Privacy Policy
Two different things share one name: an app that runs entirely on your Mac, and a website that measures its visitors. This page keeps them apart, because they are not the same promise.
Last updated
The short version
The app has no account and sends us no telemetry. Session transcripts, window positions, ports and process data are read on your Mac and stay there. We never see them.
The website is a different matter. With your permission it loads Google Analytics, which sets cookies and identifiers in your browser and gives us traffic numbers. Nothing is measured until you say yes. That is the asterisk on the “your data stays on your Mac” promise on our home page: that promise is about the app.
When you buy, Stripe takes your card details and we never see them. What reaches us is the order itself — your email address and what you bought — which is what we need in order to send your key and to support you.
Who is responsible
Sidelong is the controller of the personal data described on this page: we decide what is collected and why, and the companies listed further down only process it on our instructions. Write to hello@thesidelong.app about anything here, including a request to see, correct or delete what we hold.
The app: what stays on your Mac
Sidelong reads a great deal in order to be useful. None of it is uploaded to us: the only server we run is the licence server, which never sees more than a licence key and the name of a Mac, and the app carries no analytics of any kind.
All of it lives in the app's preferences and in its folder under ~/Library on your Mac. Deleting the app and that folder removes it.
- Window positions, sizes and titles, to find the free space a widget can use.
- Agent session transcripts, hook events, session names, tasks and subagents, read from the files the agents already write on your Mac.
- Usage limits, read with the credentials the tools you signed in to already hold.
- Listening ports, the process behind each one, and CPU and memory statistics.
- Summaries and risk explanations produced by Apple Intelligence, which runs on the device.
- Your settings: widget layout, the position remembered on each display, language, and the date of your first launch, which is what the three-day trial counts from.
- Your licence record, once you activate one: the key, the activation id, the dates and the status.
The app: every network call it makes
This is the complete list. Two of them reach a domain of ours — the update manifest and the licence server — and the rest go straight from your Mac to the service concerned, without passing through us.
- Anthropic's usage endpoint, with the token Claude Code already holds on your Mac, to read your limits.
- GitHub, through the gh CLI you signed in to, to read your pull requests and their checks and to merge one when you ask.
- Maestri Wire on your local network, and only after you pair it.
- https://dl.thesidelong.app/latest.json, a small static file, to see whether a newer version of Sidelong exists. The request carries no identifier we create; like any web request it reaches our host with your IP address, the time and the app's version, and those server logs serve only to operate and protect the download.
- https://license.thesidelong.app, our own licence server, when you activate a key, when the app revalidates it about every 30 days, and when you release a Mac. The request contains your licence key and the name of your Mac, and nothing else.
The website: analytics and cookies
thesidelong.app is a static site served by Vercel, our hosting provider, which keeps the usual request logs — IP address, time, page, user agent — to serve and protect the site.
With your permission, the site also loads Google Analytics 4. It sets cookies and identifiers in your browser and reports, in aggregate, which pages people read and where they arrived from. We configure it with IP anonymisation switched on. We use it to find out whether the site explains the product, not to follow you around the web: there are no advertising pixels, and we neither sell nor share this data.
- Pages viewed, how long they were open, and the link or search that brought you.
- Approximate location derived from the anonymised IP address, usually country and region.
- Browser, operating system and screen size.
- Two events we send ourselves: a click on a download button, with the place on the page it was clicked, and a purchase on the thank-you page, with the order reference that comes back in the URL after checkout.
Your choices on the website
Analytics does not load until you allow it. The first time you arrive a banner asks, and nothing is measured — no analytics cookie is set at all — until you answer. Declining changes nothing about how the site works.
You can change your mind whenever you like: “Cookies”, in the footer of every page, brings the question back. Declining also switches off the analytics already running on the page you are on and deletes the cookies it had set. A content blocker or the Google Analytics opt-out add-on stops it too.
Fonts are served from our own domain, so opening the site does not call Google Fonts. Checkout happens on a Stripe page rather than on ours, and the cookies Stripe sets there are described in its own privacy notice.
Buying: what Stripe handles and what we keep
Checkout runs on a Stripe page, not on ours. Stripe is our payment processor: it handles the card or wallet details you type there on our instructions, as a processor and not as a seller. We never see a full card number, and none ever reaches a server of ours.
From the order we receive what we need in order to serve you: your email address, the order reference and the amount, which we hold next to the licence key our own server generates. We send that key to you through Resend, our email provider. The rest lets us resend a key when you ask, handle a refund and keep our accounting records. What Stripe does with the payment data it holds is covered by its own privacy notice, linked from the checkout.
Email
When you write to hello@thesidelong.app, we keep your message and our reply for as long as the matter is open and for a reasonable period afterwards, so that a conversation can be picked up where it stopped. We do not add you to a mailing list: Sidelong has no newsletter.
How long we keep things
Different things, different clocks.
- Analytics: for the retention period configured on our Google Analytics property. We keep no separate copy.
- Order records: for as long as accounting law requires. We hold the order reference and your email address; the payment data stays with Stripe.
- Licence records: while the licence exists, so that a key can be resent or a Mac released.
- Server logs, for the site, the update manifest and the licence server: a short operational period, then discarded.
- Everything the app reads on your Mac: for as long as you keep it there. It never reaches us.
Who else sees any of it
Five companies, each doing one job, and each of them a processor acting on our instructions. We do not sell personal data, we do not share it for advertising, and nobody buys a list from us. We disclose anything else only when the law compels us.
- Stripe, which processes the payment.
- Cloudflare, which runs our licence server and serves the download (license.thesidelong.app, dl.thesidelong.app).
- Resend, which sends the email carrying your licence key.
- Google, for Google Analytics on the website, and only once you have allowed it.
- Vercel, which hosts and serves the website.
Where your data goes
Sidelong is run from Portugal. The processors listed above operate servers in the United States and in other countries, so some of this data leaves the European Economic Area. When it does, they rely on the European Commission's standard contractual clauses or an equivalent mechanism.
Your rights
Depending on where you live, you can ask to see the personal data we hold, to correct it, to delete it, to receive a copy in a portable form, or to object to our using it. The GDPR, the UK GDPR, the LGPD and the California privacy laws each give some version of this.
Write to hello@thesidelong.app and we answer within 30 days. If our answer does not satisfy you, you can complain to the data protection authority where you live, or to the Portuguese one, the Comissão Nacional de Proteção de Dados (CNPD).
Children
Sidelong is a developer tool for adults. It is not directed at children, and we do not knowingly collect data from anyone under 16.
Changes to this policy
When this policy changes we replace this page and update the date at the top. A change that materially affects you is announced in the changelog as well.
Contact
hello@thesidelong.app. That address reaches the people who make Sidelong, and it is the right one for a privacy question as much as for a bug.