Privacy Policy
Short version: Klyr does not run analytics or upload the files you analyze. Storage scanning and review stay on your Mac. Pro connects only when you explicitly check for updates, activate a purchase, sign in with Apple, submit your interest, or use an AI provider you selected with your own API key.
Contents
- 1. What Klyr does and doesn't collect
- 2. What stays on your Mac
- 3. What we never see
- 4. AI features (Pro tier, optional)
- 5. Third-party services
- 6. Cookies and tracking on this website
- 7. Data retention
- 8. Your rights (GDPR / CCPA / etc.)
- 9. International data transfers
- 10. Security practices
- 11. Children's privacy
- 12. Changes to this policy
- 13. Contact and data controller
- 14. Governing law
1. What Klyr does and doesn't collect
The Mac App Store edition is fully local. It makes no network calls and does not offer account sign-in, external Pro purchases, or cloud AI. Across all Klyr editions there are no analytics, telemetry uploads, remote crash reports, tracking, or advertising IDs.
The only network calls in the separately distributed Pro edition are:
| Call | When | Where it goes |
|---|---|---|
| Sparkle update check | When you choose Klyr ▸ Check for Updates | dl.klyr.app over HTTPS |
| AI provider request | When you trigger an AI categorization with an API key set | The provider you chose (Anthropic / OpenAI / Google), using your key |
| Pro interest signup | If you submit your email in the direct-download Pro app | Our Firebase function submitKlyrWaitlist in US-Central (only when you click Send) |
| Sign in with Apple verification | When you click "Sign in with Apple" in the direct-download Pro app | cleanmymacbook.com/auth and our Firebase verification functions in US-Central |
| Purchase and license activation | When checkout becomes available and you purchase or activate Klyr Pro | The approved payment provider and our Firebase entitlement service. Klyr does not receive your full payment-card or bank details. |
These calls are unavailable in the Mac App Store edition, whose updates are handled by Apple. In the direct-download Pro edition, they are off by default and triggered only by explicit user action.
2. What stays on your Mac
These files persist between launches. None of them are ever uploaded.
| Data | Stored at | Why |
|---|---|---|
| Watched-folder list | ~/Library/Application Support/Klyr/watched-folders.json | So your sidebar survives a relaunch. |
| Whitelist patterns | ~/Library/Application Support/Klyr/whitelist.json | Glob patterns Klyr will never trash. |
| Scan history | ~/Library/Application Support/Klyr/history.json | Per-scan record (timestamp, root, file count). No filenames. |
| Error + breadcrumb logs | ~/Library/Application Support/Klyr/logs/YYYY-MM-DD.log | Rotated daily, kept 5 days, deletable. |
| AI provider API keys | macOS Keychain (service app.klyr.Klyr) | Encrypted at rest by the OS. |
| License token (Pro) | ~/Library/Application Support/Klyr/license.json | Ed25519-signed; verified offline. |
| Settings + UI preferences | UserDefaults (app.klyr.Klyr suite) | Toggles for autoscan, threshold, provider choice. |
To wipe everything: Settings ▸ Reset to defaults clears the whitelist, provider choice, and API keys; Clear logs wipes the log directory; the watched-folder list survives reset by design and can be edited per row (right-click ▸ Remove from watched). To remove the lot, drag the directory ~/Library/Application Support/Klyr/ to Trash.
3. What we never see
- The contents of any file you scan.
- File paths or filenames you've scanned.
- Which apps you uninstalled.
- Which folders you watch.
- Whether you opened the app this week.
- How much storage you reclaimed.
- Your raw IP address as a stored profile field. Firebase necessarily receives standard HTTPS metadata; for abuse forensics we retain only a truncated SHA-256 hash, not the address itself.
- Your Mac's name, hardware UUID, advertising ID, or MAC address.
The Mac App Store edition never collects your Apple ID. The direct-download Pro edition collects Apple identity data only if you sign in with Apple.
If you submit a support bundle (Settings ▸ Bundle for support), Klyr writes klyr-logs-YYYY-MM-DD.txt to ~/Downloads. Nothing is uploaded — the bundle sits there until you choose to share it. Breadcrumbs are opaque tags (scanner=largeFile, phase=enumerate) and never include file paths.
4. AI features (Pro tier, optional)
The Pro build can route file-categorization questions to a Large Language Model. You bring your own API key (Anthropic Claude, OpenAI, or Google Gemini). The request goes directly from your Mac to the provider you selected — Klyr never proxies it through our servers.
What's sent to the provider:
- The filename of each candidate file (not the contents).
- The size in bytes.
- A safety hint derived from the path (e.g. "lives under
~/.git/").
What's never sent: the file body, your username, your machine name, any keychain content, your IP (well, the provider sees it — but Klyr does not forward it).
Your usage with the provider you chose is governed by your separate agreement with them. See:
You can disable AI entirely by setting Settings provider to rule-based; Klyr then uses a 19-rule deterministic classifier with no model and no network calls.
