Privacy Policy

1. Overview & Scope

Catalyst is a native macOS application that helps developers manage their local development environments. Features include managing package managers (Homebrew, pip), Python virtual environments, Git repositories and the Git Graph, shell configuration, PATH and aliases, SSH keys, startup items, disk and battery health, a diagnostics engine (Dr. Catalyst), recoverable cleanup (Cruft Sweeper), and one-file environment migration (Snapshot & Migrate).

Because Catalyst operates directly on your local filesystem and executes shell commands, it is engineered to be local-first and privacy-first by design. It is also free and open-source software under the GNU General Public License: there is no account, no sign-in, no licence key, no purchase, and no server-side record of you. Every claim in this Policy is verifiable against the published source at github.com/theappfoundryco/Catalyst — that is the point of publishing it.

This Policy applies solely to Catalyst and The App Foundry services described here. It does not apply to any third-party service or platform the App interacts with, each of which is governed by its own privacy policy and terms, as described in Section 11.

2. Who Operates Catalyst

Catalyst is an independently developed application created and maintained by The App Foundry ("we," "us," "our," or the "Developer"). The Developer is the party responsible for the App for the purposes of this Policy. Because the App is operated by an independent studio and not a registered corporation, you acknowledge and accept that the App is provided on the terms set out in this Policy and the Terms & Conditions, including the disclaimers and limitations of liability in Sections 17 through 21. You may contact the Developer at any time using the details in Section 24.

3. Information We Collect

The Developer collects no personal information from the App. There is no account system and no crash reporter. Nothing identifying you or your machine is gathered in any configuration. The complete set of information that can exist anywhere outside your Mac is the following.

3.1 Usage analytics — on by default, off in one click

Catalyst reports which of its screens you open, so that the Developer knows which parts of the App are worth continuing to build. Nothing is collected until you have been shown this choice. The App presents it once, plainly, on the same screen where you accept this Policy, with the box already ticked; unticking it there takes one click and costs you nothing, and every feature works identically either way. If you switch it off, the App has no analytics endpoint to talk to and Section 3.2 is the whole of it.

The complete payload is: an app_open event when the App launches, a feature_opened event naming which screen you opened, and one property recording whether Homebrew is installed. The screen name comes from a fixed list of 25 titles compiled into the App — it cannot contain a file path, a package name, or anything typed by you. Section 6 sets this out in full, including how to turn it back off.

3.2 Ordinary connection metadata held by our hosts

When the App downloads one of the static files listed in Section 5, the host serving that file necessarily sees the connection — your IP address, an approximate time, and the file requested — exactly as it would if you typed the URL into a browser. These files are served by GitHub Pages and Vercel, and any such record is a standard web-server log held by those providers under their own policies. The Developer does not receive, request, export, aggregate, or analyse these logs, does not use them to build a profile of any user, and has no way to connect them to an identity, because the App sends no identifier of any kind alongside the request. There is no cookie, no session, no header carrying anything about you or your machine beyond what the operating system's networking stack sends by default.

3.3 Support and feedback you choose to send

If you voluntarily submit a bug report, feature request, or support message — by email, by opening a GitHub issue, or through a linked form — the Developer receives what you chose to put in it, which may include your email address, your app version, and any logs or screenshots you attach. This is initiated entirely by you, and nothing is transmitted from the App as part of it. Please redact anything sensitive before attaching logs; diagnostic output can contain file paths and package names from your machine.

