Plain-English Privacy

Privacy.

Shiny is built so that we can't spy on you, even if we wanted to. Here's exactly what that means, written to satisfy UK GDPR without losing the plain English.

Last updated: 9 October 2026

✓No telemetry. The direct-download Shiny does not phone home about how you use it. (Through Setapp, see below.)

✓No in-app analytics. The direct-download Shiny collects no usage data. The website uses cookieless, self-hosted analytics: see below.

✓No account. No sign-up, no login, no profile.

✓No cloud. Shiny does not upload your files or data from your Mac. The only requests it makes are the update and licence checks described below.

✓No file access. Shiny doesn't ask for, or have, permission to read your documents, photos, or downloads.

Who is the data controller?

The data controller for any personal data we hold about you is:

TJH/CO LIMITED (trading as THEODORE HQ)
A company registered in England and Wales
Company number: 16589593
Registered office:
Fairway House, Links Business
Fortran Rd, St. Mellons
Cardiff, CF3 0LT
United Kingdom
Email: support@theodorehq.com

We are not required to appoint a Data Protection Officer under Article 37 of the UK GDPR (we are not a public authority, our core activities do not require large-scale regular monitoring of individuals, and we do not process special-category data on a large scale). Email support@theodorehq.com for any data-protection question.

Where your purchase email comes from

When you buy Shiny, your purchase is handled by Polar.sh, our payment and licensing provider and the Merchant of Record (the legal seller of the licence). At its own checkout Polar collects your email address, country of purchase, payment details, billing information and tax/fraud signals, and acts as a separate (independent) controller for that data under its own privacy policy and data-processing addendum. For data Polar handles on our behalf (the licence-key record, activation logs we read from its API), it acts as our processor. Polar in turn uses Stripe as its payment processor, so card details are handled by Stripe and never received by us. We receive your email and country from Polar so we can deliver and verify your licence. (This source-of-data line is required by Article 14 of the UK GDPR, because we obtain the data from Polar rather than from you directly.)

What information does Shiny collect from inside the app?

Nothing about how you use it. The direct-download Shiny runs on your Mac and does not record what you click, when you launch it, which apps it pauses, how much memory it freed, or anything else about how you use it. To spot idle apps it keeps the time you last opened each of up to 200 apps in its own settings on your Mac, and that never leaves your Mac unless you choose to send a crash email (see Crash reports). The only data Shiny sends is the update check and licence check described below.

If you use Shiny through Setapp, the app tells Setapp's own framework when it is used so that Setapp can pay us. Setapp's privacy policy covers what it collects.

Does Shiny make any network requests?

Yes, two kinds in the direct-download version. (The Setapp version makes neither: Setapp handles its updates and licensing.)

About once an hour while Shiny is open, an update check against https://www.theodorehq.com/shiny/appcast.xml. Shiny downloads a small file from our website and, like visiting any website, this shares your IP address with our web host. The request contains your current Shiny version and your macOS version (so we can serve the right update). It does not contain a unique identifier. The request is made by the open-source Sparkle update framework. Updates are signed, and Shiny checks the signature before installing one. Update checks run automatically; Settings has a Check for Updates button but no switch to turn them off.

When you activate or deactivate a Mac, and each time Shiny launches, a license check against Polar's licensing server (api.polar.sh), to verify your purchase. The request contains your license key and an activation ID; activating also sends your Mac's name, so you can see which Macs are using your license. If you are offline, Shiny keeps working for up to 7 days after its last successful check. See "International transfers" below for where this data goes.

What personal data do we hold, and on what lawful basis?

Four categories. We list each one with the lawful basis under Article 6 of the UK GDPR, because the law requires us to.

1Your purchase email and licence-key record. Held so we can deliver and verify your licence. We receive your email from Polar.sh (see above). Lawful basis: contractual necessity (Art 6(1)(b)).

2Newsletter subscription (the same email, used for the THEODORE HQ newsletter). When you buy, you can tick an optional box to get the THEODORE HQ newsletter. It is unticked unless you tick it. You can also sign up on our website. You can unsubscribe at any time by replying to any of our emails, and every newsletter includes an unsubscribe link. Lawful basis: consent (Art 6(1)(a) UK GDPR), given by ticking the box or signing up.

