Macaron
Legal

Privacy Policy

Last updated 25 October 2026

In plain words

  • Your Mac password never leaves your iPhone. We never see your screen, your files or your commands. Your iPhone talks directly to your Mac over an encrypted SSH connection. No Macaron server sits in between.
  • Your Mac password stays in your iPhone’s Keychain, protected by Face ID. It is only ever sent to your own Mac, over that encrypted connection.
  • The only Macaron server is a small alert service: it receives a heartbeat from your Mac every few minutes so it can warn you if your Mac goes down. It knows a random identifier, a push token, the time of each heartbeat and possibly your Mac’s name.
  • Apple handles your payment. RevenueCat tells the app whether you have paid, using an anonymous ID.
  • No account, no sign-up, no ads, no ad trackers. We never sell your data.

1. Who is responsible

The controller of your personal data is Jean-Sébastien Wallez, Entrepreneur Individuel (a French sole proprietorship), SIREN 852 683 887, 80 impasse Magali, 30000 Nîmes, France (“Macaron”, “we”, “us”). Contact: hello@getmacaron.app.

This policy covers the Macaron iPhone app, the free Macaron companion app for macOS, the “Mac down” alert service and the website getmacaron.app (together, the “Service”). It explains what we process, why, and your rights under the EU General Data Protection Regulation (GDPR) and French law.

2. What stays on your devices

Most of what Macaron touches never reaches us. The following data stays on your iPhone, your Mac and your router, and is exchanged only between them:

  • Your Mac account password. Stored in your iPhone’s Keychain, protected by Face ID. It leaves your iPhone only to be sent to your own Mac over the encrypted SSH connection, for example to unlock FileVault or open your session. We never receive it.
  • Your SSH key. An ed25519 key generated on your iPhone. The private key stays on your iPhone; the public key is written to your Mac when you pair them by QR code.
  • Your screen, files, commands and their output. Remote Control, screen viewing, Terminal commands, Shortcuts, power and app actions travel directly between your iPhone and your Mac, over your home network or through a WireGuard VPN on your own router. We cannot see them.
  • Your router API token and VPN settings. If you let Macaron set up your router’s VPN, the router API token is stored on your Mac (in a file readable only by your user account) and in your iPhone’s Keychain. VPN configuration is exchanged with your router directly.
  • Your Mac’s addresses and settings (local and VPN addresses, paired Mac list, preferences). Stored on your devices.

Because this data is not on our servers, we cannot recover it, hand it over, or delete it for you. You control it: unpairing, deleting the apps and uninstalling the Mac App removes it from your devices. These items are saved with the iOS “this device only” setting: they are never synced to iCloud Keychain and never restored to another device from a backup.

3. What we process, and why

“Mac down” alerts

When alerts are on, the Mac App sends a heartbeat to a small service we run on Cloudflare about every 5 minutes. When heartbeats stop, the service sends a push notification to your iPhone through Apple Push Notification service (APNs).

  • Data: a random identifier for your Mac and your device, your iPhone’s APNs device token, the timestamps of heartbeats, possibly your Mac’s display name (so the alert can say which Mac is down), and the IP address that each request comes from (seen by Cloudflare as part of handling the connection).
  • Purpose: to detect that your Mac has stopped responding and alert you.
  • Legal basis: performance of our contract with you (Article 6(1)(b) GDPR), since alerts are a feature you choose to use.

Purchases

The iPhone app is bought through Apple In-App Purchase. Apple processes your payment and billing details under its own privacy policy; we never see your card or your Apple Account details. We use RevenueCat to check whether you have an active purchase.

  • Data: an anonymous app user ID generated by RevenueCat, your purchase receipts and transaction details (product, date, country, price), and basic technical data RevenueCat needs to process the request (such as device type, OS and app version, IP address).
  • Purpose: to unlock the features you paid for, restore purchases and keep accounting records.
  • Legal basis: performance of our contract (Article 6(1)(b) GDPR) and compliance with our legal accounting obligations (Article 6(1)(c) GDPR).

Support

If you email us, we process your email address, your message and anything you choose to include.

  • Purpose: to answer you.
  • Legal basis: our legitimate interest in replying to your request (Article 6(1)(f) GDPR), or our contract with you when it concerns your purchase.

Please never send us your Mac password, router credentials or keys. We will never ask for them.