4. What We Do Not Collect

Catalyst is built to respect your proprietary code and infrastructure. The Developer does not collect, transmit, upload, or receive:

• Account or identity data. There is no account. No email address, no name, no user ID, no hardware fingerprint, no licence key, and no advertising identifier is created, stored, or transmitted. The App does not send your Mac's serial number, hardware UUID, MAC address, or host name. With analytics on, the provider generates its own app-instance identifier, described in Section 6.2 — nothing derived from your machine is passed to it.
• Anything beyond what Section 6 lists. With analytics on, precisely and only those two events and one property. With analytics off, no feature usage, no screen views, no session data, no counts and no timings at all.
• Crash or diagnostic reports. No stack traces, no automatic error reports, in either state. No crash reporter is linked at all. Crashes stay on your Mac in macOS's own crash logs, which the Developer never sees unless you personally send one.
• Anything you do inside a screen. Analytics record that you opened a screen, never what you did there. No package you installed or removed, no command you ran, no repository you opened, no snapshot you took, no search you typed.
• Source code & repositories. Your Git repositories, project files, commit history, and codebase contents are never uploaded anywhere.
• Environment variables & shell config. The contents of your ~/.zshrc, ~/.bash_profile, and any variables containing API keys or secrets remain strictly on your device.
• SSH keys & credentials. Private keys are never read for transmission; the SSH tooling shows and copies public keys only.
• Your macOS password. Never transmitted, never logged, never written to a file. Section 8 describes exactly how it is handled.
• File paths, package names, or machine names. Nothing derived from your filesystem is sent anywhere. The requests in Section 5 are fixed URLs; none of them carries a query parameter derived from your machine. The screen names in Section 6 are a fixed list compiled into the App, not free text, so there is no code path by which a path or a package name could reach an analytics event.
• Advertising & cross-app tracking. No ad networks, no advertising identifiers, no cross-app or cross-site tracking, and no sale, rental, or trade of personal data to data brokers — there is no data to sell.

5. Every Network Request the App Makes

This is the complete list. The first four are made by every install. Each is an HTTP GET for a static file that you can open in a browser yourself; none carries a request body, a cookie, an identifier, or a parameter derived from your machine. The fifth exists only while you have analytics switched on, and is the only request the App makes that sends rather than fetches.

Requests you trigger deliberately. Some actions you take reach the network by their nature, and the App tells you so before it acts: Network Diagnostics pings a public resolver (1.1.1.1) and resolves a well-known hostname to test your connection; installing Homebrew fetches Homebrew's official install script; and installing, updating, or searching packages hands off to brew and pip, which contact their own servers under their own privacy policies. These are the same requests those tools make when you run them in a terminal yourself.

Offline behaviour. Every remote read is cached on disk and falls back to the cached copy when a request fails, so Catalyst degrades to a fully local tool without a network connection rather than blocking. A failed legal-version check simply retries later and never changes what you have already accepted.

6. Analytics, Crash Reporting & Telemetry

Usage analytics were introduced in Catalyst 1.4 (the app; this Policy is separately versioned, and this is Policy version 1.4 too — the two numbering schemes coincide here by chance). They are on by default and can be switched off in one click, and nothing is collected before you have been shown that choice. There is still no crash reporter, no session recorder, and no automatic error reporting of any kind. This section is the complete account of what the analytics do and do not carry.

A change from what version 1.3 promised, stated plainly. Version 1.3 of this Policy said Catalyst contained no analytics, and undertook that if analytics were ever introduced they would be opt-in. Version 1.4 does not keep that undertaking: analytics are enabled by default. What is kept is everything the undertaking was for — the change is disclosed in the same release that makes it, the payload is enumerated in full below, nothing is collected before you have been shown the choice, and no existing user reaches the new behaviour without passing a screen that states it and offers a one-click refusal. If that trade is not acceptable to you, switching it off costs one click and no functionality.

6.1 The entire payload

With analytics switched on, the App sends the following and nothing else:

Why the screen title cannot leak anything. It is not a free-text field. The App can only send one of 25 fixed strings, enumerated in AppViewModel.Screen.telemetryName in the public source. There is no code path that puts a file path, a package name, a repository name, a search query, or anything you typed into an analytics event, because the event type has nowhere to put it.

What is never sent, in either state: what you did inside a screen, how long you stayed, what you installed or removed, what failed, what your machine is called, or anything at all from your filesystem, shell configuration, repositories, or keys.

