Privacy Policy

Last updated: 13 October 2026

Solace is a macOS menu bar application built by THEODOREHQ. The data controller for the purposes of the UK GDPR and the Data Protection Act 2018 is:

TJH/CO LIMITED (trading as THEODOREHQ)
A company registered in England and Wales
Company number: 16589593
Registered office:
c/o Fairway House Links Business, Fortran Rd, St Mellons, Cardiff CF3 0LT, United Kingdom
Email: support@theodorehq.com

Given the small scale and low-risk nature of our processing, we are not required to appoint a Data Protection Officer and have not done so. For any data question, contact us at the email above.

This policy explains what data Solace collects (very little), the lawful basis for each processing activity, and how to exercise your rights.

The short version

Solace has no user accounts, no analytics in the app, no telemetry, and no tracking, and we never receive your location. The app makes a small number of network requests, all listed below. Your settings stay on your Mac.

Network requests

Solace has no analytics SDK and no crash reporter, and it sends us no information about how you use it. These are the only network requests the app makes:

• Licence checks (Polar). If you have activated a licence key, Solace checks it with Polar, our payment provider, each time the app opens. The check sends your licence key. When you first activate, Polar also receives your Mac's name (as shown in System Settings > General > About) so it can count your activations. See "Purchase data and email" below.
• Update checks. Solace checks for updates automatically about once an hour by downloading a small file from our website. The request carries the app's version number and, like visiting any website, shares your IP address with our web host. The app has no setting to switch this off.
• City name (Apple). Whenever Solace finds your location, your Mac asks Apple to turn your coordinates into a city name to show in the app. This is between your Mac and Apple, and we never receive it.
• Weather (Apple WeatherKit). Only if you turn on weather-aware switching, Solace sends your approximate location to Apple's WeatherKit to get the forecast.
• Setapp. If you use Solace through Setapp, the app tells Setapp's own framework when it is used so that Setapp can pay us. Setapp's privacy policy covers what it collects. The Setapp version has no licence check or update check of its own.

Location data

Solace uses macOS CoreLocation to determine your approximate position for sunrise, sunset, and weather calculations. We never receive your location: your Mac works out sunrise and sunset itself, and asks Apple for your city name (and, if you turn on weather, the forecast) as described above.

The legal basis for processing your location data under GDPR Article 6(1)(a) is your explicit consent, which you provide by granting location access in macOS System Settings. You may withdraw this consent at any time in System Settings > Privacy & Security > Location Services.

Apple WeatherKit and city lookup

If you enable weather-aware switching, Solace sends your approximate location to Apple's WeatherKit API to retrieve the forecast. Separately, with or without weather switched on, your Mac asks Apple to turn your coordinates into a city name. Both requests are handled by Apple and are governed by Apple's Privacy Policy. THEODOREHQ does not receive, log, or store any data from these requests.

Purchase data and email

When you buy Solace, Polar.sh is the Merchant of Record and seller of record for your purchase. For the data it collects at its own checkout (your email, country, and payment and tax details), Polar acts as a separate, independent controller under its own terms; for anything it handles purely on our behalf it acts as our processor. Polar uses Stripe as its payment processor, and we never receive your card details. See Polar's privacy policy and data-processing addendum.

Polar then passes us a limited amount of data so we can deliver and support your purchase (under UK GDPR Article 14, the source of this data is Polar):

• Email address: used to deliver your licence key. Lawful basis: contractual necessity (UK GDPR Article 6(1)(b)).
• Country of purchase: used for VAT / sales tax accounting handled by Polar. Lawful basis: legal obligation (UK GDPR Article 6(1)(c)).
• Licence-activation log (timestamp, activation count, your Mac's name as shown in System Settings > General > About): held by Polar and used to enforce the three-device activation limit. Lawful basis: contractual necessity (UK GDPR Article 6(1)(b)).

We will never share your email address with third parties for their marketing purposes, and we will never use your email address to market unrelated third-party products or services.

Marketing emails

When you buy, you can tick an optional box to get the THEODORE HQ newsletter. It is unticked unless you tick it. You can also sign up on our website. Our lawful basis is your consent (UK GDPR Article 6(1)(a)). Because Polar is the Merchant of Record that collects your email, we rely on consent rather than the PECR "soft opt-in".

