Privacy Policy

1. Summary

TouchGrass processes break activity, typing activity signals, idle time, meeting and media signals, settings, and wellness statistics locally on your Mac.

We do not record audio, capture screen contents, read browser content, collect keystroke content, or upload behavioral statistics.

The Direct-distribution app communicates with our servers for trial and license management.

Update checks communicate with our software-update servers.

We do not use advertising trackers or behavioral analytics.

We do not sell personal information or share it for cross-context behavioral advertising.

Payments are processed by Razorpay. We do not receive or store complete payment-card numbers.

2. Information Processed Locally by the Application

TouchGrass processes the following information locally to provide reminders and related features:

• Time since recent keyboard and mouse activity, without collecting the content of keystrokes. • Running application identifiers and, when needed for media detection, the frontmost application identifier. • Whether supported applications have active audio input or output sessions. • Display, battery, screen-lock, sleep, and wake status. • Break settings, office hours, planned breaks, notification preferences, and other application settings. • Daily aggregate statistics covering completed, skipped, snoozed, interrupted, and idle breaks; break durations; and the number of posture, blink, typing-health, and advance reminders shown.

TouchGrass does not collect audio samples, screen pixels, browser URLs, tab contents, window titles, calendar events, document contents, or individual keystrokes.

Behavioral signals used for idle, typing, meeting, and media detection are evaluated locally and are not transmitted to us. Daily statistics remain on your Mac and are retained for up to 30 calendar days. You can delete them from the Statistics page in the application.

3. Information We Collect

Please do not include medical records, financial credentials, government identifiers, or other sensitive information in feedback or support messages.

For Direct builds, the installation identifier is derived by hashing the Mac hardware UUID with an application-specific salt. The raw hardware UUID remains on the device and is not transmitted to us.

The installation identifier is used to administer trials, activate licenses, enforce device limits, prevent repeated trial abuse, and provide support.

This information is used to operate, secure, troubleshoot, and prevent abuse of the Services. We do not use it for behavioral advertising.

If you explicitly permit Sparkle to send a system profile, the update request may also include macOS version, Mac model, processor details, memory, preferred language, and application version. This optional information is not connected to behavioral statistics.

Diagnostic reports are saved locally. They are not uploaded automatically. We receive a report only if you choose to attach it to a support email or otherwise send it to us.

We do not receive or store complete card numbers, CVVs, online-banking credentials, or payment authentication credentials. We may receive limited transaction records such as your name, email address, billing contact details, payment identifier, amount, currency, payment status, and refund status.

We do not purchase personal information from data brokers.

4. Browser Storage and Cookies

We do not currently use advertising cookies or third-party behavioral analytics.

The website may use necessary browser storage, including local storage, to remember that a beta-access form was submitted and to support security or basic website operation. Our hosting and security providers may also process necessary request information.

If we introduce non-essential analytics or advertising technologies, we will update this Privacy Policy and obtain consent where required.

5. How We Use Information

We may use personal information to: • Provide, maintain, and secure the Services. • Register installations and administer trials. • Activate, validate, transfer, and deactivate licenses. • Process purchases, refunds, and payment disputes. • Provide beta access and issue beta licenses. • Respond to feedback, privacy requests, and support messages. • Diagnose technical problems when you request assistance. • Deliver and verify application updates. • Prevent fraud, trial abuse, spam, and security incidents. • Maintain business, tax, payment, and legal records. • Enforce our terms and protect our legal rights. • Comply with applicable laws and lawful requests.

We do not use locally processed behavioral information for advertising, unrelated profiling, or automated decisions producing legal or similarly significant effects.

We do not use beta sign-up information for unrelated marketing unless you separately consent.

6. Legal Bases for Processing

Where the EEA, UK, Swiss, or similar laws apply, we rely on the following legal bases: • Contract: To provide trials, licenses, purchases, updates, support, and requested Services. • Legitimate interests: To operate and secure the Services, prevent fraud, administer licenses, troubleshoot problems, and improve reliability. • Consent: For optional communications, optional diagnostic submissions, optional system-profile information, or other processing where consent is requested. • Legal obligations: To comply with tax, accounting, consumer-protection, payment, and legal requirements. • Legal claims: To establish, exercise, or defend legal rights.

You may withdraw consent at any time. Withdrawal does not affect processing already performed lawfully and does not affect processing supported by another legal basis.

7. How We Disclose Information

We may disclose relevant information to: • Amazon Web Services: For website, download, API, storage, content-delivery, logging, and security infrastructure. • Razorpay: For payment processing, fraud prevention, refunds, and disputes. • Email and support providers: To deliver and store communications. • Apple: Where needed for App Store transactions and entitlements. • Professional advisers: Such as accountants, auditors, insurers, and legal advisers. • Authorities: When required by law or necessary to protect rights, safety, or security. • Business transaction participants: In connection with a merger, acquisition, financing, restructuring, or sale of assets. • Other parties with your direction or consent.

