The short version
- We collect what it takes to sell you an app, keep your licence working and help you when something goes wrong: your email address and name, your orders, your licences and the Macs they are activated on, and anything you send to support.
- Payments go through Stripe. We never see or store your card number.
- We count visits to this website with our own simple analytics, kept on our own server in Australia. We don’t store your IP address, use no cookies for it and share it with no one. There’s no advertising and there are no third-party trackers. Our apps don’t send usage data.
- We don’t sell, rent or trade your information.
- You can ask to see, correct or delete your information at any time.
Who we are
JNP Software is run by James North, an Australian musician and producer, with a small team who look after support, development and beta testing. In this policy, “we” and “us” means JNP Software.
This policy covers this website (jnp.software), your account here, and the information our Mac apps send to us. Our terms cover buying and using the apps.
What we collect, and why
Your account
Your email address and name. An account is created for you when you buy something, sign in, open a support ticket or sign up to test a beta. We use it to show you your orders, licences and tickets, and to email you about them.
You never set a password. Instead we email you a sign-in link, which works once and expires after 15 minutes. We keep only a one-way hash of each link’s secret part, so our records can’t be used to sign in as you.
Orders
When you buy, you pay on Stripe’s checkout page. Stripe tells us your name, your email address, what you bought, what you paid and a Stripe customer reference, and we keep those as your order. Stripe handles your card details and, if it asks for one, your billing address. We never see your card number.
Licences
For each licence we keep its key, the app it’s for, the email address it belongs to, where it came from (a purchase, a gift, a beta link and so on) and whether it’s active. Your email address is also written into the licence the app stores, which is why the app shows “Licensed to” followed by your email.
Activations
When you activate an app on a Mac, the app sends us your licence key, a machine ID, your Mac’s name (the one set in macOS, such as “Sam’s MacBook Pro”) and its macOS version. We store these with the date you activated.
The machine ID is a one-way hash of your Mac’s hardware UUID. It lets us recognise the same Mac again, and it can’t be turned back into the UUID. It’s the same in each of our apps, which is how your account page shows one Mac across several apps. You can see your Macs on your account page and remove any of them there.
Trials
When you start a trial, the app sends us the same machine ID, your Mac’s name and its macOS version. We record those with the date the trial began, so that reinstalling the app doesn’t restart the trial. Trial records don’t include your name or email address and aren’t linked to an account.
Weekly check-in
About once a week when your Mac is online, and on the first launch after an update, each app asks our server whether there’s a newer version. It sends the version you have and whether that copy is for Apple silicon or Intel Macs. A licensed app also sends its licence (which contains the licence key, your email address and the machine ID) so we can tell it whether the licence is still active, for example if it has been cancelled. We don’t store these check-ins.
Apart from starting a trial, activating, removing a Mac, checking for updates and fetching a download, our apps don’t contact us. They don’t send analytics, crash reports or anything about your files or how you use the app.
Support tickets
Everything you send us through support: your name and email, the app, the app and macOS versions if you give them, your messages, any attachments (up to five files of 20 MB each) and our replies. Our team may also add internal notes to a ticket to help each other. If you open a ticket without signing in, we create an account for your email address so you can follow the ticket, and email you a link to it.
Beta testers
When you sign up through a beta link, we take your email address and, if you give it, your name. We create an account, issue you a tester licence and email you a sign-in link.
Web server logs
Like nearly every website, our server records each request it receives: your IP address, the date and time, the address requested and your browser’s user agent. We strip licence keys and download tickets out of the logged addresses, and we never log cookies or the licences apps send. These logs are kept for up to 30 days and are used only to keep the site running and secure.
The server also runs CrowdSec, a security tool that blocks addresses caught attacking the site (scanning for weaknesses, for example). An address caught doing that may be shared with CrowdSec’s community blocklist.
Launch list
If you press Notify me on an app that isn’t out yet, we keep your email address and which app you asked about. We first email you a link to confirm it’s your address (unless you’re signed in as that address), and once you’ve confirmed we send you one email when that app launches. Joining the list doesn’t create an account. Every launch email has an unsubscribe link.
Website visits
We count visits to this website with our own analytics, which run on our own server in Australia. For each page you view we record:
- the page, and the site that linked you to it if your browser tells us
- any campaign tags in the link you followed (such as utm_source)
- your rough location (country, region and city), looked up from your IP address when you visit
- your browser, operating system and type of device
- an anonymous visitor code that changes every day
The visitor code is made by scrambling your IP address and browser details with the date and a secret key. It lets us count how many people visited on a day, and it can’t be turned back into your IP address. We don’t store your IP address with any of this.
