Every app wants to know how it’s doing out in the world, and a Mac utility that talks to monitors has an unusually good reason to ask: which monitors work, which fail, which features nobody touches. The usual way to find out is to start collecting first and write the privacy policy after. I did it backwards, and the backwards order turned out to be the whole point.
Write the letter before you decide to mail it: a usage report that can’t send
The version of this app running today can compose a usage report, and cannot send it. Not “doesn’t.” Cannot. The code for talking to the internet was simply never written into that part of the app, the way a room with no plumbing cannot leak. I built it this way so the report could be judged while it was still just a letter sitting on the desk, before any mailbox existed: is this useful? is this safe?
You can read the letter yourself: the Privacy tab will show you the exact report, word for word, that would be sent if you ever opted in. It’s off by default. Most apps ask you to trust a summary of what they collect. I’d rather show you the envelope’s contents.
Anonymous by construction, not by promise
There’s a difference between a rule and a wall. “Employees must not read your diary” is a rule. “The diary is written in ink the office can’t see” is a wall. Wherever I could, I built walls.
Your monitor’s serial number, the one detail that could tie a report to your specific desk, is stripped out at the moment the report is assembled. It isn’t collected-then-deleted; it never enters the document, so no bug, breach, or bad day can un-delete it. Nothing in the report is stamped finer than the day, so it can’t sketch your work hours. There is no account, no email, no name.
One thing the report does carry is a group code, a random tag that lets a hundred reports say “these came from the same setup” without saying whose. Without it, one enthusiast with a rare monitor who reports often would outvote fifty quiet owners of a common one, and I’d chase the wrong bugs. The code is drawn from thin air (never from your hardware), it dissolves and is redrawn every 90 days, and if you switch stats off it’s thrown away. Opting back in starts a stranger, not a returning customer.
A name tag that dissolves every ninety days lets us count setups without ever counting you.
The day the wording had to change
For a while the Privacy tab said the app “sends nothing anywhere.” Then I added a small convenience: once a day the app asks GitHub whether a newer version exists, so it can show a quiet “update available” line. Useful, harmless. And the moment it shipped, “sends nothing anywhere” stopped being true. Asking a website anything means the website sees a request came from your internet address, the same as any page you visit.
So the wording changed the same day, to what it says now: the app sends nothing about you. It discloses the update check plainly and gives it an off switch. A small thing, but a privacy promise that quietly goes stale is worse than no promise at all, because it keeps collecting trust it no longer earns. If I ever add anything that talks to the internet, rereading that tab and making it true again comes first, before the feature.
That’s the whole policy, really. Walls where walls are possible, plain words where they aren’t, and the letter on the desk for anyone who wants to read it.
Addendum, August 2026: the mailbox exists now
The paragraphs above said the app cannot send the report, and when they were written that was the literal truth. As of version 1.16 it can: the letter that sat on the desk for a month proved useful, so I built the mailbox. Per the rule this essay set for itself, the wording changed before the feature shipped, and here is exactly what changed.
The report is still off by default, still readable in full before you decide, and still built by code with no networking in it; the sending lives in one separate file that reads the finished letter and does nothing else. The app will mention the choice at most three times, ever: once in the welcome walkthrough, once three days in, and once more only if a monitor is misbehaving, since that’s exactly when a report of that setup would help someone else with the same monitor. Each mention says which of the three it is.
On the receiving end, this site keeps the report and the day it arrived, nothing else, and deletes both after 400 days. The server code never reads or stores the address a report came from; like any web request, the hosting platform sees that address in its own request logs for a short time, which is the same honest asterisk the update check has always carried. The full field list is on the privacy page.