Website

The website getmacaron.app has no accounts and no sign-up. Like any website, its hosting provider processes technical data (IP address, browser, pages requested) in server logs to deliver pages and protect against abuse. We may use privacy-friendly, cookieless analytics to count visits in aggregate. We do not use advertising trackers, and we do not set cookies that require consent. If that ever changes, we will update this policy and ask for your consent where the law requires it.

  • Legal basis: our legitimate interest in running a secure website and understanding its audience in aggregate (Article 6(1)(f) GDPR).

Apple diagnostics

If you have chosen to share analytics with app developers in your iPhone or Mac settings, Apple may provide us with anonymized crash reports and usage statistics. This is controlled by you in your Apple settings.

4. What we do not do

  • We do not collect your Mac password, your screen, your files, your commands or their output.
  • We do not require an account, a name or an email address to use Macaron.
  • We do not sell, rent or share your personal data for advertising.
  • We do not use ad networks or cross-app tracking, and we do not build profiles of you.

5. Who processes data for us

We use a small number of service providers (processors) who act on our instructions:

Provider What for Data involved
Apple (Apple Distribution International, Ireland, and Apple Inc., USA) App distribution, In-App Purchase, push notifications (APNs), optional diagnostics Purchase data, APNs device token, notification content
RevenueCat, Inc. (USA) Purchase validation and subscription status Anonymous app user ID, receipts, transaction and technical data
Cloudflare, Inc. (USA, global network) Hosting the “Mac down” alert service Random identifiers, APNs token, heartbeat timestamps, Mac display name, IP address
Vercel Inc. (USA, global network) Hosting the website Server logs (IP address, browser, pages requested)

For payments, Apple acts as the seller of record and processes your payment data as an independent controller under the Apple Privacy Policy.

We may also disclose data if required by law, to protect our rights, or as part of a sale or reorganization of the business, in which case this policy will continue to apply.

6. International transfers

Some providers above are based in the United States or operate global networks, so your data may be processed outside the European Economic Area. Where this happens, transfers rely on the EU-U.S. Data Privacy Framework (for providers certified under it) and/or the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information about these safeguards.

7. How long we keep data

  • Alert data (identifiers, APNs token, Mac display name): kept while alerts are active for your Mac, and deleted within 30 days after you turn alerts off, unpair your Mac or its heartbeats stop for good.
  • Heartbeat timestamps: only the most recent ones are kept, for no more than 30 days.
  • Purchase records: kept by RevenueCat for as long as needed to provide your purchase, and by us as required by French accounting law (up to 10 years for accounting records).
  • Support emails: kept for up to 3 years after our last exchange, then deleted.
  • Website server logs: kept for a short period, no more than 12 months.

8. Security

Macaron is built so that the most sensitive data never reaches us. Your Mac password and SSH private key stay in your iPhone’s Keychain, protected by Face ID; connections to your Mac use SSH, an encrypted protocol, and VPN connections use WireGuard. Communication with our alert service and with RevenueCat uses encrypted HTTPS. We limit the data on our servers to what alerts and purchases strictly need.

No system is perfectly secure. Your own security choices (your iPhone passcode, your Mac password, your router and VPN settings, your backups) matter most. See our Terms of Service for your responsibilities. If we become aware of a personal data breach affecting you, we will notify the CNIL and you as the law requires.

9. Your rights

Under the GDPR, you have the right to:

  • access the personal data we hold about you;
  • have it corrected;
  • have it deleted;
  • restrict or object to its processing (including any processing based on our legitimate interests);
  • receive it in a portable format;
  • withdraw consent at any time, where processing is based on consent;
  • give instructions about what happens to your data after your death (a right under French law).

To exercise these rights, email hello@getmacaron.app. Because Macaron has no accounts, we may ask for details that help us find the right data (for example your Mac’s display name or a purchase receipt). We will reply within one month. You can also delete your alert data yourself by turning off alerts or unpairing your Mac.

You also have the right to lodge a complaint with a supervisory authority, in particular the CNIL (Commission Nationale de l’Informatique et des Libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or the authority of your country of residence.

10. Children

Macaron is not intended for children under 15 and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows the latest version. If a change is significant, we will give notice in the app or on the website before it applies.

12. Contact

Jean-Sébastien Wallez, Entrepreneur Individuel 80 impasse Magali, 30000 Nîmes, France hello@getmacaron.app