Privacy
The app
The Kelmscott Mac app only collects data if you opt in. In Settings > Privacy there is one switch, off by default: Send daily feature counts. Beside it the app shows the exact message it would send. Your files stay on your Mac; nothing is collected about the content of your documents.
What is sent, if you turn it on
One message a day, about the day just counted. It contains the date; the app version (major and minor only); the macOS major version; the language the app runs in, or “other”; whether Studio is on; a schema number; and, for each of twenty named features, one of four bands saying how often you used it that day (not at all, 1 to 9, 10 to 99, 100 or more). The app sends the message once, at a randomly chosen minute while it is running, and never retries. A day counted while the switch was off is never sent.
The message carries no identifier. There is no device ID, no install ID and no hash. Nothing in it connects it to you or to another day’s message. When few people have the switch on, a message may still be the only one of its kind in a month. We will not try to link any message to a person or to any other data we hold, including support email and sales records.
Your Mac’s network address reaches Cloudflare, which carries the message to us. Cloudflare is our processor and handles the address under its own policy. Our receiving service does not read, store or log the address. A rate limiter holds it in memory for up to sixty seconds. Request logging is off for that service.
Cloudflare Workers Analytics Engine keeps the raw rows for three months, then deletes them. We keep monthly totals, which contain no rows. Messages from beta builds go to a separate dataset, and the totals never read it. Turning the switch off stops future messages and drops any message waiting to be sent. We cannot delete a message that has already been sent, because nothing in it says whose it is (GDPR Article 11(2)). We do not try to re-identify any message.
If you ask Siri about a document you have open in Kelmscott, on a Mac where Apple offers that, Kelmscott gives Siri the text of that document. Siri handles it on your Mac or on Apple’s Private Cloud Compute, or through a third-party extension if you have one enabled, under that provider’s terms. Kelmscott does not see your question or Siri’s answer.
Crash reports use Apple’s MetricKit, which is aggregate and opt-in through System Settings. The Direct-download build can also use Sentry, off until you turn it on in the app’s preferences, with personal-data filters on. You can turn either off at any time. The App Store build contains no Sentry code.
Kelmscott keeps a safety copy of unsaved work on your Mac so you can recover it after a crash. Pasted or piped text is copied within moments of arriving. A new document is copied once you start editing it. The copy lives in the app’s own Application Support folder, is excluded from Time Machine backups, and never leaves your Mac. Kelmscott deletes it when you save, when you choose Delete on closing, or when you close a pasted or piped window you never edited. After a crash, the copy opens in its own window the next time you start the app.
This website
kelmscott.app uses Google Analytics 4 to count visits and see which pages people read. IP addresses are anonymized. We run no advertising and no retargeting, and set no third-party cookies beyond Google Analytics.
To opt out of analytics on this site, use a tracker blocker such as uBlock Origin or Privacy Badger, turn on your browser’s “Do Not Track” setting, or browse in private mode.
Data controller
Tideswell Group LLC is the data controller for this site and for the Kelmscott app. Contact: privacy@kelmscott.app.
Lawful basis
We run site analytics on the basis of our legitimate interest in knowing which pages people read. The analytics use anonymized IP addresses, with no advertising, no retargeting and no cross-site tracking. You can opt out with a tracker blocker, your browser’s Do Not Track setting or private browsing (see This website above), or email privacy@kelmscott.app to ask for deletion. We handle correspondence on the basis of our legitimate interest in replying to it.
Your rights
The feature counts carry no identifier, so there is nothing in them these rights can act on (see “What is sent” above). The rights apply to website analytics and to any correspondence with us:
- Right of access: ask what we hold about you.
- Right to rectification: ask us to correct anything inaccurate.
- Right to erasure: ask us to delete what we hold.
- Right to restrict or object to processing.
- Right to data portability for any data we hold.
- Right to lodge a complaint with a supervisory authority. EU residents can complain to their national data protection authority. UK residents can complain to the ICO.
To exercise any of these, email privacy@kelmscott.app.
Retention
Google Analytics 4 keeps user-level data for 14 months by default. Feature-count rows expire after three months; we keep the monthly totals. We keep email sent to privacy@kelmscott.app only as long as it takes to deal with it.
International transfers
Google Analytics 4 processes data on Google’s infrastructure, including servers outside the EU and UK. Those transfers run under Google’s Data Processing Terms and Standard Contractual Clauses. IP anonymization limits what is transferred.
Changes to this notice
We update this notice when our practices change. We flag material changes at the top of the page when they happen.
Contact
Questions about this notice: privacy@kelmscott.app.
Last updated: 21 September 2026.