Privacy Policy

Beta telemetry (on by default, opt-out anytime). During the beta, docktor sends two kinds of first-party telemetry to docktor’s own feedback endpoint (a Cloudflare Worker operated for docktor): a minimal usage heartbeat, and a redacted summary of any crash macOS recorded for docktor. Nothing is transmitted until you have seen the disclosure in onboarding, and you can turn both off at any time in Settings › General › Beta Telemetry (or during onboarding).

docktor uses no third-party analytics or crash-reporting SDKs — no Sentry, no Google Analytics — and its only first-party server is the feedback endpoint described below; we do not run any analytics or account backend, and we have no way to identify you.

There is exactly one channel that runs back the other way: if you file feedback, the maintainer can write a reply to it, addressed to your install’s random identifier rather than to a name, an account, or an email address, and delivered on the beta usage heartbeat. You can then write back, so a report becomes a conversation — but only messages you type and send yourself are ever transmitted.

The following data is read on-device. Most of it never leaves your Mac; the two exceptions (looking up song lyrics and reverse-geocoding your location name) are called out explicitly and listed under third-party services:

• Apple Calendar events — Read-only via EventKit, only after you grant Calendar permission. Used to populate the calendar widget. docktor does not modify, delete, or sync your Apple Calendar events. Never transmitted off your Mac.
• Music playback metadata — Title, artist, artwork, and playback state for supported music apps (Apple Music and Spotify). Lyrics exception: when you view synced lyrics, docktor sends that track’s title, artist, album, and duration to LRCLIB over HTTPS to fetch matching lyrics. No account or persistent identifier is attached. If you never open lyrics, nothing is sent.
• Window contents — Captured via ScreenCaptureKit to render thumbnail previews when you hover a Dock tile. Frames live in memory only and are discarded as soon as the preview closes. Never transmitted off your Mac.
• Window metadata — The Accessibility API is used to enumerate window positions, sizes, and titles for Dock Previews. Never transmitted off your Mac.
• Coarse location — CoreLocation supplies latitude and longitude when you opt into the Weather widget. Coordinates are sent to the Open-Meteo HTTPS endpoint to look up forecasts, and to Apple’s servers to reverse-geocode a human-readable location name. No persistent identifier accompanies either request.

docktor includes a beta Feedback widget. It sends data only when you explicitly tap Send — there is no background or automatic transmission. When you submit feedback, docktor transmits the following to docktor’s feedback endpoint:

• Your typed message — the text you write in the feedback field.
• Screenshots you attach or capture — a preview of every attachment is shown before you send. Screenshots may contain whatever is on your screen, so review the preview before sending.
• Build flavor — whether the build is an Xcode Debug or distributed Release build. It identifies the binary configuration, not you.
• App version — the docktor version and build number the report was sent from. Always included.
• Install identifier — a random identifier (a UUID) generated on your Mac and stored only on your Mac. Always included, because it is the report’s return address: it lets us group the reports from one install and send a reply back. It is not tied to your hardware, and it is not a name, an account, or an email address.
• Country — the two-letter country code (for example US) that Cloudflare resolves from the network connection your report arrives on. It is resolved at Cloudflare’s edge, so docktor never asks your Mac for your location, and it is deliberately no more precise than the country — no city, region, coordinates, or time zone. Your IP address itself is not stored on the report or the heartbeat; it is written only to a short-lived rate-limit log (a sliding window of about ten minutes) and pruned after that.
• Non-personal diagnostics (only when the “Include diagnostics” toggle is on) — macOS version, locale, screen size, and coarse reliability counters. No name, email, account, or other personally identifying information.
• A short tail of docktor’s own logs (controlled by the drawer’s “Attach logs” menu, 5 minutes by default) — the most recent log lines emitted by docktor itself, to help reproduce bugs. Set “Attach logs” to Off to send a report with no logs. These are docktor’s own logs, not a system-wide capture.

