Terms & Privacy Policy

These terms set out the rules for using the “Mac Explorer” app (the “App”) and the website available at mac-explorer.com (the “Website”), as well as the rules for purchasing a license for the App.

The service provider and the entity responsible for the App and the Website is IT.focus Jakub Król, ul. Warmińska 8/6, 44-335 Jastrzębie-Zdrój, Poland, VAT ID: PL6332194440 (“we,” the “service provider”).

The App is a native file manager for macOS, designed in particular for developers and people switching from Windows.

• The App can be downloaded and used free of charge during a trial period lasting 30 days.
• After the trial period ends, continued use of the App requires purchasing a license in one of the available variants (Personal, Small Team, Company).
• A license covers a specific number of devices and grants the right to free updates up to every major version within the purchased license.
• The license is a one-time payment — it is not a subscription and does not renew automatically.

The sale of licenses, payment handling and tax settlement is carried out on our behalf by an external partner operating under the Merchant of Record (MoR) model — Polar Software, Inc. This means that Polar acts as the official seller (reseller) of the license to the end customer and takes on the obligations related to taxes (VAT, sales tax, etc.), payment handling and fraud prevention. Polar uses the payment infrastructure of Stripe, Inc.

In practice this means that:

• We do not handle or store payment card data — this is done exclusively by the billing partner and its payment provider.
• We do not issue invoices or receipts directly — sales documents and payment confirmations are issued by the Merchant of Record.
• Managing your purchased license, payments, refunds or billing data takes place in the customer portal provided by the billing partner.
• Even so, we're always happy to help — if anything needs clarification or intervention, just contact us and we'll walk you through the process.

Complaints regarding the operation of the App can be submitted via the support form. We handle them without undue delay, no later than within 14 days.

Because the subject of the sale is digital content (a software license) and delivery is immediate, a consumer's right to withdraw from the contract may be limited if performance began with the consumer's explicit consent before the withdrawal deadline. Refund matters are handled in accordance with the Merchant of Record's policy and applicable law — we'll help you get in touch with the billing partner.

• The App is provided “as is,” with the utmost care taken over its quality, security and performance.
• In matters not covered here, Polish law applies, in particular the Civil Code and the Consumer Rights Act.
• We reserve the right to change these terms; changes do not affect acquired rights. We will announce significant changes on the Website.

The controller of your personal data, in accordance with Art. 4(7) GDPR, is IT.focus Jakub Król, ul. Warmińska 8/6, 44-335 Jastrzębie-Zdrój, Poland, VAT ID: PL6332194440. For all matters concerning the protection of personal data, you can contact us via the support form.

Data Protection contact. For questions about how your data is protected, or to exercise any of your rights described in Section 13 (access, rectification, erasure and others), write to us through the same support form with the subject “Data protection request.” Every such request is handled personally by the controller and answered within 30 days, in accordance with Art. 12(3) GDPR.

We process data to the minimum extent necessary, for the following purposes:

• Analytics data about the use of the Website (e.g. visited pages, approximate location, device and browser type, statistical data) — to analyze traffic, improve services and develop the product. This data is aggregated and statistical in nature.
• Contact data you provide voluntarily when writing to us (e.g. email address and message content) — to respond to and handle your request.
• Data related to the purchase of a license (transaction and billing data) — processed primarily by the billing partner under the Merchant of Record model; only limited information necessary for license handling and support may reach us.

• Art. 6(1)(f) GDPR (the controller's legitimate interest) — for analytics, service development and security, and handling correspondence.
• Art. 6(1)(b) GDPR (performance of a contract) — for providing and handling the App license.
• Art. 6(1)(c) GDPR (legal obligation) — for any tax and accounting obligations (fulfilled mainly by the Merchant of Record).
• Art. 6(1)(a) GDPR (consent) — for cookies and analytics technologies that require consent, where we use them.

In connection with the use of external service providers, your data may be entrusted to the following categories of recipients, under data processing agreements (Art. 28 GDPR):

• The Website's hosting and analytics provider (Vercel Inc.) — infrastructure and aggregated visit statistics (Vercel Analytics, without cookies).
• The behavioral analytics provider (Google LLC) — Google Analytics 4, only after the user gives consent.
• The Merchant of Record billing partner (Polar Software, Inc.) and its payment provider (Stripe, Inc.) — handling sales, payments and tax settlement.
• The provider of the releases and updates repository from which the App downloads new versions.

We place great importance on privacy. The App is cut off from the internet by default and connects to the network only in order to:

• check for and download updates,
• handle the trial period,
• verify and activate a license.

Beyond the cases above, the App does not send any data to our servers — including telemetry data or anonymous usage statistics. The names and contents of your files never leave your device because of the App. If you configure your own script or action that uses the network, that is your deliberate, local decision and not an action of the App's core.

Optional Google Drive access (Limited Use). If you choose to, you can sign in with your Google Account so the App can connect directly to your own Google Drive — giving you a native Finder-like view of your files with better performance and higher transfer limits than an unauthenticated connection. This feature is entirely optional and off by default.

