We can’t see your files.

We built Smol because the existing tools quietly inverted the deal: you got a service, they got your files. We didn’t want to run that business, so we built one that runs entirely on your Mac. Everything below follows from these four rules:

• Your files never leave your Mac. Compression happens locally. The Smol app does not upload your images, PDFs, or videos to any server, ever — not anonymized, not “temporarily,” not for “analytics.”
• We collect the minimum data to sell you software. Your email address, your license key, your purchase receipt. The whole list is on this page.
• The app never tracks you. No telemetry, no phone-home, no usage analytics inside the Smol app — ever. The marketing website is more conventional: it runs Google Analytics and the Meta and X advertising pixels so we can see how people find us and whether our ads work. We name each one, and exactly what it receives, in §03 and §05.
• We don’t sell, rent, or share your data. The only people we share data with are the companies who help us run the business (Stripe for payments, our email provider for receipts). The complete list is in §05.

Here’s the entire list, organized by when we collect it. If it’s not on this list, we don’t have it.

smolmac.com is a static website hosted on Cloudflare Pages. We use Google Analytics for traffic measurement and two advertising pixels (Meta and X) for ad-conversion measurement. There is no session-replay tool and no third-party fonts that phone home.

Cloudflare automatically logs the IP address, user-agent, and request path for every visit to the site. We do not access these logs except for debugging or security incidents. They are kept for a short period and then deleted by Cloudflare. Cloudflare’s privacy policy →

Google Analytics 4. Every page loads Google Analytics (gtag.js, measurement ID G-S9QNKKTS58). It records page views, the pages you move through, approximate location derived from your (Google-truncated) IP address, device and browser type, and the ecommerce steps you take on checkout — viewing a plan, starting checkout, and completing a purchase, including the plan and amount. To make sure a completed purchase is counted even if your browser blocks analytics, our server also reports that one purchase event to Google directly (the Measurement Protocol), using the plan, the amount, and the same anonymous analytics ID — never your email. We use all of this to understand traffic and improve the site, and Google may set its own cookies. Google processes this under its own terms; you can opt out site-wide with Google’s opt-out browser add-on →

Meta (Facebook) pixel. Every page also loads the Meta pixel, backed by Meta’s Conversions API on our server. It reports page views site-wide and the same checkout and purchase events, so we can measure whether our ads lead to sales. At the purchase step it sends the plan, the price, and a hashed (not plain-text) version of your email. Meta may set cookies and use this data under its own policy. You can manage this in Meta’s ad preferences →

X (Twitter) conversion pixel. The checkout pages (/buy and /buy/success) load the X pixel. It fires three events: when you view the checkout page, when you complete your payment details, and when your purchase is confirmed. At the purchase step it sends the plan you bought, the price, and your email address to X so we can measure whether our ads on X lead to sales. X may set cookies for this purpose. If you arrived at this site organically and not from an X ad, the pixel still loads but has nothing to attribute. You can opt out via X’s ad settings →

Google Analytics and the Meta pixel set cookies (and read the first-party identifiers our edge sets) across the whole site; the X pixel and Stripe add their own cookies on the checkout pages. There is still no login, no newsletter form, and no comment system.

The Smol app makes exactly three kinds of network requests during normal operation. We’ll describe each one.

1 — License validation

On first launch (and then once a week thereafter), the app sends your license key and a hashed identifier of the Mac it’s running on to our license server. The server responds with “valid” or “invalid.” That’s the entire conversation. If the app can’t reach the server, it keeps running offline for up to 30 days.

2 — Update checks

The app checks for updates by fetching a small JSON file from our update server. The request includes your current app version and macOS version so we send you the right build. We do not log who asked.

3 — Crash reports (opt-in)

If you check “Send anonymous crash reports” in Preferences, the app sends us a stack trace when it crashes. We strip filenames, file paths, and anything that could identify the file you were working on. The setting is off by default.

