We can’t see your files.

We built Smol because the existing tools quietly inverted the deal: you got a service, they got your files. We didn’t want to run that business, so we built one that runs entirely on your Mac. Everything below follows from these four rules:

• Your files never leave your Mac. Compression happens locally. The Smol app does not upload your images, PDFs, or videos to any server, ever — not anonymized, not “temporarily,” not for “analytics.”
• We collect the minimum data to sell you software. Your email address, your license key, your purchase receipt. The whole list is on this page.
• We don’t track you. No analytics on the website. No telemetry in the app. We use the X (Twitter) pixel on the checkout pages only, to measure whether our ads lead to purchases — nothing else. No third-party cookies outside of that.
• We don’t sell, rent, or share your data. The only people we share data with are the companies who help us run the business (Stripe for payments, our email provider for receipts). The complete list is in §05.

Here’s the entire list, organized by when we collect it. If it’s not on this list, we don’t have it.

smolmac.com is a static website hosted on Cloudflare Pages. There is no analytics provider, no session-replay tool, and no third-party fonts that phone home.

Cloudflare automatically logs the IP address, user-agent, and request path for every visit to the site. We do not access these logs except for debugging or security incidents. They are kept for a short period and then deleted by Cloudflare. Cloudflare’s privacy policy →

X (Twitter) conversion pixel. The checkout pages (/buy and /buy/success) load the X pixel. It fires three events: when you view the checkout page, when you complete your payment details, and when your purchase is confirmed. At the purchase step it sends the plan you bought, the price, and your email address to X so we can measure whether our ads on X lead to sales. X may set cookies for this purpose. If you arrived at this site organically and not from an X ad, the pixel still loads but has nothing to attribute. You can opt out via X’s ad settings →

Outside of the checkout pages, the site sets no cookies. There is no login, no newsletter form, no comment system. (Stripe’s checkout form does set cookies for its own fraud and session handling.)

The Smol app makes exactly three kinds of network requests during normal operation. We’ll describe each one.

1 — License validation

On first launch (and then once a week thereafter), the app sends your license key and a hashed identifier of the Mac it’s running on to our license server. The server responds with “valid” or “invalid.” That’s the entire conversation. If the app can’t reach the server, it keeps running offline for up to 30 days.

2 — Update checks

The app checks for updates by fetching a small JSON file from our update server. The request includes your current app version and macOS version so we send you the right build. We do not log who asked.

3 — Crash reports (opt-in)

If you check “Send anonymous crash reports” in Preferences, the app sends us a stack trace when it crashes. We strip filenames, file paths, and anything that could identify the file you were working on. The setting is off by default.

Running a software business requires a few outside vendors. Here are all of them and what data they receive:

• Stripe — processes your payment. Receives your card details, billing address, email, and purchase amount. We see only the summary they return. Stripe’s privacy policy →
• Cloudflare — hosts the website and the license-validation server. Receives request data (IP, user-agent, path). Used for delivery and abuse prevention. Cloudflare’s privacy policy →
• Resend — sends you your license key and receipt. Receives your email address and the contents of the email we’re sending you. We do not run marketing campaigns through this provider. Resend’s privacy policy →
• X Corp (Twitter) — conversion pixel on checkout pages only. Receives: the plan you selected, the purchase price, and your email address at the moment your purchase is confirmed. Used solely to measure whether our ads on X lead to purchases. X may use this data under their own privacy policy. X’s privacy policy →

That’s the entire list. If we ever add a vendor, we update this page first — the version number at the top of the page changes and we mark the change in §11.

• Purchase records and receipts: 7 years. We’re required to keep these for tax purposes.
• Your license key: as long as your license is valid. If you ask us to delete your account, we mark the key revoked and remove the personally identifiable parts of the record.
• Crash reports: 90 days, then deleted.
• Server logs: Cloudflare’s defaults — days, not months.
• Email correspondence with support: 2 years, so we have context if you write again.

Whether or not the law requires it where you live, you can do all of the following by emailing us at [email protected]. No special forms, no friction, no “please verify your identity by uploading your passport.” Just write to us from the email address on the purchase.

• Get a copy of your data. We’ll send back everything we hold about you, usually within 7 days.
• Correct your data. Change of email, wrong spelling on the receipt — just ask.
• Delete your data. We’ll delete the record and revoke the license. If we’re legally required to keep parts of it (taxes), we’ll explain what stays and why.
• Object or restrict processing. Tell us what you’d like us to stop doing and we’ll figure out how.
• Take your data with you. We can export your records as JSON or CSV.
• Complain to a regulator. If you’re in the EU or UK, you can file with your local data-protection authority. We’d rather you write to us first so we can fix it, but it’s your call.

We don’t charge for any of this. We don’t make you jump through automated forms. A human reads your email.

Smol is a paid productivity tool for grown-ups. It’s not directed at children under 13 (or under 16 in the EU). We don’t knowingly collect data from anyone in that age range. If you’re a parent or guardian who believes we’ve received data from your child, email us at [email protected] and we’ll delete it immediately.

• In transit: everything goes over HTTPS / TLS 1.3.
• At rest: our databases are encrypted at rest with AES-256.
• Card data: never touches our servers. Stripe handles it under their PCI-DSS Level 1 certification.
• Access: only the founders have access to customer records. There’s no team yet.
• Backups: encrypted, geographically separate, tested.

No system is perfectly secure. If we ever discover a breach affecting you, we will tell you directly — not via a press release — within 72 hours of becoming aware, with a clear explanation of what happened, what was exposed, and what we’re doing about it.

Customer records live on infrastructure in San Francisco, California and on Cloudflare’s global edge. Stripe and Resend operate globally and may process data in the United States, Europe, or other regions. By buying Smol, you understand that your data may be transferred to and processed in countries other than your own, including the United States. We rely on standard contractual clauses with all vendors for these transfers.

We’ll change this policy as the business changes. When we do:

• The version number and the “Last updated” date at the top of this page change.
• We’ll publish a one-line changelog at the bottom of this section so you can see what moved.
• For material changes (new vendor, new category of data, new purpose), we’ll email everyone with an active license at least 30 days before the change takes effect.

Changelog

• v1.1 — May 17, 2026 — Added X (Twitter) conversion pixel disclosure in §01, §03, and §05.
• v1.0 — May 13, 2026 — Initial policy.

Smol is operated by an indie team based in San Francisco, California. If you need a postal address for legal correspondence, email us first and we’ll send it.

For anything privacy-related — access, deletion, questions, weirdness — write to:

[email protected]