We also record how long a page stayed open, links you follow to other websites, and a few actions in the shop: downloading a trial, adding an app to your cart and starting checkout. To group the pages of one visit, your browser keeps a random visit number in its session storage, which it deletes when you close the tab.
This uses no cookies, doesn’t follow you to other websites, and isn’t shared with anyone. We use it to see which pages help people and how they find us. Visits from our own team aren’t counted.
Cookies
We use one cookie: when you sign in, a session cookie keeps you signed in. It’s removed when you sign out or when the session expires. If you never sign in, we don’t set it.
There are no advertising or tracking cookies, and the site loads no third-party scripts. Our visit counting doesn’t use cookies (see Website visits). Your cart is remembered in your browser’s local storage so it survives a page refresh. It stays in your browser and isn’t sent to us until you check out. The currency you pick for approximate prices is kept there too. Until you pick one, we suggest one from the country your IP address points to, looked up as the page loads and not stored.
When you pay, you’re on Stripe’s checkout page, which sets its own cookies (mainly to prevent fraud) under Stripe’s privacy policy.
Who else handles your information
We use a few service providers to run the shop. Each gets only what it needs for its job.
| Provider | What they do | Where |
|---|---|---|
| Our own servers | This website, our database, licensing and our visit statistics | Australia |
| Stripe | Payments: your card details, billing details, name and email | United States and elsewhere |
| Postmark | Sends our emails: receipts, sign-in links and ticket replies | United States |
| iDrive e2 | Private file storage for app downloads and support attachments | Singapore |
| Apple iCloud Mail | Hosts our support inbox, which receives a copy of new tickets and your replies | United States |
| Cloudflare | DNS for jnp.software (turning the name into our server’s address). Traffic to the site doesn’t pass through Cloudflare. | United States |
Because some of these providers are outside Australia, your information may be stored or processed in the United States or Singapore. We choose providers who protect it to a standard comparable to Australian privacy law.
We don’t sell, rent or trade your information, and we don’t use it for advertising. We’ll only hand it to anyone else if the law requires us to.
Emails we send
We email you about things you’ve done or asked for: receipts, licences, sign-in links, beta downloads and replies to your tickets. If you own an app, we email you when a new version of it comes out, and if you joined an app’s launch list, we email you once when it launches. Both have an unsubscribe link. We don’t send newsletters or other marketing email.
How long we keep it
- Your account, licences and activations for as long as you have an account. Licences are meant to last a lifetime, so we don’t delete them on a timer.
- Orders for as long as Australian tax law requires (generally five years), even if you ask us to delete your account.
- Trial records are kept so a trial can’t be restarted. They don’t include your name or email address.
- Support tickets are kept so we have the history if you come back to us. Ask and we’ll delete them.
- Sign-in links are useless after 15 minutes.
- Launch list sign-ups until you unsubscribe or ask us to remove them. After an unsubscribe we keep just enough to make sure you don’t hear from us about that app again.
- Web server logs for up to 30 days.
- Website visit records for 400 days, after which they’re deleted automatically.
Keeping it safe
The site only works over HTTPS. App downloads and support attachments are kept in private storage and handed out only through short-lived links, after we’ve checked who is asking. Sign-in links are stored as one-way hashes. Our staff tools can only be reached from our private network.
No system is perfect. If we ever have a data breach that’s likely to cause you serious harm, we’ll tell you, and the regulator where the law requires it.
Seeing, correcting and deleting your information
You can ask us at any time for a copy of what we hold about you, to correct it, or to delete it. Email software@jamesnorth.productions or open a ticket at /support. We may ask you to confirm the request from the email address on your account. It’s free, and we’ll reply within 30 days, usually much sooner.
You can remove a Mac from a licence yourself on your account page. If you ask us to delete your account, we’ll explain what that means for your licences first, and we’ll keep order records for as long as tax law requires.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988. If you’re not happy with how we’ve handled a privacy concern, please tell us first so we can put it right. If we can’t, you can contact the Office of the Australian Information Commissioner at oaic.gov.au. If you live somewhere with its own privacy laws, such as the EU or the UK, you have the rights those laws give you as well, and we’ll honour them.
Changes to this policy
If we change how we handle your information, we’ll update this page and the date at the top. If the change is a significant one, we’ll also let you know by email or on the site.
Contact
Questions about privacy go to software@jamesnorth.productions, or open a ticket at /support. A real person on our team will answer.