Service providers may process information only for contracted purposes and subject to applicable privacy and security obligations.

8. Sale, Sharing, and Advertising

We do not sell personal information.

We do not share personal information for cross-context behavioral advertising or use it for targeted advertising. We have not sold or shared personal information for those purposes during the preceding 12 months.

Disclosing information to service providers for hosting, payment processing, security, email, and support is not treated as a sale where applicable law provides an exemption for service-provider processing.

9. International Transfers

Our providers may process information in countries other than the country where you live. Those countries may have different data-protection laws.

Where required, we use appropriate safeguards such as contractual data-protection terms, data-processing agreements, Standard Contractual Clauses, the UK International Data Transfer Addendum, or another legally recognized transfer mechanism.

10. Retention

We retain information only for as long as reasonably necessary: • Local daily statistics: up to 30 calendar days unless deleted sooner. • Transient activity and meeting/media signals: only while needed for local application operation and not as an event history. • Local settings and planned breaks: until you delete or reset them. • License email and key stored in the macOS Keychain: until deactivation or local removal. • License and installation records: while necessary to operate the trial or license, enforce device limits, prevent repeated trial abuse, and resolve disputes. • Website and API security logs: normally up to 90 days, unless needed longer to investigate abuse, security incidents, or legal claims. • Feedback, beta requests, and routine support correspondence: normally up to 24 months after the last interaction. • Diagnostic reports sent to us: until the related support matter is resolved, normally no longer than 24 months. • Payment and tax records: for the period required by applicable accounting, tax, consumer-protection, and payment laws.

When retention is no longer necessary, we delete, anonymize, or securely isolate the information.

11. Security

We use reasonable technical and organizational safeguards, including HTTPS, access controls, restricted local file permissions, redaction of common identifiers in diagnostic logs, and storage of license credentials in the macOS Keychain.

No Internet transmission or storage system is completely secure. We cannot guarantee absolute security.

12. Children

The Services are not directed to children under 13, or a higher minimum age where required by local law. We do not knowingly collect personal information from children below the applicable age.

A person who has not reached the age of majority should not make a purchase without permission from a parent or legal guardian.

If you believe a child has provided personal information improperly, contact privacy@touchgrass.land.

13. Your Privacy Rights

Depending on your location, you may have the right to: • Request access to personal information we maintain about you. • Request correction of inaccurate information. • Request deletion of personal information. • Receive a portable copy of certain information. • Restrict or object to certain processing. • Withdraw consent. • Opt out of sale, sharing, targeted advertising, or qualifying profiling. • Appeal a decision concerning a privacy request. • Complain to a data-protection authority. • Receive equal service without unlawful discrimination for exercising your rights.

TouchGrass does not presently sell personal information, use targeted advertising, or perform qualifying automated profiling.

To exercise a right, email privacy@touchgrass.land. We may need to verify your identity and authority before completing a request.

You can delete local statistics directly from the application. Requests concerning server-side license, beta, feedback, purchase, or support records must be submitted by email.

14. Regional Disclosures

Residents of applicable US states may have rights to access, correct, delete, or obtain a copy of personal information and to opt out of certain processing. In the preceding 12 months, we may have processed identifiers, customer records, commercial information, Internet or network activity, and correspondence. We disclose these categories only for the operational purposes described in this Policy.

EEA, UK, and Swiss residents may complain to their local supervisory authority. Canadian residents may withdraw consent where processing depends on consent. Residents of Australia, New Zealand, South Africa, India, and other jurisdictions may exercise the access, correction, deletion, grievance, or related rights provided by applicable law.

15. Beta Program

Eligible beta participants may receive a complimentary license for participating in testing or providing feedback. Participation is voluntary.

We use beta information to evaluate requests, issue licenses, communicate about the beta, and administer the program. We do not sell beta information or use it for targeted advertising.

You may withdraw from the beta program or request deletion by contacting privacy@touchgrass.land.

16. Do Not Track and Global Privacy Control

Some browsers offer a Do Not Track setting. Because there is no universally applicable standard for Do Not Track signals, our website does not currently respond to those signals.

Where legally required, we recognize applicable opt-out preference signals such as Global Privacy Control. Because we do not sell personal information or use it for targeted advertising, such a signal generally does not change the website's current behavior.

17. Changes to This Policy

We may update this Privacy Policy when our practices, Services, providers, or legal obligations change. The updated version will display a revised "Last updated" date.

If a change materially affects how we use personal information, we will provide additional notice where required.

18. Contact Us

For privacy questions or requests: • Email: privacy@touchgrass.land • General inquiries: hello@touchgrass.land