6.2 Who processes it, and what they see

The provider is Google Analytics for Firebase, operated by Google LLC and Google Ireland Limited, acting as the Developer's processor. Google receives the events above, together with information inherent to any network request — your IP address, and the coarse device and OS information the SDK attaches (macOS version, app version, device model, language, and approximate region derived from IP). Google generates its own app-instance identifier so that repeat launches from one install are not double-counted. That identifier is created by the SDK; it is not derived from your hardware, and it is destroyed when you delete the App or switch analytics off. Google's handling is governed by its own terms and its privacy policy.

The Developer's use of this data is limited to reading aggregate screen counts. Google Signals, advertising personalisation, and ad-network integrations are not enabled, no advertising identifier is collected, and the data is not used for advertising, sold, shared with data brokers, or used to train any model.

6.3 How to turn it on, off, or leave it off

The App shows the choice once, on the same screen where you accept this Policy, with the box already ticked. Unticking it there is a single click and the App opens exactly the same way either way — accepting the Policy is required, sharing analytics is not, and the Continue button is never blocked on it. Every feature works identically whether analytics are on or off; nothing is withheld, degraded, or nagged, and you are not asked again.

You can change your mind at any time from the App's About screen, where a single switch turns it on or off. Turning it off stops collection immediately, within the running session, rather than at the next launch. Because there is no account and no identifier tied to you, there is nothing for the Developer to go back and delete on your behalf; deleting the App removes the app-instance identifier and ends the association entirely.

6.4 The one file that carries it

All of the above is implemented in a single file — Telemetry/Telemetry.swift in the public repository — which is the only place any provider is wired in, and the only file that links the SDK. The catalog of what may ever be sent is a second file, Telemetry/AppEvent.swift, which is short enough to read in a minute. This arrangement exists so that the question "what does Catalyst report about me?" has a two-file answer that you can check for yourself rather than a claim you have to take on trust.

A build made from the public source code sends nothing regardless of the switch, because the provider's configuration file is not in the repository and the App treats its absence as "analytics unavailable" rather than as an error.

6.5 No crash reporting

Firebase Crashlytics was removed at version 1.0 and has not returned. No stack trace, no non-fatal error, and no diagnostic breadcrumb leaves your Mac. Catalyst 1.4 added usage analytics only, and the crash-reporting methods in the source remain deliberately empty.

6.6 If this changes again

Any widening of what is collected will be disclosed in this Policy and in the project's public README in the same change that introduces it, with a version bump that requires your renewed acceptance before the App continues (Section 23). Shipping analytics while a policy still says otherwise is the single outcome this arrangement exists to prevent.

7. What Is Stored on Your Mac

All application state is local. Nothing in this section is synced, backed up to us, or transmitted:

• Preferences and app state — your settings, the versions of the legal documents you have accepted, and similar local flags, held in the App's own preferences.
• Cached catalogs — the static JSON from Section 5, written under ~/Library/Application Support/ so that the App works offline and makes fewer requests. Clearing it only costs you a refetch.
• Health history — the scores and diagnostics Dr. Catalyst produces over time, kept locally so trends can be shown. This never leaves the Mac.
• Your macOS password, if you have authorised a privileged action — in the macOS Keychain, under the conditions in Section 8.
• Snapshots you create — written to the location you choose, under the terms in Section 9.

All of it is removable by you at any time (Section 13). None of it is readable by the Developer, who has no channel through which to request it.

8. Your macOS Password & Privileged Actions

Some operations — certain installs, system-level cleanup, and helper installation — require administrator privileges. When one is needed, the App presents a native macOS password dialog.

What happens to what you type. The password is used to authorise the command you asked for, and is stored in the macOS Keychain so you are not asked again on every subsequent action. The Keychain item is written with a device-only access class, which means it never syncs to iCloud Keychain or any other device, is not included in encrypted backups, and is readable only while your Mac is unlocked. The dialog states this before you type. It is never transmitted over the network, never written to a log or a plain file, and never included in a snapshot — there is no code path in the App that could send it anywhere, and no server that would receive it.

