Mac App Index ("we", "us") is a directory of Mac apps available at macappindex.com (the "Site"). The controller of your personal data is Piotr Boroń, al. Solidarności 68/121, 00-240 Warsaw, Poland. You can reach the controller at [email protected].
This policy explains what personal data we process when you visit the Site, create an account, upvote or bookmark apps, submit an app, buy a paid placement or subscribe to our newsletter. We process personal data under the General Data Protection Regulation ("GDPR") and Polish law.
You can sign in with a one-time link sent to your email address (a "magic link") or with Google. We store your name, email address, whether the address is verified, and your profile picture if Google provides one. We do not use passwords. For each sign-in session we store a session token, its expiry date, and the IP address and browser user agent the session was started from.
When you upvote or bookmark an app, we store which account did so and when. The total number of upvotes for each app is public. We do not publish who voted for what. Vote timestamps are used to calculate the Hot ranking described on How we rank.
When you submit an app we store the website and Mac App Store links you entered, your name and email address as the submitter, and any note you add. If you place our badge on your site, we store the address of the page you verified and the dates of each check. If you verify ownership of an app, we send a one-time code to the email address on the app's domain that you enter and store the code until it is used or expires.
The listing itself (app name, description, images, links, developer name) is public. It describes the app, not you, but it can include a developer's name when the app is published under a personal name.
To create and check listings, our servers read the public pages of a submitted app's website and its public Mac App Store data. We use Firecrawl, with Jina Reader as a fallback, to read web pages, ScreenshotOne to capture website screenshots, and Apple's public iTunes Search API for App Store details. An AI model may draft parts of the listing text from this public material. We only fetch publicly accessible pages and never log in to a developer's site.
Paid listings, featured placements and ads are paid through Stripe. Stripe collects your payment details directly; we never see or store your full card number. From Stripe we receive your name, email address, what you bought, the amount and the payment status, and we record the resulting change to your listing.
If you subscribe to our newsletter, or tick the newsletter box when submitting an app, we add your email address (and, from the submit form, your name) to our mailing list at Resend. Every newsletter has an unsubscribe link.
If you report a problem with a listing, we store the type of problem, your message and, if you give it, your email address. If you email us, we keep the correspondence.
Like any website, our servers receive your IP address and browser details with every request. We use your IP address, or your account ID when you are signed in, to limit how often certain actions can be performed (for example submissions, votes and newsletter sign-ups), which protects the Site against abuse. These rate-limit counters expire after at most 24 hours.
We measure traffic with Plausible Analytics. Plausible does not use cookies and does not store IP addresses or other identifiers. It gives us aggregate figures such as page views, referring sites, countries and device types, and it counts clicks on outgoing app links. Nothing in it can be linked to you or your account.
If you accept analytics cookies in our cookie banner, we also use Google Analytics 4, a service of Google Ireland Limited and Google LLC, to measure page views, sessions and traffic sources. Google Analytics receives the page address, a random identifier stored in a cookie, your approximate location derived from a shortened IP address (Google Analytics 4 does not store full IP addresses), and device and browser details. We do not send your name, email address or account details to it, and Google Signals and ad personalisation are switched off in our code. If you are in the European Economic Area, the United Kingdom or Switzerland, or your browser sends Global Privacy Control, Google Analytics does not load at all until you accept.
When ads are shown, they are served by Revinel through our own domain. Revinel records ad impressions and clicks to count them for advertisers and does not set cookies.
We use only what the Site needs to work:
_ga and _ga_*), only if you accept them. They distinguish visits and expire after up to 2 years.The first three are strictly necessary and need no consent under Art. 399 of the Polish Electronic Communications Law. Google Analytics cookies are set only with your consent, which you give or refuse in the cookie banner. You can withdraw it at any time with the "Cookie settings" link at the bottom of every page; Google Analytics stops collecting immediately. We use no advertising cookies.
We do not sell your personal data and do not share it for advertising. We use these service providers, each only for the purpose listed and under data processing terms:
We may also disclose data where the law requires it, for example to a court or a public authority, and to a buyer of the Site if it changes hands, under this policy.
The Site is operated from Poland. Some providers listed above are based in the United States or may process data there. In those cases we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses.
Under the GDPR you have the right to:
To use any of these rights, email [email protected] from the address linked to your account. We answer within one month. That period can be extended by two months for complex requests, in which case we tell you within the first month. Requests are free unless they are clearly unfounded or excessive.
You can also complain to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warsaw.
Rankings are calculated automatically from upvotes and publish dates, and badges are checked automatically. These concern apps, not people. Decisions to approve, reject or remove a listing, or to suspend an account, are taken by a person. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR), and we do not profile visitors for advertising.
All traffic to the Site is encrypted with HTTPS. Access to our database and admin tools is limited to the people who run the Site. Sign-in uses one-time links or Google, so we hold no passwords. No system is perfectly secure; if a breach puts your rights at risk, we will notify PUODO and, where required, you.
The Site is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, write to [email protected] and we will delete it.
We will update this policy when our processing changes. The date at the top shows the latest version. Significant changes will be announced on the Site or by email to account holders.
See also the terms of service.