used to show prices in your currency.
• Google runs crash reports, opt-in statistics for the app and this website, and feature switches (Firebase Crashlytics, Google Analytics for Firebase and Firebase Remote Config), the waitlist (Firebase Authentication and Cloud Firestore), moving a license between Macs (Cloud Functions and Cloud Firestore), counting trials and purchases (Cloud Functions and Cloud Firestore), counting where homepage visitors come from (Cloud Functions and Cloud Firestore), showing prices in your currency on every page that shows one (Cloud Functions), and bug reports and feedback (Cloud Functions, Cloud Firestore and Cloud Storage).
• Resend sends the waitlist's magic-link emails.
• Dodo Payments runs checkout and payments, works out the price in your currency, sends your license key and checks it when Cupola activates or opens.

We don't sell personal data, and we don't share it for advertising. We may disclose data if the law requires it.

8. International transfers

Our providers may process data in the United States and other countries outside your own. Where the law requires it, those transfers are covered by recognised safeguards such as the European Commission's Standard Contractual Clauses.

9. How long we keep it

• Server logs: only as long as needed to keep the site running and secure.
• Crash reports: Crashlytics keeps them for 90 days.
• Waitlist: until you leave it. Once Cupola has launched and the launch email has gone out, we delete the whole list, and its sign-in records, within 3 months.
• Usage and visit statistics: no more than 14 months.
• Trial and purchase counts: for as long as we sell Cupola. The request times and scrambled IP addresses kept to limit requests are deleted automatically within 2 days.
• Where visitors come from: the daily totals, for as long as we sell Cupola. The scrambled IP addresses kept to limit requests are deleted automatically within about an hour, and never later than 2 days.
• Bug reports and feedback: as long as we need them to look into what you reported. Email us to have yours deleted sooner. The send times and scrambled IP addresses kept to limit sending are deleted automatically within 2 days.
• Purchase records: as long as tax and accounting law requires.
• Browser storage: until you clear it, as described in section 3.

10. Your rights

Depending on where you live, you can ask us to show you the personal data we hold about you, correct it, delete it, restrict or object to how we use it, or give you a copy to take elsewhere. You can withdraw any consent you've given, and you can complain to your data protection authority. To use any of these rights, email [email protected]. We'll never charge you or treat you differently for asking.

Crash reports, statistics, trial counts and the totals of where visitors come from carry no name or email, so we usually can't tell which ones are yours; the visitor totals hold nothing about any one person at all. Switching crash reports and statistics off in Cupola's Settings, or taking back your OK with Cookie settings on this site, stops any more from being sent. To leave the waitlist, use "Leave the waitlist" on the waitlist page or email us.

11. Children

Cupola isn't aimed at children, and we don't knowingly collect personal data from children under 13. If you think a child has given us personal data, email us and we'll delete it.

12. Changes to this policy

When Cupola or this site starts handling data differently, we'll update this policy first and change the date at the top of this page.

13. Contact

Questions about privacy? Email [email protected].