Mounted

Privacy Policy

Last updated: 29 September 2026

This is the seller’s privacy policy for Mounted and getmounted.app. We collect as little as we can. This page explains what we do collect, why, and your choices.

Who is responsible

Salvador Bettencourt Avila, a sole trader trading as Mounted and based in the United Kingdom, is responsible for your personal data (the data controller). You can contact us about privacy at [email protected].

What stays on your Mac

Your shares, groups, server names, Mount At paths and settings are stored on your Mac. Share passwords are stored in the macOS Keychain on your Mac. None of this is sent to our servers.

Licensing

When you activate or deactivate a licence, and when Mounted checks your licence (about once a day, and before it checks for updates), the app sends your licence key and a device identifier to our licensing service. The device identifier is a Mounted-specific SHA-256 hash derived from your Mac’s hardware UUID. It is not your Mac’s serial number.

Like any web request, these requests reveal your IP address. Our licensing service uses it to limit abuse, and Cloudflare may keep it briefly in service logs.

Our licensing service stores:

  • a SHA-256 hash of your licence key, never the key itself;
  • the hashed device identifier of the Mac where your licence is active;
  • licence and update coverage records;
  • purchase records from Paddle: Paddle transaction and customer IDs, purchase times, and any refunds or adjustments.

We use this to confirm your licence, keep it to one Mac at a time and apply refunds.

Licence key recovery

So you can recover a lost licence key, Paddle sends us the email address you used at checkout. We store it only as a keyed hash plus an encrypted copy used to send recovery emails. We never store it in plain text.

When you ask for a recovery code, we email it to that address. The address you type to ask for a code is used only to find a matching purchase and isn’t stored. Recovery codes are stored only as hashes and expire after 15 minutes.

Payments

Paddle is the Merchant of Record for all our orders. Paddle handles your payment and billing details and sends your receipt. We never receive your card number.

Update checks

Mounted checks our update feed using Sparkle, a standard macOS update framework. Sparkle’s anonymous system profiling is turned off, so no system profile is sent. Like any web request, an update check reveals technical details such as your IP address to the server that hosts the feed.

We count app downloads, update checks and update downloads with Umami. For each we record the file, the app version and your country. Cloudflare works out the country from your IP address. The address itself isn’t passed to Umami, and we don’t keep it.

This website

getmounted.app is hosted on Cloudflare. Cloudflare processes technical request data, such as IP addresses, to serve and protect the site.

We count visits with Cloudflare Web Analytics. It records the page you viewed, the site that linked to it, your browser, your country and how quickly the page loaded. It uses no cookies and no fingerprinting, and it doesn’t follow you across other sites.

We also use Umami to see which pages lead to downloads and purchases. It records the same kind of information, plus clicks on the download link and the steps of checkout. For a purchase it records the amount and currency, never your name, email address or payment details. Umami uses no cookies and stores nothing on your device.

The site has no advertising scripts and sets no marketing cookies.

If you email us, we use your email address and message to reply to you.

Who else handles your data

  • Paddle: payments, invoicing, tax and receipts. As Merchant of Record, Paddle sells Mounted to you and handles your payment and order details under its own privacy policy, not on our instructions.
  • Cloudflare processes data for us: website hosting and analytics, the licensing service and its database, and update hosting.
  • Resend processes data for us: sending licence recovery emails.
  • Umami processes data for us: website analytics.

We do not sell your personal data, and we do not use it for advertising.

How long we keep data

We keep licence and purchase records while your licence exists, and afterwards for as long as we need them for tax, accounting and fraud prevention. Recovery codes expire after 15 minutes. The address and content of each recovery email are deleted once it has been sent, or once sending has failed.

Your rights

Depending on where you live, you may have the right to:

  • access the personal data we hold about you;
  • have it corrected;
  • have it deleted;
  • object to how we use it.

To use any of these rights, email [email protected]. We may need to confirm that the request comes from you, for example by asking for your order details.

Complaints

If you’re unhappy with how we handle your data, please contact us first so we can try to put it right. You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, or to the data protection authority where you live.

Changes to this policy

We may update this policy when Mounted or our providers change. We will post the new version on this page with a new “Last updated” date.