Skip to content

Privacy Policy

Last updated 14 September 2026

Draft — not yet published. [decide] marks what only the author can settle. The structure follows Glancet’s /privacy page (../../glancet/glancet-landing/src/pages/privacy.astro), which is the template for the published version.

Spalt is a desktop app that runs on your Mac. It has no account system, no advertising, no analytics and no crash reporting service. This policy lists every place data moves so the claim can be checked rather than taken on trust.

Who is responsible

The data controller is Arch Rainey, contactable at [decide: support address].

The app

What it reads on your Mac

  • Your git repositories — the ones you open, through git on your machine. Spalt reads the working copy, index and history to draw its views and writes to them when you stage, commit, branch, merge, rewrite or discard. It never reads a repository you have not opened.
  • Its own files — settings, projects and recent repositories in ~/Library/Application Support/com.arthurhlopin.spalt/documents; cached copies of pull-request, workflow-run and issue lists in …/snapshots (deleted when unreadable or a month old); review notes and the undo journal inside each repository’s .git.
  • Credentials you give it — a GitHub token (from the gh CLI, a token you paste, or the in-app sign-in), an Atlassian API token, and AI provider keys — stored in the macOS Keychain under the spalt service and read only by the app’s Rust core.
  • The machine, for the statusbar: CPU, memory, disk and the process and port tables the system exposes to your user. None of it is stored or sent.

What leaves your Mac, and when

Every request below is made only to a service you signed in to or switched on, using your credentials, and only for what you are looking at or what you pressed:

  • GitHub (api.github.com) — pull requests, reviews, checks, Actions runs, deployments; and the writes you click: open, comment, review, merge, close, re-run, cancel, dispatch.
  • Atlassian Cloud (your site’s atlassian.net) — Jira issues, transitions and comments you click; Confluence pages linked from an issue.
  • The AI account you assigned, only for repositories where you enabled AI: a staged diff, a file’s change, or your review notes — after .gitignored files, .env files, key material and secret-shaped strings are removed. For subscription CLIs (Claude Code, Codex, OpenCode) the CLI makes the request under its own sign-in; for API-key providers Spalt makes it over HTTPS with your key in the header; for local models it stays on your network.
  • Git remotes — fetch, pull, push and clone go through the git on your Mac with its own credential helper, SSH agent and configuration.
  • The update check — once a day, and when you click Check for Updates…, the app asks [decide: domain]/latest.json whether a newer version exists, then asks you before installing. The request carries the app’s version and what any HTTP request carries: your IP address and a user-agent. Settings → About switches the daily check off.

That is the complete list. Nothing describing your code, file names, branch names, commits, notes or which repositories you open is ever sent to Spalt’s author.

What is written down when something fails

Failures are appended to ~/Library/Logs/com.arthurhlopin.spalt/errors.jsonl and crashes to crashes.log beside it. Credentialed URLs, GitHub, Atlassian and AI tokens are masked before a line is written. Nothing in these files is transmitted; Copy report puts a masked text on your clipboard with your home directory shortened to ~, for you to paste into a message or an issue if you choose.

How installs are counted

[decide] Either: Installs are not counted. Or, Glancet’s approach: We count how many copies check for updates each day. The IP address and user-agent of each update-check request are combined with a secret and the date, hashed one way, and only the hash is kept; the same Mac produces an unrelated hash tomorrow, so nobody can be followed from one day to the next. Hashes are deleted after 90 days; daily totals are kept. Switching the update check off in Settings ends this.

The website

[decide: domain] is a static site on Cloudflare Pages: no cookies, no client-side analytics, no login. Cloudflare serves every request and therefore sees your IP address; see Cloudflare’s privacy policy.

Your rights

Because Spalt holds nothing about you on any server, most requests are simple: write to [decide: support address] and we will tell you what, if anything, we hold against your address, and delete it.

Changes

This policy is versioned with the app; the version published with a release describes that release.

Last updated: [decide]