You can unsubscribe at any time by replying to any of our emails, and every newsletter includes an unsubscribe link. Withdrawing consent (Article 7(3)) does not affect the lawfulness of earlier emails. You also have an absolute right to object to direct marketing (UK GDPR Article 21(2)); if you object, we will stop sending marketing emails without delay.

How to unsubscribe

You only receive the newsletter if you tick the box at checkout or sign up on our website. You can withdraw that consent at any time by:

• Clicking the unsubscribe link included in every newsletter
• Replying to any of our emails, or emailing support@theodorehq.com, with the subject line "Unsubscribe"

Unsubscribing will not affect transactional emails related to your purchase or licence key.

Data retention

We retain personal data only for as long as we have a lawful basis to do so:

• Purchase email and licence record: held by Polar (our merchant of record) and by us for as long as your licence is active, and for seven years after your last purchase, in line with HMRC record-keeping requirements (Value Added Tax Act 1994, Schedule 11; Finance Act 2008, Schedule 36).
• Marketing list subscription: until you unsubscribe, after which your email is removed from the marketing list within 30 days. We retain a suppression record indefinitely so that we do not contact you again.
• Licence-activation logs: 12 months from the most recent activation event.
• Support emails: two years after the last reply, longer where a specific issue requires it. Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) in answering your enquiry and supporting your purchase.

Website analytics

To understand which pages people find useful, this website uses Umami, a privacy-friendly analytics tool we self-host on our own server at analytics.theodorehq.com. (The Solace app itself contains no analytics of any kind; this is the website only.)

Umami records aggregate, non-identifying information: the page URL, title and referrer, the country your visit came from (derived from your IP address, which is then immediately discarded and never stored), and your browser, operating system, device type and screen size. It sets no cookies, does not fingerprint your device, does not follow you across other websites, and shares nothing with any third party. We cannot identify you from it.

Lawful basis: under PECR (as amended by the Data (Use and Access) Act 2025), this aggregate, cookieless analytics falls within the "statistical purposes" exception, which requires us to tell you about it and to give you a simple, free way to opt out (both done here). The brief processing of your IP address to derive a country relies on our legitimate interests (UK GDPR Article 6(1)(f)) in understanding aggregate traffic without identifying you. Retention: aggregate figures indefinitely; raw event records for twelve months.

To opt out, use the button below (it saves a small flag that tells Umami to ignore this browser on this site permanently). Any standard content blocker (uBlock Origin, Ghostery, Brave's shields) also blocks it automatically.

Cookies and similar storage

No cookies, no third-party trackers, no advertising scripts, no fingerprinting. Our web fonts and analytics are self-hosted (served from our own servers), so loading a page makes no third-party requests. The only exception is Polar's checkout: hovering over or pressing a Buy button connects to Polar.

When you first visit, your browser keeps a small note (in its localStorage, not a cookie) of the page you landed on, the site that sent you, any campaign tags in the link you arrived through and the time of your first visit. If you buy, this note is passed to Polar, our payment provider, with your order so we can see which pages lead to sales. It is never used for advertising. If you turn analytics off with the button on this page, no note is kept or sent, and any note already kept is removed. Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) in understanding how people find Solace. You can also remove it at any time by clearing this site's data in your browser, or by using any standard content blocker.

Support button

Messages sent through the support button on this website are handled by our Support Centre. Posts there are public, and you get an automatic first reply written by AI, then a person follows up. See the Support Centre privacy policy.

Who handles your data, and international transfers

We keep suppliers to a minimum. Where one is based outside the UK, an approved UK transfer safeguard is in place under UK GDPR Chapter V: typically the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses with the UK addendum.

• Polar.sh (United States): the Merchant of Record and seller of record for your purchase. For the data it collects at its own checkout (your email, country, and payment and tax details) Polar acts as a separate, independent controller under its own terms; for anything it handles purely on our behalf it acts as our processor. Polar uses Stripe as its payment processor, and we never receive your card details. See Polar's data-processing addendum and privacy policy.
• Vercel (United States): hosts this website. Vercel is certified under the UK Extension to the EU-US Data Privacy Framework, and its data-processing agreement also incorporates the UK International Data Transfer Agreement.
• Apple iCloud: runs our support@theodorehq.com mailbox. For UK and EU users this is controlled by Apple Distribution International Limited in Ireland (within the EEA), with Standard Contractual Clauses for any onward transfer.
• Missive: the email app we use to read and answer support email.
• Apple Inc. (city lookup and WeatherKit): your Mac asks Apple to turn your coordinates into a city name, and, if you enable weather-aware switching, your approximate location is sent to Apple's WeatherKit API, in accordance with Apple's Privacy Policy. We never receive or store any data from these requests.
• Setapp (Setapp version only): reports to its own framework when the app is used, so that Setapp can pay us. Setapp's privacy policy covers what it collects.
• Umami (website analytics): self-hosted on a server we control, so your analytics data is never transferred to a third-party analytics company.