Your control. You can clear the stored credential from within the App at any time, or remove the item directly using Keychain Access; the next privileged action will simply prompt you again. If your login password changes, the stored value stops working and the App discards it and re-prompts. If you would rather nothing be stored, decline the privileged action — every feature that requires it is optional, and the App remains usable without it.

9. Snapshots, Secret Scrubbing & Encrypted Secrets

Catalyst can capture your development environment into a single portable Snapshot file so you can restore it on another Mac. Snapshots are written to a location you choose on your own disk and are never uploaded to the Developer. There is no snapshot server, no sync, and no telemetry attached to the feature.

Secret scrubbing. When capturing your shell configuration, the App runs a local scrubber that attempts to detect and redact obvious API keys, tokens, and passwords, replacing each with a placeholder. This happens entirely on your device. Automated scrubbing is best-effort and cannot guarantee that every secret is found. You are solely responsible for reviewing any snapshot before sharing it with anyone.

Encrypted secrets. If you choose to include the redacted values so that a restore can put them back, they are encrypted with a passphrase you supply, using authenticated encryption (AES-GCM), before being written into the snapshot file. The passphrase is never stored in the snapshot and is never known to the Developer. If you lose it, those values cannot be recovered by us or by anyone else — that is the intended property, not a limitation. A snapshot carrying encrypted secrets is still a sensitive file: treat it like a password vault, and transfer it accordingly.

10. How Information Is Used

Because the App collects nothing, there is no user data for the Developer to use, profile, monetise, or disclose. The narrow categories described in Section 3 are used only for what they exist for: our hosts' standard server logs support the delivery and security of static files, and anything you send to support is used solely to answer you and to fix the problem you reported. Nothing is used for advertising, sold or shared with data brokers, used to train any model, or fed into automated decision-making that produces legal or similarly significant effects about you.

11. Third-Party Services

The App relies on the following third parties. Each operates under its own privacy policy and terms, over which the Developer has no control and for which the Developer accepts no responsibility. Using a feature that depends on one means your interaction with that service is governed by its policies.

• GitHub (Pages & Releases). Serves the static catalogs and the update feed, and hosts the release binaries and the public source repository.
• Vercel. Hosts this website, including the legal-version file the App checks.
• Sparkle. The open-source macOS update framework that performs the update check and verifies each update's signature before applying it.
• PyPI (Python Software Foundation). Provides the public package metadata used for Python version checks.
• Homebrew and pip. When you install, update, or remove a package, these tools run on your Mac and contact their own servers directly, exactly as they do from a terminal.
• Google Analytics for Firebase (Google LLC / Google Ireland Limited) — only if you switched analytics on. Processes the two events described in Section 6. If you leave analytics off, the SDK is never initialised and this service receives nothing from you.

Note for readers of earlier versions: Firebase Crashlytics, and the Cloudflare-backed account and licensing infrastructure, are no longer used by Catalyst in any form. Firebase Analytics was removed at app version 1.0 and returned at app version 1.4 as an opt-in feature, on the terms set out in Section 6.

12. Sharing & Disclosure

The Developer does not sell, rent, trade, or otherwise share personal information for monetary or other valuable consideration, and holds no store of user data that could be shared. In the narrow event that information does exist — for example, a support email you sent — it would be disclosed only: (a) where you direct it; (b) to comply with applicable law, legal process, or a valid governmental or regulatory request; (c) to protect the rights, property, safety, or security of the Developer, users, or the public, or to investigate fraud or abuse; or (d) in connection with a transfer of the App or its assets, in which case any successor would be bound by commitments no less protective than this Policy.

