Your files stay on your Mac.

Last updated 28 October 2026. Applies to Shedi 1.2 and shedi.app.

Who I am

Shedi is made by Otabek Abdiraimov, an independent developer in Uzbekistan (LinkedIn). I'm the one responsible for your data under this policy. Questions or requests: support@shedi.app. There is no separate data protection officer.

What the app sends

Three things go online, and you can turn the third off:

• The license check, with Lemon Squeezy. When you activate, and about once a week after that, Shedi sends your license key, an instance id for this Mac, and the instance name "Mac". Not your Mac's real name, and nothing about your files.
• The check for updates. Shedi uses Sparkle to read shedi.app/appcast.xml. System profiling is turned off, so no details about your Mac are sent.
• Anonymous usage counts, which you can turn off. From version 1.0.1, the "Share anonymous usage" switch is on when you set Shedi up; turn it off there or any time in Settings, General. If you updated from 1.0.0, Shedi asks you once and starts with it off. When it's on, Shedi sends Pulse, analytics I run on my own server (Shedi before 1.2.4 sent Umami): how many scans, cleans and uninstalls run, how much space a scan found, as a range (like "5–10 GB"), and how much a clean or uninstall freed, rounded to a tenth of a GB, how long a scan took, how many items were cleaned or failed, which categories had items, whether you used "Also delete from the Trash", whether the menu bar view and Full Disk Access are on, how many days since install, app and macOS version, and license state, tied to a random ID made on your Mac. Never file or folder names, paths, app names, your license key, your Mac's name or your email. Like any web request, Pulse receives your IP address; it uses it only to look up the country and city at that moment and never stores it, and it hashes the random ID before storing it. Turning sharing off deletes counts not yet sent and makes a new random ID.

"Contact Support…" in Settings opens your own mail app with Shedi's version, your macOS version, your Mac's chip type, license state and whether Full Disk Access is on already filled in. Nothing is sent until you press Send, and you can delete any of it first.

When you buy

Lemon Squeezy sells Shedi as the merchant of record. They take the payment, handle tax and send your receipt and key, under their own privacy policy. I never see your card. From Lemon Squeezy I receive your name, email, country and order details, which I use to deliver your key and answer support. A notification about each order reaches me through a Telegram bot, with the site that sent you (see below), the product and the amount.

This website

• Hosting. The site runs on Vercel, which processes your IP address and browser details to serve pages.
• Visit counts. Pulse, analytics I run on my own server, counts visits without cookies and never stores your IP address.
• Which version of the home page you see. I'm testing three versions of the English home page. The site picks one at random and keeps your pick in a cookie named ab for 90 days, so the page doesn't change on you. It holds one letter (a, b or c), is added to the visit counts and to the checkout link, and identifies nothing about you.
• Purchases. When you buy through shedi.app, Lemon Squeezy tells Pulse about the sale: the product, the price, your country and the random visit ID the checkout link carried, which ties the sale to the version of the home page you saw. Your email is kept only as a one-way hash, to count repeat buyers. Never your name or card.
• Where you came from. The site keeps the first site or link that brought you in your browser's local storage and adds it to the checkout link, so I know which channel led to a sale. It never leaves your browser unless you open the checkout.
• Affiliate links. If you arrive through a creator's referral link, Lemon Squeezy's affiliate script sets a cookie with a referral ID so the creator gets credit for a sale, and the site keeps that creator's code in local storage for 30 days so it also applies on halo-mac.com, my other app's site, which shares the same store. Apart from that and the ab cookie above, this website sets no cookies.
• Badges. The TryMacApps, MacNative, NativeShelf and Mac Browse badges in the footer load from their sites, which see your IP address when your browser fetches them.

Email

If you write to support, I keep the conversation to help you and to remember earlier issues.

Why I'm allowed to use it

For readers in the EU, UK and similar places, these are the legal bases under the GDPR (Article 6):

• To deliver what you bought (contract): the license check, order details from Lemon Squeezy, and support for your purchase. Without your license key the paid features can't be unlocked; everything else on this page is optional.
• Legitimate interest in running and improving Shedi: anonymous usage counts, update checks, hosting, visit counts, the channel that led to a sale, affiliate credit, and support email that isn't about an order. You can object at any time: the "Share anonymous usage" switch stops usage counts at once, and for anything else, email me.
• Legal obligation: keeping order records for tax.

Who receives it

Lemon Squeezy (payments, licenses and affiliates), Contabo (the server my own analytics, Pulse, runs on), Umami (usage counts from Shedi before 1.2.4), Vercel (hosting), Telegram (order notifications) and my email provider (support). Each handles data under its own policy. These services, and I, are outside the European Economic Area, mostly in the United States, so your data leaves the EEA; the services rely on their own safeguards for such transfers, such as the EU's Standard Contractual Clauses.

How long I keep it

Order records stay as long as tax law and your license need them. Support email stays until you ask me to delete it. Usage and visit counts are kept in aggregate.

Your rights

You can ask for a copy of what I hold about you, or for it to be corrected, deleted or handed to you in a portable format, and you can object to or ask me to limit its use, by emailing support@shedi.app. I'll answer within 30 days. Where I rely on your consent, you can withdraw it at any time; that doesn't affect what happened before. Deleting your order record also ends support for that license key. If you're in the EU or UK, you can also complain to your data protection authority.

Children

Shedi isn't aimed at children under 13, and I don't knowingly collect anything from them.

Changes

If Shedi starts sending something new, it's added here before the release that does it, and the date at the top changes.