Privacy policy

Cirrulet is the macOS app and plugin marketplace available at cirrulet.com. In this policy, “Cirrulet”, “we”, and “us” refer to the operator of those services. This policy applies to the Cirrulet website, accounts, marketplace, publisher tools, and related online services, and to the accounts the macOS app connects on your behalf. A third-party plugin may have its own privacy practices, which its publisher is responsible for explaining.

• Account information. When you create or connect an account, our authentication provider processes identifiers such as your name, email address, profile image, sign-in method, and account security information.
• Social sign-in data. If you choose Google, Apple, or X sign-in, we receive only the account information authorised by that provider and requested by Cirrulet. For Google sign-in, this is the basic OpenID identifier, email address, and profile information used to authenticate you and maintain your Cirrulet account. We do not use Google user data for advertising or sell it. Connecting a Google Calendar inside the macOS app is a separate, later step, described under “Google user data in the macOS app”.
• Marketplace activity. We keep records of purchases, licences, entitlements, refunds, disputes, downloads, and the plugins associated with them. Payment card details are handled by Stripe and are not stored by Cirrulet.
• Publisher information. If you publish a plugin, we process your publisher profile, public signing keys, plugin metadata, uploaded source and assets, build and security-review results, release history, and payout account status.
• Device and licence data. The app may send a random installation identifier and a label you choose for a device. We store a keyed pseudonym derived from the installation identifier for licence enforcement. We do not request serial numbers, MAC addresses, hardware UUIDs, or similar hardware fingerprints for this purpose.
• Usage and diagnostics. We use Vercel Web Analytics and Speed Insights for aggregate page usage and performance information, and PostHog for product analytics and session replays. PostHog replays mask all displayed text and form inputs, do not capture request headers or bodies, and strip query strings and fragments from captured URLs. Analytics URLs are reduced to their origin and pathname before transmission, removing query strings and fragments. A legacy analytics endpoint may process a limited set of product events with a pseudonymous identifier; it does not accept prompts, source code, file paths, credentials, or arbitrary free-form content.
• Security information. We process request, network, rate-limit, audit, and security signals needed to prevent abuse, verify webhooks, investigate incidents, and protect the marketplace and its users.

Separately from signing in to cirrulet.com, a plugin running inside the Cirrulet macOS app can ask to connect your Google Calendar. This section describes that connection specifically, because it is the only place Cirrulet handles data from a Google Workspace API.

• What we request, and when. Nothing is requested until you install a plugin that asks for it and approve the request in Cirrulet’s own permission prompt. We then request two scopes: calendar.calendarlist.readonly, to list the calendars on your calendar list; and calendar.events, to read your events and to create, change, and delete events you ask Cirrulet to. A plugin that only needs to read your schedule may ask for the narrower calendar.events.readonly in place of the second, and those three are the only scopes the app will request. We do not request access to your calendars’ sharing permissions, and we do not request the ability to delete a whole calendar.
• Where the data goes. Your calendar data travels from Google to your Mac and no further. It is not sent to Cirrulet’s servers, it is not stored on them, and no Cirrulet server is in the path of a Google Calendar request. Calendar data is used to display your schedule in the island and to carry out the changes you make there.
• Where the credentials live. The access and refresh tokens Google issues are stored in the macOS Keychain on your Mac, in a keychain service used for nothing else. They are never transmitted to Cirrulet, and they are never given to a plugin. A plugin receives an opaque reference it cannot read, and the app attaches the credential itself, only to requests addressed to Google’s API hosts www.googleapis.com and calendar.googleapis.com. What the credential can reach there is bounded by the scopes above, which permit calendar access and nothing else; a plugin that tries to set its own authorization header on those hosts has the request refused rather than overridden.
• Retention, and how to disconnect. Calendar data is held on your Mac for as long as the plugin you granted access to keeps it, in that plugin’s own on-device storage; removing the plugin deletes that storage. To end the connection itself, open Plugins in Cirrulet and choose Connected Accounts, which lists every third-party account the app holds a sign-in for and which plugin asked for it. Disconnecting one there asks Google to revoke the sign-in and deletes it from your Keychain; if Cirrulet cannot reach Google at that moment it tells you so, stops using the sign-in immediately, and finishes the revocation the next time it can. Removing a plugin does the same for the accounts that plugin connected. A plugin may also offer its own disconnect control, and withdrawing the plugin’s authorization permission in Cirrulet’s plugin settings stops the app from using the credential from that moment on, though on its own it does not tell Google. You can also revoke Cirrulet’s access at any time from your Google Account permissions page; if you do, Cirrulet notices the next time it tries to use the sign-in and asks you to reconnect rather than failing silently.
• Limited use. Cirrulet’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer or sell Google user data; we do not use it for advertising, retargeting, or credit decisions; we do not use it to train artificial-intelligence or machine-learning models; and no person at Cirrulet reads it, because it never reaches us.

• Provide authentication, accounts, downloads, and licences.
• Process purchases, publisher payouts, refunds, and disputes.
• Build, scan, review, sign, publish, and distribute marketplace plugins.
• Operate, secure, troubleshoot, measure, and improve the services.
• Comply with legal, accounting, tax, fraud-prevention, and consumer protection obligations.

Where UK data protection law applies, our legal bases are performance of a contract, our legitimate interests in operating and securing the services, compliance with legal obligations, and consent where the law requires it.

We share information only as needed to run the services, comply with law, or protect users. Service providers include Clerk for identity and authentication; Stripe for checkout, payments, refunds, disputes, and publisher payouts; Vercel for hosting, private artifact storage, analytics, performance measurement, and isolated plugin builds; PostHog for product analytics and masked session replay; Neon for managed database infrastructure; and Upstash for distributed rate limiting. If you choose social sign-in, the selected provider also processes the authentication request under its own terms.

We may disclose information to professional advisers, regulators, law enforcement, or a successor to the service when legally required and subject to appropriate safeguards. We do not sell personal data. Providers may process information in countries outside your own; where required, we rely on recognised transfer safeguards.

We keep information only for as long as it is needed for the purposes above. Custom pseudonymous analytics events expire after 90 days. Account and operational data generally remains while your account is active. You can permanently delete your account from account settings, which ends access to purchases, licences, device slots, and publisher tools.

Some transaction, refund, publisher, release, security, and audit records may be retained after account deletion where necessary for accounting, legal compliance, fraud prevention, dispute handling, or software-supply-chain provenance. Those records are no longer usable to sign in. Our infrastructure providers may retain backups and logs for limited periods under their own retention schedules.

You can review and update account details, manage connected sign-in methods, revoke device slots, and delete your account from Cirrulet’s account controls. Depending on where you live, you may also have rights to access, correct, erase, restrict, object to, or receive a portable copy of personal data, and to complain to your local data protection authority. In the UK, that authority is the Information Commissioner’s Office.

To make a privacy request, use the support contact presented during sign-in or in a Cirrulet purchase receipt. We may need to verify your identity before completing a request.

We use technical and organisational measures designed to protect information, including scoped access, signed webhooks, private artifact storage, isolated builds, and cryptographic verification. No online service can guarantee absolute security.

We may update this policy as the services or legal requirements change. The date above shows the latest revision. Material changes will be presented through the website or another appropriate channel. Please also read our terms of service.