13. Your Rights & Controls

Because your data lives on your device, you retain direct and complete control over it. You can:

• Delete everything by uninstalling the App and removing its Application Support folder — that is the whole of its local state.
• Clear the stored admin credential from within the App or via Keychain Access (Section 8).
• Clear cached catalogs at any time; the App simply refetches them when next needed.
• Turn analytics on or off from the About screen, at any time, with immediate effect (Section 6.3). Leaving them off is the default and requires no action.
• Work fully offline. Blocking the App's network access at the firewall disables update checks and catalog refreshes, and leaves every local feature working.
• Audit the claims here against the published source code, which is the reason it is published.
• Contact the Developer about anything you have sent to support, including to request its deletion.

Depending on where you live, you may have additional rights under applicable data-protection laws — for example, under the EU/UK GDPR (access, rectification, erasure, restriction, portability, and objection) or the California CCPA/CPRA (know, delete, correct, and opt out of "sale" or "sharing," noting that the Developer does not sell or "share" personal information for cross-context behavioral advertising). In practice, a request of this kind will usually be answered by confirming that the Developer holds nothing about you beyond any correspondence you began. To make a request, contact the Developer using Section 24.

14. Data Retention

The Developer operates no user database and therefore retains no user records. Local data on your Mac is retained until you delete it, and is under your control alone. Standard server logs held by our hosting providers are retained by those providers under their own retention schedules and are not exported or aggregated by the Developer. Support and feedback correspondence is retained only as long as necessary to address your request and for reasonable record-keeping, and is deleted on request.

Analytics, if you enabled them. Event-level data is retained by Google for two months, the shortest window the platform offers, after which only aggregate counts remain. The Developer reads those aggregates and exports nothing. Because no identifier ties the data to you, an individual record cannot be located to delete on request; switching analytics off stops all further collection immediately, and deleting the App destroys the app-instance identifier that linked one install's events together.

15. Children's Privacy

Catalyst is an advanced developer tool that involves system-administration privileges. It is not directed to children under the age of 13 (or the higher minimum age that may apply in your jurisdiction). The Developer does not knowingly collect personal information from anyone, children included. If you believe a child has provided information in a manner inconsistent with this Policy, contact the Developer so it can be addressed.

16. International Users & Regional Rights

The static files the App downloads are served from global content networks operated by GitHub and Vercel, which may serve your request from, and log it in, jurisdictions including the United States, the European Union, and India; those providers maintain their own safeguards. To the extent applicable, residents of certain regions have specific rights under laws such as the GDPR and CCPA/CPRA, as described in Section 13. By using the App, you consent to the limited processing described in this Policy in the jurisdictions where the App and its providers operate.

If you enable analytics, the events in Section 6 are processed by Google on infrastructure that includes servers in the United States, and Google relies on the European Commission's Standard Contractual Clauses for transfers out of the EEA and the UK. The lawful basis for this processing is your consent under Article 6(1)(a) GDPR, given at the acceptance screen described in Section 6.3 — which is shown before any collection begins and carries a one-click refusal — and withdrawable at any time from the About screen with immediate effect; withdrawing it does not affect the lawfulness of processing carried out beforehand. If you do not enable analytics, no personal data is transferred by the App at all, because none is transmitted.

17. System Modification Disclaimer

Catalyst executes privileged shell commands (including brew, pip, sudo, and edits to system and shell configuration files). The App is not a passive tool; it actively modifies your operating system and environment at your direction. You acknowledge that using features such as the Cruft Sweeper, system-wide package installations, or shell-profile edits carries a real risk of data loss or system instability, for which the Developer is not liable. You are responsible for maintaining your own backups and for reviewing each action before you confirm it.

18. Disclaimer of Warranties

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE APP AND ALL CONTENT, FEATURES, AND SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITH ALL FAULTS AND WITHOUT WARRANTY OF ANY KIND. THE DEVELOPER EXPRESSLY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, ACCURACY, AND NON-INFRINGEMENT.

