App Privacy Policy
This App Privacy Policy covers only the ChocolateBar app for macOS: what it does with data on your Mac and the requests it makes to the internet. It does not cover the chocolatebar.app website, checkout, or email. Those are covered by the separate Website Privacy Notice.
ChocolateBar is a local-first Mac app. It is built so that the app itself collects no personal data and sends nothing about how you use it. The only data the app sends is the limited technical data any internet request necessarily exposes when it checks for an update, plus your license key if you choose to download one, as described below.
Who We Are
ChocolateBar is operated as a sole proprietorship by Aloysius Lim (“we”, “us”), who is the data controller responsible for the personal data described in this policy. For any privacy question or to exercise your rights, contact us at [email protected].
The App: No Usage Tracking
The ChocolateBar app contains no telemetry, no analytics, no crash reporting, and no account system. The only time it contacts the internet is to check for an update, which we describe below. To render the strip below your menu bar, the app reads your existing macOS menu bar items and, if you turn it on, lists your running apps, one chip per app. All of this is processed on your Mac. To speed up redraws, the app caches app icons, any custom icons you choose, and a snapshot of each app’s menu contents on disk under ~/Library/Application Support/ChocolateBar. Nothing in that cache is ever transmitted to us, written to our servers, or shared with anyone.
Update Checks
Automatic update checks are off by default. If you do nothing, the app contacts our servers only when you press “Check for Updates”. If you turn on automatic checks in Settings, the app also checks once on launch, at most once per day. Either way, a check is an ordinary web request to ChocolateBar’s servers for a small public version file, and like any web request it necessarily reveals your device’s IP address and the app version you are running. We use this only to return the latest version number and do not build profiles from it. The lawful basis is our legitimate interest in delivering security and bug-fix updates (GDPR Art. 6(1)(f)).
If an update is available and you choose to download it, the app sends your license key to our payments provider so it can confirm your license is active, confirm the release falls within your license’s update window, and issue a one-time download link. This request also reveals your IP address and, because your license key is linked to the email you purchased with, ties the download to your purchase record. The lawful basis is performance of our contract with you to deliver the software you bought (GDPR Art. 6(1)(b)).
App Permissions
macOS Accessibility is the only permission the app needs. With it, ChocolateBar reads the menu bar and lists windows, and presses or clicks menu bar items when you click a chip. With Reveal turned on, it also synthesizes Command-drags and clicks to pull a hidden item into view. During that synthetic hold it reads key presses only to strip the held Command from keys you type, so a stray Q never becomes Command-Q, and to let Command-Tab through. Keys are never logged or stored. While a revealed item is out, it also watches for Escape so it can tuck the item back. That permission stays on your Mac and is never used to send data anywhere. You may revoke it at any time in System Settings, after which the app stops reading the menu bar and listing windows.
Your Rights
Depending on where you live (for example under the GDPR, UK GDPR, or California’s CCPA), you may have the right to access, correct, export, or delete personal data we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email [email protected] from the address associated with your purchase.
Children
ChocolateBar is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
Security
We use industry-standard practices to protect the limited data we hold, including TLS in transit and access controls. No method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
Changes
We may update this policy from time to time. When we do, the effective date above will change and material changes will be announced on this page. Your continued use after a change means you accept the updatedpolicy.
Contact
Questions or requests about your data? Email [email protected].