5. Third-party services
| Service | Purpose | Data shared |
|---|---|---|
| Apple App Store (MAS Free) | Distribution, updates, payment | Whatever Apple collects when you install or update the app. See Apple's privacy policy. |
| Sparkle (Pro DMG only) | Update delivery | Request to our update server only; no user data sent beyond standard HTTPS metadata. |
| Your chosen AI provider (Pro) | File categorization, optional | See section 4 above. |
| Google Cloud Firestore (Klyr Pro interest signup) | Storing your contact details so we can reach out about Pro access, only if you submit the form. We run a Cloud Function on Firebase that writes to Firestore; the data lives in Google Cloud (US-Central region). | The email address you typed, optionally your name and phone number if you chose to include them, an optional flag for whether you want beta access, the source page tag, the signed-up-at timestamp, a truncated SHA-256 hash of your IP (not the IP itself — kept only for abuse forensics), and your browser's User-Agent header. Klyr usage data on your Mac is never linked to your interest signup. We control the data ourselves; no third-party email-marketing service holds it. |
| Google Cloud Firestore (Klyr Pro account identity) | Direct-download Pro only: storing your Apple identity (opaque user id), email and name (if Apple shared them), and app/OS version when you sign in with Apple. Data lives in Google Cloud (US-Central region). | The Apple user id (Apple's opaque per-app identifier; not your Apple ID itself), email + verified flag + relay flag, optional name, app + macOS version, signed-up-at + last-seen-at timestamps, a truncated SHA-256 of your IP. Klyr usage data on your Mac is still never linked to your identity. |
| Approved payment provider (when checkout becomes available) | Payment processing, receipt, taxes, refunds, and purchase verification. | Information you provide at checkout. Klyr receives purchase status, product, order identifier, and purchase email needed to deliver and manage the license, but not full card or bank credentials. |
Withdrawal. Email vivek.yadav@stringswaytech.com with the subject "delete my interest" (or "unsubscribe") and we'll delete your klyr_waitlist record the same business day. To delete your Sign in with Apple account record, email the same address with the subject "delete my account" and we'll purge the klyr_users record the same business day.
6. Cookies and tracking on this website
This website (cleanmymacbook.com) sets no advertising or analytics cookies, runs no behavioral analytics, and embeds no third-party trackers. The site uses Google Fonts for typography. When you deliberately start Sign in with Apple, the browser communicates with Apple and our Firebase authentication endpoint to complete that request.
7. Data retention
- Local logs: rotated daily, deleted automatically after 5 days. You can clear earlier via Settings ▸ Clear logs.
- Scan history: retained until you click Clear all history in the History tab.
- Watched folders, whitelist, API keys, license: retained until you remove them or uninstall the app.
- Pro interest signup: retained on Stringsway's mailing-list infrastructure until you ask us to delete it. Email vivek.yadav@stringswaytech.com with the email address you signed up with and we'll purge it within 7 days.
- Pro account identity: retained while your account is active or until you ask us to delete it. Authentication sessions expire after 10 minutes and are single-use.
- Purchase entitlement: retained while the license is active and as required for accounting, fraud prevention, refunds, and legal obligations.
8. Your rights
Most Klyr data stays on your Mac. If you joined the Pro interest list or used Sign in with Apple, we also hold the limited account information described above. Depending on where you live, your rights may include:
- Right of access: email us to request a copy of any interest or account record associated with your email address.
- Right to rectification: ask us to correct inaccurate contact or account information.
- Right to erasure: delete the app and its Application Support directory for local data; email us to purge a Pro interest or account record.
- Right to data portability: local Klyr data is stored in readable files under Application Support; you may also request an export of your server-side account record.
- Right to object / withdraw consent: turn off any feature that triggers network calls (AI provider, update check) in Settings.
- Right to lodge a complaint: contact your local data-protection authority. In the EU, find your authority at edpb.europa.eu.
9. International data transfers
Klyr's local-only architecture means no personal data leaves your Mac under normal use. The exceptions:
- Pro interest signup — submitted to a Stringsway Technologies endpoint. Our infrastructure is hosted in the US and India.
- Pro Sign in with Apple — the authentication response is verified by our Firebase backend in the US-Central region.
- AI provider requests — go directly from your Mac to your chosen provider's infrastructure (US, EU, or wherever they operate).
By deliberately using one of these optional features, you request the corresponding transfer.
10. Security practices
- Encryption at rest: API keys live in macOS Keychain, encrypted by the OS. Local logs and settings files use file permissions; if you need at-rest encryption, enable FileVault.
- Encryption in transit: every outbound call uses HTTPS / TLS 1.2+.
- Code signing: The MAS Free build is signed by Apple Distribution and notarized by Apple. The DMG Pro build is signed by Developer ID Application and notarized.
- Sandbox: the MAS Free build runs inside Apple's App Sandbox with only the entitlements it needs (user-selected file read/write).
- License verification: Ed25519 signature over the license token, verified offline against the embedded public key.
- Vulnerability reports: email vivek.yadav@stringswaytech.com with "security" in the subject. We acknowledge within 48 hours.
11. Children's privacy
Klyr is not directed to children under 13 (or the higher minimum age required in their jurisdiction). We do not knowingly collect personal data from children. If you believe a child submitted account or interest information, contact us and we will delete it.
12. Changes to this policy
If this policy changes, we will update the version and effective date on this page. We will provide additional notice for material changes when required by law or reasonably appropriate for the change.
Version history
- v1.3 — 2026-09-09: clarified Klyr's storage-management positioning and documented the planned payment and purchase-activation data flow.
- v1.2 — 2026-09-09: updated the website domain and documented the browser-based Sign in with Apple flow used by Klyr Pro.
- v1.1 — 2026-06-02: added Sign in with Apple (opt-in, Pro build); updated §1 network-calls table; added §3 Apple ID qualifier; added
klyr_usersFirestore row in §5; updated withdrawal paragraph. - v1.0 — 2026-05-26: initial policy.
13. Contact and data controller
Data controller: Stringsway Technologies (the entity publishing Klyr)
Email: vivek.yadav@stringswaytech.com
Website: stringswaytech.com
Email us with privacy questions, takedowns, "I think Klyr did something unexpected", security disclosures, or anything else covered by this policy. Average response time is under 48 hours, weekdays.
14. Governing law
This policy is governed by the laws of India. Disputes — to the extent they survive the privacy-first design above — are resolved in the courts of Pune, Maharashtra, India.
If you spot a clause that does not match Klyr's behavior, email us. We treat documentation drift as a product bug.