What the feedback feature does NOT send: anything before you tap Send, your files, clipboard contents, calendar events, music metadata, browsing activity, keystrokes outside the feedback field, or system-wide logs from other apps.

Feedback is delivered over HTTPS to a Cloudflare Worker operated for docktor, which stores it (Cloudflare D1 and R2) and emails a triage alert to the maintainer via Resend. It is not used for advertising, profiling, sale, or any third-party analytics.

When the beta telemetry option is on, docktor periodically sends a minimal “heartbeat” to the same endpoint. Each heartbeat contains only that the app is running and how long the current session has been up (an uptime in seconds), tagged with:

• the same random, anonymous install identifier generated on-device;
• a random per-launch session identifier (a fresh UUID each time docktor starts, used only to group one run’s heartbeats; it does not persist across launches and does not identify you);
• the app and macOS version, and a Debug-vs-Release build flag; and
• the same edge-resolved two-letter country code described above (the IP address itself is not stored on the heartbeat).

It contains no usage details, feature interactions, message content, screenshots, or personal data. Its sole purpose is to show how many beta testers currently have docktor running. It can be turned off during onboarding or anytime in Settings; when it is off, no heartbeats are sent.

When you file feedback, the maintainer may write a short reply to that report, and you can write back — so a report becomes a two-way conversation about that one report. Every message is addressed to the random install identifier your report carried — never to a name, an account, or an email address. Replies to you are handed to your install on its next beta usage heartbeat.

• A conversation tells us nothing new about you: messages travel to and from the install that filed the report, with no account, name, or email address involved.
• You control whether a reply can arrive — delivery rides the beta usage heartbeat, so while beta telemetry is off no reply is fetched, and nothing extra is added to the heartbeat request to receive one.
• Nothing you write is sent until you send it. A message carries only your text and which report it belongs to — no diagnostics, logs, or attachments.
• Opening the conversation list asks the endpoint which reports you filed, identified only by that random install identifier; the reply is your own text coming back to you.
• Messages are short and short-lived: each is capped at 2,000 characters, and every message — in either direction — is deleted from docktor’s endpoint 90 days after it is written, whether or not it was delivered.
• Arrival is announced locally. If you have granted notification permission, the local notification carries a preview of the reply text; if not, the reply is simply marked unread in the Feedback widget. Nothing about the notification is transmitted.
• Only the maintainer can write to you — no other user or third party can send you a message through docktor.

When the beta telemetry option is on, docktor checks — on launch only — for crash reports that macOS itself wrote for docktor since the previous launch. For each new one, docktor forwards a redacted summary: the exception type and signal, the app and macOS version and the OS-assigned incident identifier, and a size-capped list of the crashed thread’s top stack frames, tagged with the same random install identifier.

Before anything is sent, docktor strips usernames and home-directory paths, caps the summary at 64 KB, and reads only docktor’s own crash reports. The raw .ips file is never transmitted, and nothing is sent at the moment of the crash. This rides the same opt-out toggle as the heartbeat.

• Spotify — OAuth tokens are stored in your macOS Keychain and used to call Spotify’s HTTPS API for playback control and metadata.
• Open-Meteo — the Weather widget calls Open-Meteo over HTTPS with your coordinates; no API key or stable identifier is required.
• LRCLIB — when you view synced lyrics, the current track’s title, artist, album, and duration are sent over HTTPS; no API key, account, or persistent identifier.
• Apple (reverse geocoding) — MapKit / CoreLocation turns coordinates into a place name, governed by Apple’s privacy policy.
• Sparkle update feed — docktor fetches a signed appcast over HTTPS on launch and about once a day; the request carries only your app and macOS version.
• Cloudflare — docktor’s feedback endpoint runs on Cloudflare Workers, with submissions stored in Cloudflare D1 and R2, governed by Cloudflare’s privacy policy.
• Resend — feedback triage alert emails are sent to the maintainer via Resend.

• Email: [email protected]
• LinkedIn: linkedin.com/in/petercsauer
• Issues: github.com/petercsauer/docktor-releases/issues