THE DEVELOPER DOES NOT WARRANT THAT THE APP WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE; THAT SYSTEM ENVIRONMENTS OR CONFIGURATIONS WILL BE PRESERVED WITHOUT CORRUPTION OR LOSS; OR THAT DEFECTS WILL BE CORRECTED. YOU ASSUME TOTAL RESPONSIBILITY AND RISK FOR YOUR USE OF THE APP. SOME JURISDICTIONS DO NOT ALLOW CERTAIN WARRANTY EXCLUSIONS, SO SOME MAY NOT APPLY TO YOU; IN SUCH CASES WARRANTIES ARE LIMITED TO THE MINIMUM EXTENT PERMITTED BY LAW.

19. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE DEVELOPER, OR ANY OF ITS AFFILIATES, CONTRACTORS, OR REPRESENTATIVES, BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, SOURCE CODE, OR SYSTEM INTEGRITY, ARISING OUT OF OR RELATING TO YOUR ACCESS TO, USE OF, OR INABILITY TO USE THE APP, REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

TO THE FULLEST EXTENT PERMITTED BY LAW, THE DEVELOPER'S TOTAL CUMULATIVE LIABILITY FOR ANY AND ALL CLAIMS ARISING OUT OF OR RELATING TO THE APP OR THIS POLICY SHALL NOT EXCEED THE GREATER OF (i) THE TOTAL AMOUNT YOU ACTUALLY PAID TO THE DEVELOPER FOR THE APP IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM (WHICH, THE APP BEING FREE, IS ORDINARILY NIL), OR (ii) FIVE U.S. DOLLARS (US $5.00). YOU ACKNOWLEDGE THAT THESE LIMITATIONS ARE AN ESSENTIAL BASIS OF THE BARGAIN. SOME JURISDICTIONS DO NOT ALLOW CERTAIN LIMITATIONS, SO SOME MAY NOT APPLY TO YOU; IN SUCH CASES LIABILITY IS LIMITED TO THE SMALLEST AMOUNT PERMITTED BY LAW. NOTHING HEREIN EXCLUDES LIABILITY THAT CANNOT LAWFULLY BE EXCLUDED.

20. Indemnification

To the maximum extent permitted by applicable law, you agree to defend, indemnify, and hold harmless the Developer and its affiliates, contractors, and representatives from and against any and all claims, liabilities, damages, losses, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to your use of the App, your execution of destructive or privileged system commands, your violation of this Policy or the Terms & Conditions, or your infringement of any third-party right.

21. Assumption of Risk & Release

You knowingly and voluntarily acknowledge that installing, cleaning, modifying, migrating, or otherwise administering a macOS developer environment carries inherent risks — including accidental deletion of files or repositories and corruption of system or Python environments — and you assume full and exclusive responsibility for all such risks. To the maximum extent permitted by applicable law, you release, waive, and forever discharge the Developer from any and all claims arising out of or relating to your use of the App, including any data loss, financial loss, or damage of any kind.

22. Governing Law & Dispute Resolution

This Policy and any dispute arising out of or relating to it or the App shall be governed by and construed in accordance with the laws of India, without regard to its conflict-of-laws principles, except where the mandatory consumer-protection or data-protection laws of your country of residence apply and cannot be excluded. The dispute-resolution and arbitration provisions of the Terms & Conditions apply equally to this Policy.

23. Changes to This Policy

The Developer may update this Policy from time to time to reflect changes to the App, legal requirements, or operational practices. When the Policy changes, the version number and effective date at the top of this page are updated. The App checks the published version at most once every 14 days and, when it differs from the version you last accepted, asks you to review and accept the new one before you continue. That check transmits nothing about you; it downloads a file containing version numbers. Your continued use of the App after a revised Policy takes effect constitutes your acceptance of the changes. If you do not agree, you must stop using and uninstall the App.

24. Contact

If you have any questions, concerns, or requests regarding this Policy or your data, you may contact the Developer:
The App Foundry — theappfoundryco@gmail.com.

This document is provided for informational purposes and does not constitute legal advice. The Developer recommends consulting a qualified attorney to confirm this Policy meets all legal requirements applicable to the App's distribution markets.