3Licence-activation logs (timestamp, country, IP address from the activation request). Lawful basis: legitimate interests (Art 6(1)(f)) in fraud prevention and licence-abuse detection.

4Support emails you send us. Used only to reply to you and to keep a record of the conversation. Lawful basis: legitimate interests (Art 6(1)(f)) in providing customer support.

How long do we keep your data?

Purchase email and licence record: while your licence is active, plus seven years after your last purchase, for HMRC tax-record requirements (Schedule 11 of the VAT Act 1994 and corresponding income-tax rules).
Newsletter subscription: until you unsubscribe, plus thirty days while we process the unsubscribe.
Licence-activation logs: twelve months from activation, then automatically deleted by Polar.
Support emails: two years, then deleted, unless you ask us to keep them as a reference for an open issue.

Crash reports

Shiny never sends crash reports automatically. If Shiny crashes, the next time you open it you'll see a calm dialog explaining what happened, with a button to read the full report and a button to send it to support. Nothing leaves your Mac unless you choose to send it: you see the entire report first, and the email goes out from your own mail client so you remain in control of the message.

A crash email contains the time of the crash, Shiny's version, your macOS version, your Mac's hardware model, the type of crash, a short summary, the stack trace (the list of steps in the code that led to the crash) and the last 100 lines of Shiny's own activity log.

If macOS itself shows a separate "Send to Apple" dialog after a crash, that's Apple's standard system, not us, and you control it in System Settings → Privacy & Security → Analytics & Improvements.

Cookies and local storage on this website

No cookies. No third-party trackers. No advertising scripts. No fingerprinting. Our web fonts are self-hosted (served from this site), so loading a page makes no third-party requests at all. The one exception is the Buy button: when you point at it or press it, your browser loads the Polar checkout script from jsDelivr (see below). We do not show a cookie banner because we do not set cookies and the small bits of local storage we use fall under the exceptions described below.

A few small things are stored locally in your browser's localStorage, only on your own machine:

Your light/dark theme preference (key: shiny-theme-cache). Purely functional. Stored under the PECR "appearance" exception (Reg 6(3)(c), as amended by the Data (Use and Access) Act 2025) for storage that adapts the site to a user-selected preference. Clearing your browser's site data removes it.
A first-visit note (keys: ta_landing, ta_first_at, and, if you arrive with UTM tags in the URL, ta_source, ta_medium, ta_campaign, ta_term, ta_content, ta_ref). When you first visit, your browser keeps a small note of the page you landed on, the site that sent you and any campaign tags. If you buy, this note is passed to Polar, our payment provider, with your order so we can see which pages lead to sales. It is never used for advertising. If you turn analytics off with the button on this page, no note is kept or sent. It is not a cookie, and it is not used to track you across other websites. Storage basis: PECR "statistical purposes" exception (Reg 6(3)(d), DUAA 2025). UK GDPR basis for the data itself: legitimate interests (Art 6(1)(f)) in understanding aggregate attribution.

Umami, our website analytics (described below), is cookieless and stores nothing on your device by default. It writes a single umami.disabled key only if you opt out (see the button below).

Both the appearance and statistical-purposes exceptions require us to give you a simple, free way to object. You can use the button below at any time, or clear this site's data in your browser, or use any standard content blocker (uBlock Origin, Ghostery, Brave's built-in shields all block our analytics by default).

Website analytics (Umami)

We use Umami, a privacy-friendly analytics tool we self-host on our own server at analytics.theodorehq.com. The server is located in Manchester, United Kingdom, so no international transfer is involved. We installed it in May 2026 to understand which pages people read so we can write better articles and improve what we publish.

Umami records: page URL, page title, page referrer, country (derived from your IP, then immediately discarded), browser, operating system, device type, and screen size. It does not set cookies, does not fingerprint your device, does not follow you across other websites, and shares nothing with any third party. The analytics server is run by us alone.

Storage basis (PECR): the "statistical purposes" exception (Reg 6(3)(d), as amended by the Data (Use and Access) Act 2025), because the access is solely to compile aggregate statistics about how people use this site. We give you a simple, free way to opt out (the button in the section above) as that exception requires. UK GDPR basis for the brief IP-to-country step before the IP is discarded: legitimate interests (Art 6(1)(f)). Retention: aggregate figures kept indefinitely; raw event records for twelve months.

