Privacy Policy

Last updated: 26 June 2026

Solace is a macOS menu bar application built by THEODOREHQ. The data controller for the purposes of the UK GDPR and the Data Protection Act 2018 is:

TJH/CO LIMITED (trading as THEODOREHQ)
A company registered in England and Wales
Company number: 16589593
Registered office:
c/o Fairway House Links Business, Fortran Rd, St Mellons, Cardiff CF3 0LT, United Kingdom
Email: support@theodorehq.com

Given the small scale and low-risk nature of our processing, we are not required to appoint a Data Protection Officer and have not done so. For any data question, contact us at the email above.

This policy explains what data Solace collects (very little), the lawful basis for each processing activity, and how to exercise your rights.

The short version

Solace does not collect, store, or transmit your personal data. There are no user accounts, no analytics in the app, no telemetry, and no tracking. Your data stays on your Mac.

Data the app collects

None. Solace does not collect any personal information. It does not phone home. It has no analytics SDK, no crash reporter, and no telemetry of any kind.

Location data

Solace uses macOS CoreLocation to determine your approximate position for sunrise, sunset, and weather calculations. This data is processed entirely on your device. Your coordinates are never transmitted to any server operated by the Developer.

The legal basis for processing your location data under GDPR Article 6(1)(a) is your explicit consent, which you provide by granting location access in macOS System Settings. You may withdraw this consent at any time in System Settings > Privacy & Security > Location Services.

Apple WeatherKit

If you enable weather-aware switching, Solace sends your approximate location to Apple's WeatherKit API to retrieve current weather conditions. This request is handled by Apple and is governed by Apple's Privacy Policy. THEODOREHQ does not receive, log, or store any data from these requests.

Purchase data and email

When you buy Solace, Polar.sh is the Merchant of Record and seller of record for your purchase. For the data it collects at its own checkout (your email, country, and payment and tax details), Polar acts as a separate, independent controller under its own terms; for anything it handles purely on our behalf it acts as our processor. Polar uses Stripe as its payment processor, and we never receive your card details. See Polar's privacy policy and data-processing addendum.

Polar then passes us a limited amount of data so we can deliver and support your purchase (under UK GDPR Article 14, the source of this data is Polar):

• Email address — used to deliver your licence key. Lawful basis: contractual necessity (UK GDPR Article 6(1)(b)).
• Country of purchase — used for VAT / sales tax accounting handled by Polar. Lawful basis: legal obligation (UK GDPR Article 6(1)(c)).
• Licence-activation log (timestamp, activation count, device identifier) — held by Polar and used to enforce the three-device activation limit. Lawful basis: contractual necessity (UK GDPR Article 6(1)(b)).

We will never share your email address with third parties for their marketing purposes, and we will never use your email address to market unrelated third-party products or services.

Marketing emails

We may send occasional product update emails: feature announcements, usage tips, and news about Solace and related macOS products we develop. Our lawful basis is your consent (UK GDPR Article 6(1)(a)), which you give by ticking an unticked (never pre-ticked) opt-in box at checkout. Because Polar is the Merchant of Record that collects your email, we rely on consent rather than the PECR "soft opt-in".

Every marketing email contains a one-click unsubscribe link, and you can withdraw consent at any time (Article 7(3)) without affecting the lawfulness of earlier emails. You also have an absolute right to object to direct marketing (UK GDPR Article 21(2)); if you object, we will stop sending marketing emails without delay.

How to unsubscribe

You only receive marketing emails if you opt in at checkout. You can withdraw that consent at any time by:

• Clicking the "Unsubscribe" link included in every marketing email
• Emailing support@theodorehq.com with the subject line "Unsubscribe"

Unsubscribing will not affect transactional emails related to your purchase or licence key.

Data retention

We retain personal data only for as long as we have a lawful basis to do so:

• Purchase email and licence record — held by Polar (our merchant of record) and by us for as long as your licence is active, and for seven years after your last purchase, in line with HMRC record-keeping requirements (Value Added Tax Act 1994, Schedule 11; Finance Act 2008, Schedule 36).
• Marketing list subscription — until you unsubscribe, after which your email is removed from the marketing list within 30 days. We retain a suppression record indefinitely so that we do not contact you again.
• Licence-activation logs — 12 months from the most recent activation event.
• Support emails: two years after the last reply, longer where a specific issue requires it. Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) in answering your enquiry and supporting your purchase.

Website analytics

To understand which pages people find useful, this website uses Umami, a privacy-friendly analytics tool we self-host on our own server at analytics.theodorehq.com. (The Solace app itself contains no analytics of any kind; this is the website only.)

Umami records aggregate, non-identifying information: the page URL, title and referrer, the country your visit came from (derived from your IP address, which is then immediately discarded and never stored), and your browser, operating system, device type and screen size. It sets no cookies, does not fingerprint your device, does not follow you across other websites, and shares nothing with any third party. We cannot identify you from it.

