Privacy Policy

Last updated 23 October 2026

This policy explains what personal data MacWipe handles, why, and what you can do about it. The short version: the files MacWipe scans never leave your Mac. We hold only what we need to sell you a subscription, keep your licence working and answer your emails.

Who we are

MacWipe is a trading name of Selfound Ltd, a company registered in England and Wales with company number 16450921. Our registered office is Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.

Selfound Ltd is the data controller for the personal data described here, and is registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC275470. For anything about privacy, write to privacy@macwipe.com.

What stays on your Mac

MacWipe scans your Mac to find space it can recover. The scan results, the list of files, what you choose to remove, the history of past cleans and your settings are kept in a database on your Mac. None of it is sent to us or to anyone else, in either edition of the app. The app contains no analytics, advertising or crash-reporting software.

On Macs with Apple Intelligence, MacWipe can explain the items that open when you log in. It uses Apple's on-device model, so those details stay on your Mac too.

The two editions of MacWipe

Mac App Store edition

The App Store edition has no server of its own and makes no network connections to us. If you subscribe, the purchase is handled entirely by Apple: Apple processes your payment, and the app asks Apple, on your Mac, whether your subscription is active. Apple does not give us your name, email or payment details. Apple's own privacy policy covers that purchase.

Direct edition (downloaded from macwipe.com)

The Direct edition is bought on macwipe.com and needs a licence. To activate and keep its licence current, the app talks to our server:

when you activate, it sends your licence key (or the email you sign in with), a hashed device id, the name of your Mac and the app version;
about once a day while you use it, it checks in to refresh its licence, sending the same hashed device id;
when you release a Mac, it tells the server so the key is free again;
it checks macwipe.com for app updates. The check asks only for the latest version; it doesn't send a profile of your Mac.

The device id is made on your Mac from its hardware identifier combined with a MacWipe-specific value, then hashed with SHA-256. Only the hashed result is sent. We never receive your Mac's hardware UUID or serial number, and the hash can't be used to recover them.

What we hold about you

If you use macwipe.com or the Direct edition, we may hold:

Account details: your email address, and the date you signed up. Anyone can create an account by signing in with an emailed link; there is no password.
Purchase references: the Stripe customer id and subscription id for your purchase, your plan, its status and renewal date, and Stripe's notifications about it (for example, that a payment succeeded or was refunded). We use these ids only to match your purchase to your account.
Licence and Mac details: your licence keys (stored hashed for look-up, and encrypted so we can show them to you on your Account page), and for each activated Mac its hashed device id, its name, the app version and the times it last checked in.
Sign-in links and codes: stored hashed, single use, and valid for 15 minutes.
Support messages: what you send us through the support form or by email, and our replies.
Blog comments: comments you post on the MacWipe blog. They are shown publicly with only the first letter of your email address; your full email is never shown.
IP addresses: held briefly in memory to limit repeated requests (for example, too many sign-in attempts), and recorded in our server logs. To count how often each blog post is read, we store a salted hash of your IP address rather than the address itself, so the stored value can't be turned back into your address.
A record of admin actions: if we change anything on your account (such as resetting a key or refunding a payment), we keep a log of what was done and when.

Payments: Stripe is the merchant of record

Subscriptions bought on macwipe.com are sold through Stripe. Stripe is the merchant of record: it resells MacWipe to you, takes your payment, and handles tax, receipts and invoices. Your card and billing details are collected and held by Stripe, and Stripe's own privacy policy governs them. We never see or store your card number.

Stripe tells us the outcome of your purchase (for example, which plan you chose and whether the subscription is active) and the email address used at checkout.

Who processes data for us

We use a small number of service providers. Each only handles data to provide its service to us:

Stripe: checkout, payments, tax, receipts and the billing portal.
Mailgun (servers in the United States): sending our emails (sign-in links, your licence keys, key reset confirmations, and messages sent through the support form).
Hetzner (servers in Helsinki, Finland): hosts the server and database that run macwipe.com.
Cloudflare: answers the DNS look-ups that point browsers to macwipe.com. Your visits go straight to our server, not through Cloudflare. On the support page, Cloudflare Turnstile checks that the form is sent by a person: it sees your IP address and browser details. Cloudflare R2 stores our app downloads, blog images and database backups.
Slack: when you send the support form, your name, email address and message are posted to our team's Slack so we see it quickly.
Apple: sells and manages App Store subscriptions, as described above.

Some of this data is processed outside the UK. Finland is covered by the UK's adequacy regulations for the European Economic Area. For transfers to the United States we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the UK International Data Transfer Addendum to the provider's standard contractual clauses.

We don't sell your data, share it with advertisers, or use it to build advertising profiles.

Why we use your data (lawful bases)

To provide what you asked for (contract): your account, sign-in, licence keys, activating and refreshing your Macs, and support.
Our legitimate interests: keeping the service secure and preventing abuse (rate limits, logs, the support form's Turnstile check, enforcing the three-Mac limit), moderating blog comments, and counting blog post views. We have weighed these against your privacy and kept the data to a minimum.
Legal obligations: keeping records we are required to keep, such as business and accounting records.

How long we keep it

Your account and its purchase references are kept until you ask us to delete it. If you have an active subscription, cancel it first in the billing portal.
Activated Macs that haven't checked in for 180 days are removed automatically, which also frees their key.
Sign-in links and codes expire after 15 minutes.
IP addresses used for rate limiting are kept only in memory and are gone within two hours.
Server logs are kept in a rolling log of limited size, which is overwritten as new entries arrive. We don't archive them.
Database backups are kept for 30 days, so deleted data disappears from backups within 30 days.
Support messages are kept for two years after our last message with you.
Purchase records: when you delete your account, we keep a minimal record of past purchases (dates, plans, amounts and Stripe references) for six years, because UK law requires us to keep accounting records. Stripe keeps its own records as merchant of record.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you can ask us to:

give you a copy of the personal data we hold about you;
correct anything that is wrong;
delete your data;
restrict or object to how we use it;
send your data to you or another service in a portable format.

If you live in the European Union, you have the same rights under the EU GDPR.

Write to privacy@macwipe.com from the email address on your account. We will reply within one month. There is no charge.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113, or, in the EU, to the data protection authority where you live.

Cookies

macwipe.com sets two cookies of its own: a session cookie that keeps you signed in and protects forms from forgery, and, only if you choose "Keep me signed in", a cookie that keeps you signed in on that device for up to 14 days. Both are strictly necessary, so they don't need your consent. We don't use analytics, advertising or tracking cookies, and we don't load third-party trackers.

Stripe sets its own cookies on its checkout and billing pages, under Stripe's policies.

Security

All connections to macwipe.com use HTTPS. Licence keys, sign-in links and codes are stored hashed; licence keys shown on your Account page are also stored encrypted. Requests to sign in and activate are rate limited. No card data reaches our servers. No system is perfectly secure, but if a breach affects your data, we will tell you and the ICO where the law requires it.

Children

MacWipe is not aimed at children, and we don't knowingly collect personal data from anyone under 13. If you think a child has given us their data, write to privacy@macwipe.com and we will delete it.

Changes to this policy

If we change this policy, we will update the date at the top. If a change affects how we use data we already hold, we will email account holders before it takes effect.

Contact

Selfound Ltd, Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.
Email: privacy@macwipe.com