Privacy Policy

The CleanPanda app and this website are published by Omnibus, Ltd (“we”, “us”), the controller of the personal data described here. Our full details are in the legal notice. For any privacy question write to privacy [at] omnibus.dev.

• CleanPanda looks at your files only on your computer. Your files, their contents and the lists of what it found are never sent to us or anyone else.
• The app has no account, no analytics and no advertising. It sends error reports to Sentry: crash reports always, other errors and logs only while Send diagnostics is on (section 4).
• The app goes online only to check a license key, to send error reports and, when you ask or turn it on, to check for updates.
• This website uses analytics only after you allow it, and never when your browser sends Global Privacy Control.
• We do not sell or share personal information, and we do not use it for advertising.

When you check your computer, CleanPanda reads the names, sizes and dates of files and folders, and for duplicates their contents, on your computer. When you remove something it goes to the Trash, and CleanPanda records what moved, from where and when, so you can put it back. Settings, that record, optional history and the widget's totals are stored on your computer and are never sent to us.

License checks. When you enter a license key, and from time to time afterwards, the app asks our license provider, Lemon Squeezy, whether the key is valid. It sends the key, an activation ID and an anonymous device label such as “Mac 3f9a”, not your computer's name. Lemon Squeezy also receives your IP address, as with any connection.

Updates to your apps. Only when you press “Check for updates”, the app asks each app's own update server, the App Store and Homebrew whether a newer version exists. No file names and no list of your apps go to us.

Updates to CleanPanda. Only when you press “Check now”, or if you turn on automatic checks (off at first), the app asks our website whether a newer version is out. It sends the version you have; our server sees your IP address and the time, like any web server.

The app sends error reports to Sentry, a service of Functional Software, Inc. (USA), which processes them for us so that we can find and fix problems (legitimate interest). Sentry also receives the IP address of the computer sending a report, as with any internet request, and may store it with the report.

• What a report contains: the type of error and its message, with your home folder, user name, file paths and quoted text removed; the stack trace (where in the app's code it happened); the app version; the operating system and its version; the device model and processor architecture; and a random installation identifier.
• When: crash reports (the app stopping, or an error it could not handle) are always sent. Other errors and the app's logs are sent only while Settings > Privacy & data > Send diagnostics is on. It is on at first, and turning it off applies at once.
• Never sent: your files or their contents (including mail, photo and PDF contents), license keys, your computer's name or any other personal data apart from the IP address.
• Legal basis: our legitimate interests in keeping the app stable and secure (GDPR Art. 6(1)(f)). You can object at any time by turning Send diagnostics off; crash reports are still sent, because they are needed to fix crashes.
• Transfer: the reports, with the IP address, go to the USA under Sentry's data processing terms with Standard Contractual Clauses.
• Retention: Sentry keeps reports for 90 days, its default, and then deletes them.

Hosting and logs. The site is hosted by Vercel. Its servers process your IP address, browser type and requested pages to deliver the site and keep it secure (legitimate interest). These logs are kept for a short period by Vercel and are not used to identify you.

Analytics, only with consent. If you accept analytics, we use Vercel Web Analytics and Speed Insights, which count visits and measure performance without cookies, and, where enabled, Google Analytics. You can withdraw consent at any time through “Your privacy choices” in the footer. See the cookie policy.

When you write to us through the contact form, we store your name, email address, optional organization, topic and message so that we can answer you (legitimate interest, or steps before a contract if you ask about buying). Messages are stored in a Cloudflare D1 database. To block spam, the form uses Cloudflare Turnstile, which processes technical signals from your browser and your IP address; it does not use them for advertising.

We keep messages for up to 24 months after our last exchange, then delete them, unless we need them longer to handle a legal claim. Please do not paste file contents or passwords into the form.

Licenses are sold by Lemon Squeezy, which acts as our reseller and merchant of record. Lemon Squeezy collects your payment and billing details as an independent controller under its own privacy policy; we receive your name, email address, country and order details to deliver and support your license. Purchases through the Mac App Store or Microsoft Store are handled by Apple or Microsoft under their own policies. We keep order records as long as tax and accounting law requires.

Lemon Squeezy, the merchant of record for purchases on this website, is a Stripe company. Card payments are processed on Stripe's infrastructure, with Stripe acting for Lemon Squeezy; we never receive your card details.

We use these providers, each bound to process data only for us or under its own policy:

• Vercel Inc. (USA): website hosting, logs, cookieless analytics
• Cloudflare, Inc. (USA): contact form storage (D1) and spam protection (Turnstile)
• Lemon Squeezy (USA): sales, tax, license keys (independent controller)
• Functional Software, Inc. (Sentry) (USA): error reports from the app
• Google LLC (USA): Google Analytics, only if enabled and only with your consent

Some providers are in the United States. Transfers from the EU, UK and Switzerland rely on the EU-US Data Privacy Framework and its UK and Swiss extensions where the provider is certified, and otherwise on Standard Contractual Clauses. Data about Canadian residents may be processed outside Canada and may be accessible to authorities there.

Depending on where you live you can access, correct, delete or export your personal information, object to or restrict its use, and withdraw consent. Details for your region:

• European Union, EEA, UK and Switzerland: see the GDPR page
• United States, including California: see the US privacy notice
• Canada, including Quebec: see the Canada privacy page

GDPR · US privacy notice · Canada. Write to privacy [at] omnibus.dev; we do not charge for requests.

The CleanPanda app and this website are for work and are not directed at children under 16. We do not knowingly collect personal information from children.

Connections to this site, the license service, error reports and update checks use HTTPS. Access to contact messages is limited to the people who answer them. Read more on the security page.

If we change what the app sends or this site collects, we update this policy and its date, and describe app changes in the release notes.