Running a software business requires a few outside vendors. Here are all of them and what data they receive:

• Stripe — processes your payment. Receives your card details, billing address, email, and purchase amount. We see only the summary they return. Stripe’s privacy policy →
• Cloudflare — hosts the website and the license-validation server. Receives request data (IP, user-agent, path). Used for delivery and abuse prevention. Cloudflare’s privacy policy →
• Resend — sends you your license key and receipt. Receives your email address and the contents of the email we’re sending you. We do not run marketing campaigns through this provider. Resend’s privacy policy →
• X Corp (Twitter) — conversion pixel on checkout pages only. Receives: the plan you selected, the purchase price, and your email address at the moment your purchase is confirmed. Used solely to measure whether our ads on X lead to purchases. X may use this data under their own privacy policy. X’s privacy policy →
• Google (Analytics) — Google Analytics 4 runs on every page. Receives: page views, the pages you visit, approximate location from your IP, device and browser data, and checkout/purchase events (the plan and amount) — from your browser, and for a completed purchase also from our server (the Measurement Protocol), never including your email. Used to measure traffic and improve the site. Google processes it under its own terms. Google’s privacy policy →
• Meta (Facebook) — conversion pixel plus Conversions API on every page. Receives: page views site-wide, and at the purchase step the plan, the price, and a hashed version of your email. Used solely to measure whether our ads on Meta lead to purchases. Meta uses this data under its own privacy policy. Meta’s privacy policy →

That’s the entire list. If we ever add a vendor, we update this page first — the version number at the top of the page changes and we mark the change in §11.

• Purchase records and receipts: 7 years. We’re required to keep these for tax purposes.
• Your license key: as long as your license is valid. If you ask us to delete your account, we mark the key revoked and remove the personally identifiable parts of the record.
• Crash reports: 90 days, then deleted.
• Server logs: Cloudflare’s defaults — days, not months.
• Email correspondence with support: 2 years, so we have context if you write again.

Whether or not the law requires it where you live, you can do all of the following by emailing us at hi@smolmac.com. No special forms, no friction, no “please verify your identity by uploading your passport.” Just write to us from the email address on the purchase.

• Get a copy of your data. We’ll send back everything we hold about you, usually within 7 days.
• Correct your data. Change of email, wrong spelling on the receipt — just ask.
• Delete your data. We’ll delete the record and revoke the license. If we’re legally required to keep parts of it (taxes), we’ll explain what stays and why.
• Object or restrict processing. Tell us what you’d like us to stop doing and we’ll figure out how.
• Take your data with you. We can export your records as JSON or CSV.
• Complain to a regulator. If you’re in the EU or UK, you can file with your local data-protection authority. We’d rather you write to us first so we can fix it, but it’s your call.

We don’t charge for any of this. We don’t make you jump through automated forms. A human reads your email.

Smol is a paid productivity tool for grown-ups. It’s not directed at children under 13 (or under 16 in the EU). We don’t knowingly collect data from anyone in that age range. If you’re a parent or guardian who believes we’ve received data from your child, email us at hi@smolmac.com and we’ll delete it immediately.

• In transit: everything goes over HTTPS / TLS 1.3.
• At rest: our databases are encrypted at rest with AES-256.
• Card data: never touches our servers. Stripe handles it under their PCI-DSS Level 1 certification.
• Access: only the founders have access to customer records. There’s no team yet.
• Backups: encrypted, geographically separate, tested.

No system is perfectly secure. If we ever discover a breach affecting you, we will tell you directly — not via a press release — within 72 hours of becoming aware, with a clear explanation of what happened, what was exposed, and what we’re doing about it.

Customer records live on infrastructure in San Francisco, California and on Cloudflare’s global edge. Stripe and Resend operate globally and may process data in the United States, Europe, or other regions. By buying Smol, you understand that your data may be transferred to and processed in countries other than your own, including the United States. We rely on standard contractual clauses with all vendors for these transfers.

We’ll change this policy as the business changes. When we do:

• The version number and the “Last updated” date at the top of this page change.
• We’ll publish a one-line changelog at the bottom of this section so you can see what moved.
• For material changes (new vendor, new category of data, new purpose), we’ll email everyone with an active license at least 30 days before the change takes effect.

Changelog

• v1.3 — June 20, 2026 — Noted that a completed purchase is also reported to Google Analytics server-side (Measurement Protocol) as a backstop — plan and amount only, never your email — in §03 and §05.
• v1.2 — June 20, 2026 — Added Google Analytics 4 disclosure and documented the Meta (Facebook) pixel + Conversions API in §01, §03, and §05; corrected the summary and §03 to reflect site-wide analytics and cookies.
• v1.1 — May 17, 2026 — Added X (Twitter) conversion pixel disclosure in §01, §03, and §05.
• v1.0 — May 13, 2026 — Initial policy.

Smol is operated by an indie team based in San Francisco, California. If you need a postal address for legal correspondence, email us first and we’ll send it.

For anything privacy-related — access, deletion, questions, weirdness — write to:

hi@smolmac.com