Do Not Track and US visitors

We don't track you across other websites and we don't run advertising, so there is nothing for a Do Not Track signal to switch off. If you are in the United States, including California: we do not sell or share your personal information, and you can ask to see or delete what we hold by emailing support@theodorehq.com.

The support button on this site

Messages sent through the support button on this site are posted publicly on our Support Centre, and you get an automatic first reply, then a person follows up. See the Support Centre privacy policy for how that works.

Who handles your data, and international transfers

We keep suppliers to a minimum. Where one is based outside the UK, an approved UK transfer safeguard is in place:

Polar.sh (United States) is our payment and licensing provider and the Merchant of Record (the legal seller) for your purchase. At its own checkout it acts as a separate controller for the data it collects there (email, country, payment, billing, tax/fraud); for data it handles on our behalf via its API (your licence-key record, activation logs) it acts as our processor. Polar uses Stripe (United States) as its payment processor; we never receive your card details. See Polar's data-processing addendum and privacy policy.
Vercel (United States) hosts this website. Vercel is certified under the UK Extension to the EU-US Data Privacy Framework, and its data-processing agreement also incorporates the UK International Data Transfer Agreement (IDTA).
Apple iCloud runs our support@theodorehq.com mailbox. For UK and EU users this is controlled by Apple Distribution International Limited in Ireland (within the EEA), with Standard Contractual Clauses for any onward transfer outside the EEA.
Missive is the email app we use to read and reply to messages sent to support@theodorehq.com, including crash emails you choose to send. Those messages pass through Missive's servers. See Missive's privacy policy.
jsDelivr is a public content delivery network that serves the Polar checkout script when you point at or press the Buy button. Your IP address is visible to it, as with any file you load from another site. See jsDelivr's privacy policy.
Website analytics is self-hosted on a server we run ourselves (Umami) in Manchester, United Kingdom, so your analytics data is never shared with a third-party analytics company and never leaves the UK.

You can ask us for more detail on any of these safeguards at support@theodorehq.com.

Your rights under UK GDPR

You have the following rights with respect to the personal data we hold about you:

Right of access: ask us for a copy of the data we hold (Art 15).
Right to rectification: correct any data that is inaccurate (Art 16).
Right to erasure: ask us to delete your data, subject to our HMRC retention obligation above (Art 17).
Right to restrict processing: pause our processing while a dispute is resolved (Art 18).
Right to data portability: receive your data in a structured, common format (Art 20).
Right to object: object to processing based on legitimate interests, including direct marketing (Art 21).
Right to withdraw consent: for the newsletter, at any time, via the unsubscribe link or by emailing us (Art 7(3)).
Right not to be subject to automated decision-making: we do not make any such decisions about you (Art 22).

To exercise any of these rights, email support@theodorehq.com. We respond within thirty days, free of charge.

Complaints

You have the right under section 164A of the Data Protection Act 2018 (inserted by the Data (Use and Access) Act 2025) to complain to us directly about how we have handled your personal data. The simplest electronic route is to email support@theodorehq.com. Tip to reach us fast: include the words "Privacy complaint" in the subject line. We flag every email containing that phrase so it goes to the front of the queue. We will:

Acknowledge your complaint within 30 days of receiving it,
Investigate it without undue delay, and
Tell you the outcome, in writing, with our reasoning.

You also have the right to complain to the UK Information Commissioner's Office (ICO), the independent supervisory authority:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

You can contact the ICO at any time, though we would appreciate the chance to investigate first.

Children

Shiny is not directed at children under 13 (the UK age of digital consent under section 9 of the Data Protection Act 2018). We do not knowingly collect any personal data from anyone under 13. If you believe we hold such data in error, email us and we will delete it promptly.

Changes to this policy

If we ever change this policy, we'll update the date at the top, and email anyone on the customer list a plain-English summary of what changed at least fourteen days before the changes take effect. We will not retroactively start collecting more from existing users without telling them first.

Contact

Questions, concerns, or anything that smells off: support@theodorehq.com. A real human (Theodore) reads every email.