You can ask us for more detail on any of these safeguards at support@theodorehq.com.

Third-party services

The Solace application itself does not integrate with any third-party analytics or advertising services. It contacts only the services listed under "Network requests" above. THEODOREHQ does not sell, share, or use personal information for targeted advertising.

Do Not Track and visitors in the United States

We don't track you across other websites and we don't run advertising, so there is nothing for a Do Not Track signal to switch off. If you are in the United States, including California: we do not sell or share your personal information, and you can ask to see or delete what we hold by emailing support@theodorehq.com.

Data storage and retention

Your settings and preferences are stored locally on your Mac using macOS UserDefaults, and nothing is synced to iCloud or any cloud service. If you have activated a licence, your licence key and activation ID are kept in your Mac's Keychain and the email address from your purchase is kept in the app's preferences. Solace also keeps your last approximate location (to about a kilometre) on your Mac, so it can work out sunrise and sunset the moment it starts, and removes it if you withdraw location access. It also keeps a short record of its own light and dark switches in ~/Library/Logs/Solace, so we can help if something goes wrong; this never leaves your Mac unless you send it to us.

Uninstalling the app does not remove all of this. What can stay behind is the app's preferences file, the licence key and activation ID in the Keychain, and a small record of when your free trial started (kept so that reinstalling does not restart the trial) in ~/Library/Application Support/.thq/ and a second preferences file. To remove everything, first choose Deactivate in the app's About page (this frees the activation and removes the key and email), then quit and delete the app, then delete ~/Library/Preferences/com.th.solace.plist, ~/Library/Preferences/com.theodorehq.solace.state.plist, the .thq folder and ~/Library/Logs/Solace. You can also email support@theodorehq.com and we will delete your purchase records.

Children's privacy

Solace and this website are general-purpose tools and are not directed at children under 13 (the UK age of digital consent under section 9 of the Data Protection Act 2018). We do not knowingly collect any personal data from anyone under 13. If you believe we hold such data in error, email us and we will delete it promptly.

Your rights

Under the UK GDPR, the EU GDPR, the CCPA, and similar privacy regulations, you have the following rights:

• Right of access (UK GDPR Article 15): confirmation of the personal data we hold about you and a copy of it.
• Right to rectification (Article 16): correction of inaccurate personal data.
• Right to erasure (Article 17): deletion of your personal data, subject to retention obligations such as HMRC's seven-year record-keeping requirement.
• Right to restrict processing (Article 18): in defined circumstances such as while the accuracy of the data is being checked.
• Right to data portability (Article 20): to receive data you provided to us in a structured, machine-readable format.
• Right to object (Article 21), including an absolute right to object to direct marketing.
• Right to withdraw consent (Article 7(3)): where we rely on consent (e.g. location access). Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right not to be subject to automated decision-making (Article 22). We do not use any automated decision-making or profiling.

To exercise any of these rights, email support@theodorehq.com. We will respond within 30 days (UK GDPR Article 12(3)). The response is provided free of charge (Article 12(5)).

You may withdraw consent for location access or uninstall the application at any time. If you purchased Solace directly, you may also request deletion of any purchase records by contacting us.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to complain to us directly (a right under section 164A of the Data Protection Act 2018). The easiest way is to email support@theodorehq.com (putting "Privacy complaint" in the subject line gets it to the front of our queue). We will acknowledge your complaint within 30 days, investigate it, and tell you the outcome.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at any time, though we would appreciate the chance to resolve things for you first:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

In the EU, you can find your local data protection authority at edpb.europa.eu.

Changes to this policy

If this policy is updated, the revised version will be posted on this page with a new "Last updated" date at the top. We will not retroactively widen our data collection without notice. For material changes that affect customers' rights or our handling of personal data, we will give existing customers at least 14 days' notice by email before the changes take effect.