Lawful basis: under PECR (as amended by the Data (Use and Access) Act 2025), this aggregate, cookieless analytics falls within the "statistical purposes" exception, which requires us to tell you about it and to give you a simple, free way to opt out (both done here). The brief processing of your IP address to derive a country relies on our legitimate interests (UK GDPR Article 6(1)(f)) in understanding aggregate traffic without identifying you. Retention: aggregate figures indefinitely; raw event records for twelve months.

To opt out, use the button below (it saves a small flag that tells Umami to ignore this browser on this site permanently). Any standard content blocker (uBlock Origin, Ghostery, Brave's shields) also blocks it automatically.

Cookies and similar storage

No cookies, no third-party trackers, no advertising scripts, no fingerprinting. Our web fonts and analytics are self-hosted (served from our own servers), so loading a page makes no third-party requests at all.

The website does save one small item in your browser's localStorage: a first-touch attribution record, made up of the page you first landed on, the site that referred you, any campaign tags (UTM parameters) in the link you arrived through, and a first-visit timestamp. We use it only to understand which links lead to purchases if you later buy Solace, by passing it to checkout when you click "Buy Now". It is not a cookie, it stays in your own browser, it is never shared with anyone else, and it is not used to track you across other websites. Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) in understanding how people find Solace. You can remove it at any time by clearing this site's data in your browser, or by using any standard content blocker.

Who handles your data, and international transfers

We keep suppliers to a minimum. Where one is based outside the UK, an approved UK transfer safeguard is in place under UK GDPR Chapter V: typically the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses with the UK addendum.

• Polar.sh (United States): the Merchant of Record and seller of record for your purchase. For the data it collects at its own checkout (your email, country, and payment and tax details) Polar acts as a separate, independent controller under its own terms; for anything it handles purely on our behalf it acts as our processor. Polar uses Stripe as its payment processor, and we never receive your card details. See Polar's data-processing addendum and privacy policy.
• Vercel (United States): hosts this website. Vercel is certified under the UK Extension to the EU-US Data Privacy Framework, and its data-processing agreement also incorporates the UK International Data Transfer Agreement.
• Apple iCloud: runs our support@theodorehq.com mailbox. For UK and EU users this is controlled by Apple Distribution International Limited in Ireland (within the EEA), with Standard Contractual Clauses for any onward transfer.
• Apple Inc. (WeatherKit): if you enable weather-aware switching, your approximate location is sent to Apple's WeatherKit API in accordance with Apple's Privacy Policy. We never receive or store any data from these requests.
• Umami (website analytics): self-hosted on a server we control, so your analytics data is never transferred to a third-party analytics company.

You can ask us for more detail on any of these safeguards at support@theodorehq.com.

Third-party services

The Solace application itself does not integrate with any third-party analytics, advertising, or data-processing services. The only external service the app communicates with is Apple WeatherKit, as described above. THEODOREHQ does not sell, share, or use personal information for targeted advertising.

Data storage and retention

All settings and preferences are stored locally on your Mac using macOS UserDefaults. No data is stored on external servers. No data is synced to iCloud or any cloud service.

Solace does not retain any personal data. Settings stored locally on your Mac persist until you uninstall the application or clear them manually. To delete all Solace data, simply uninstall the application.

Children's privacy

Solace is not directed at children. It does not knowingly collect any data from anyone, including children under the age of 13 (or 16 in the EU/UK).

Your rights

Under the UK GDPR, the EU GDPR, the CCPA, and similar privacy regulations, you have the following rights:

• Right of access (UK GDPR Article 15) — confirmation of the personal data we hold about you and a copy of it.
• Right to rectification (Article 16) — correction of inaccurate personal data.
• Right to erasure (Article 17) — deletion of your personal data, subject to retention obligations such as HMRC's seven-year record-keeping requirement.
• Right to restrict processing (Article 18) — in defined circumstances such as while the accuracy of the data is being checked.
• Right to data portability (Article 20) — to receive data you provided to us in a structured, machine-readable format.
• Right to object (Article 21), including an absolute right to object to direct marketing.
• Right to withdraw consent (Article 7(3)) — where we rely on consent (e.g. location access). Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right not to be subject to automated decision-making (Article 22). We do not use any automated decision-making or profiling.

To exercise any of these rights, email support@theodorehq.com. We will respond within 30 days (UK GDPR Article 12(3)). The response is provided free of charge (Article 12(5)).

You may withdraw consent for location access or uninstall the application at any time. If you purchased Solace directly, you may also request deletion of any purchase records by contacting us.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to complain to us directly (a right under section 164A of the Data Protection Act 2018). The easiest way is to email support@theodorehq.com (putting "Privacy complaint" in the subject line gets it to the front of our queue). We will acknowledge your complaint within 30 days, investigate it, and tell you the outcome.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at any time, though we would appreciate the chance to resolve things for you first:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

In the EU, you can find your local data protection authority at edpb.europa.eu.

Changes to this policy

If this policy is updated, the revised version will be posted on this page with a new "Last updated" date at the top. We will not retroactively widen our data collection without notice. For material changes that affect customers' rights or our handling of personal data, we will give existing customers at least 14 days' notice by email before the changes take effect.