Our use of the data and scopes obtained through this Google sign-in is limited as follows:

• The access and refresh tokens returned by Google are used exclusively to let the App act on your behalf when you browse, open or transfer your own files to and from your own Google Drive — i.e. solely to provide and improve this specific, user-facing feature of the App.
• The tokens never leave your Mac. They are written only to a local rclone configuration file, which is itself encrypted; the encryption password protecting that file is generated locally and stored in the Apple Keychain on your device. We do not receive, see or store this data on any server we operate.
• We do not read, inspect, analyze, log, retain or otherwise process the contents, names or metadata of your Google Drive files, nor your Google account profile data, beyond what is technically necessary, in that moment, to carry out the specific action you requested (e.g. listing a folder or copying a file) — and it is not persisted afterward.
• This data is never used for advertising or any advertising-related purpose, never used to build profiles, never sold, and never shared with any third party other than Google itself, and only to the extent needed to relay your own request to your own Drive.
• No employee, contractor or other human at IT.focus reads or otherwise accesses your Google user data.

This complies with the requirements of the Google API Services User Data Policy, including its Limited Use requirements. You can revoke the App's access at any time from your Google Account permissions page, or by removing the connection inside the App itself, which also deletes the local, encrypted token.

We apply the principle of data minimization: wherever possible, sensitive data (such as OAuth tokens granting access to your Google Drive, or the contents of your files) is processed locally on your device and never reaches our servers at all — there is nothing for us to protect centrally because we never hold it.

To protect the data that is, by design, kept locally, we use the following mechanisms:

• Encryption at rest — the rclone configuration file holding your Google Drive tokens is encrypted, and the password protecting it is generated on your device and kept in the Apple Keychain, macOS's own secure credential store.
• No server-side storage — access tokens, refresh tokens and file contents obtained via Google APIs are never transmitted to, logged by, or stored on any infrastructure we operate.
• Access control — this data is readable only by the App running under your local macOS user account; we have no remote access to it.
• Revocation — you can disconnect the integration and delete the local token at any time from within the App or from your Google Account permissions page (see Section 10).
• Data minimization and retention limits — for the analytics, correspondence and transaction data we do process (Section 7), we keep only what is necessary for the stated purpose and for the periods described in Section 12.

To exercise your rights over any personal data we do hold — including requesting a search, update, export or deletion of your data — use the Data Protection contact described in Section 6.

• Analytics data — for the period necessary for statistical purposes, in accordance with the analytics services' settings.
• Correspondence — for the time necessary to handle the matter and for the limitation period of any claims.
• Transaction data — for the period required by tax and accounting regulations (fulfilled mainly by the Merchant of Record).

In connection with the processing of data, you have the following rights:

• the right to access your data and receive a copy of it,
• the right to rectification (correction) of your data,
• the right to erasure of your data (“the right to be forgotten”),
• the right to restrict processing,
• the right to data portability,
• the right to object to processing based on a legitimate interest,
• the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal),
• the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

How to exercise these rights.Send your request through the Data Protection contact described in Section 6 (support form, subject “Data protection request”). Please describe which right you want to exercise; if needed, we may ask you to confirm your identity so we don't hand your data to the wrong person. We respond within 30 days, as required by Art. 12(3) GDPR.

Some of our providers (including Vercel, Polar, Stripe) are based outside the European Economic Area, in particular in the USA. In such cases, data transfers take place based on GDPR-compliant mechanisms, such as standard contractual clauses (SCCs) or other permissible transfer bases.

The Website uses cookies for analytics purposes (Google Analytics 4) and, after consent, for an advertising conversion-measurement pixel (OpenAI), described below. We do not sell data, and none of these technologies are used within the App itself — the App remains ad-free and does not profile its users (see Section 10).

Google Analytics 4 (Google LLC, USA). If consent is given, the Website loads the production stream G-7KRV2M9FZJ. GA4 may set cookies (including _ga, _ga_*) stored for up to 2 years. Data may be transferred to the USA based on standard contractual clauses (SCCs).

OpenAI conversion pixel (OpenAI OpCo, LLC, USA).If consent is given, the Website loads OpenAI's “oaiq” script, which measures whether a visitor who arrived from an OpenAI/ChatGPT advertisement went on to complete an action on the Website (e.g. starting a trial or purchasing a license). This lets us evaluate the effectiveness of ads run through OpenAI, and may involve OpenAI setting its own cookies or similar identifiers and processing data as an independent controller under its own privacy policy. It is used only on the Website, only after consent, and is never active inside the App.

Consent Mode v2. Before consent is given, all analytics services are disabled by default (analytics_storage: denied). GA4 and the OpenAI pixel are loaded only after clicking “Accept” in the cookie banner. The decision is stored in the browser's localStorage and a first-party consent cookie.

Vercel Analytics.The Website uses Vercel's built-in analytics (Vercel Inc., USA), which collects aggregated traffic data (page views, visitor country) without using cookies and without the ability to identify a specific user.

How to manage consent and cookies. You can withdraw or change your consent to analytics and advertising cookies at any time using the Cookie settings control in the Website footer or by clearing site data in your browser settings. You can also use the Google Analytics Opt-out Browser Add-on or your browser's privacy settings. Not accepting analytics or advertising cookies does not affect your ability to use the Website.

We may update this policy to reflect changes in our services or in the law. The current version is always available on this page, and we state the date of the last update above.