DiskFox Privacy Policy
Version 2026-10-06 · Effective 30 September 2026
In short. DiskFox works on your Mac. Your files, scan results and history stay on your Mac, and we never receive them. DiskFox has no accounts, advertising, analytics, telemetry or crash reporting. We only receive personal information when DiskFox checks for updates, when you contact us, or when you buy a licence, and this policy explains each case.
1. Who we are
DiskFox is a trading name of Krishan Assi, a sole trader whose business address is 19 Britton Avenue, St Albans, Hertfordshire AL3 5EJ, United Kingdom. We are the controller of the personal information described in section 5, which means we decide how and why it is used.
Contact us about privacy at support@diskfox.app.
2. What this policy covers
This policy covers the DiskFox app for Mac, its update service, the free trial, licence purchases and activation, our support, and our website (diskfox.app), including the beta sign-up form.
3. What DiskFox does on your Mac
DiskFox reads information on your Mac to measure storage, explain changes and help you remove what you choose. That information is processed on your Mac and is not sent to us or to anyone else. We have no access to it.
DiskFox reads:
- the names, sizes and dates of files and folders in the locations listed in DiskFox (Settings ▸ Privacy & Access ▸ Advanced ▸ Locations DiskFox reads), and in folders you choose to scan;
- the contents of files only when you run an Exact Duplicates scan, to confirm that files match byte for byte, on your Mac;
- details about your Mac and apps: macOS version, storage totals, installed apps and their sizes, and settings such as whether FileVault or Apple Intelligence is turned on;
- whether Apple Intelligence is available on your Mac, using Apple's Foundation Models framework on macOS 26 or later. DiskFox only asks for this status. It does not send any prompts or information to an AI model.
DiskFox stores on your Mac, in your user Library:
| What | Contains | How long it's kept |
|---|---|---|
| Storage history | Storage totals and sizes per storage category, the macOS version, and names only of non-personal items such as Xcode runtime versions | Every scan for 30 days, then one per day for a year, then one per week, until you erase it |
| Cleanup receipts and action records | What you removed or uninstalled, including the original and Trash paths of each item, sizes, and any errors | Until you delete them or erase history |
| Storage alerts and watches | The limits and alerts you set up | Until you delete them or erase history |
| Preferences | Your settings, and the version and date of the Terms you accepted | Until you delete DiskFox's preferences |
| Diagnostic logs | Scan durations and counts, written to macOS's own log. File names and paths are not recorded in readable form. | Kept and removed by macOS |
| Exports | Reports, history or images you choose to save, in the place you choose. Reports and history exports remove your user name, home folder name, computer name, serial numbers and personal file names. | Until you delete them |
You can erase DiskFox's history at any time: Settings ▸ Privacy & Access ▸ Advanced ▸ Erase Local History. Removing the DiskFox app doesn't remove its history; to remove everything, also delete the DiskFox folder in ~/Library/Application Support.
4. Permissions DiskFox may ask for
Each permission is optional, explained before it is requested, and can be turned off in System Settings. None of them sends information to us.
| Permission | What it allows | Where to turn it off |
|---|---|---|
| Full Disk Access | Measuring folders macOS protects, such as Mail downloads, Messages attachments, device backups and the Trash | Privacy & Security ▸ Full Disk Access |
| Files and Folders (Downloads, Desktop, Documents) | Measuring files in those folders. macOS asks the first time DiskFox reads them. | Privacy & Security ▸ Files & Folders |
| Notifications | Showing storage alerts you create | Notifications |
| Open at Login | Starting DiskFox when you sign in, so scheduled checks can run | General ▸ Login Items |
| Administrator helper | Moving apps owned by the system account to your Trash when you uninstall them. An administrator must approve it. | DiskFox Settings ▸ Privacy & Advanced, or General ▸ Login Items |
| App Management | macOS may ask before DiskFox moves an app to the Trash | Privacy & Security ▸ App Management |
5. Personal information we receive, and why
5.1 Update checks
When DiskFox checks for updates (automatically, if you allow it, or when you choose Check for Updates), it connects to our update server. The server receives your IP address, the version of DiskFox and of its update component (Sparkle), your language preferences, and the time of the request. DiskFox's optional "system profile" feature is turned off, so no other information about your Mac is sent. If you download an update, the download server receives the same kind of information.
- Why: to tell you about updates and deliver them securely.
- Lawful basis: our legitimate interests in keeping DiskFox secure and working, and in providing updates that are part of your licence.
- Who receives it: our hosting provider, Cloudflare, Inc., which serves updates from diskfox.app.
- How long: Cloudflare's short-lived request logs, kept for up to 7 days.
- Your choice: you can turn off automatic checks in DiskFox's Settings.
We also keep anonymous counts of update checks and update downloads for each hour and DiskFox version, so we know how many people use each version. These counts contain nothing else: no IP address and nothing that could identify you or your Mac.
Builds without an update service configured make no update checks. DiskFox's Settings show which applies to your copy.
5.2 Support
When you email us, we receive your email address, your name if you give it, your message, and anything you attach, such as a diagnostic report you chose to export.
- Why: to answer you, and to fix problems you report.
- Lawful basis: our legitimate interests in supporting our customers and improving DiskFox; where you have bought a licence, also to perform our contract with you.
- Who receives it: Cloudflare Email Routing, which forwards mail sent to our diskfox.app addresses, to our mailbox provider, Google (Gmail), based in the United States. We send our replies through Resend, an email delivery service based in the United States.
- How long: 24 months after our last contact with you.
5.3 Buying a licence
Polar (polar.sh) sells DiskFox licences as our merchant of record. Polar collects your payment details and is responsible for them under its own privacy policy; we never see your card details. We receive order details from Polar.
- What we receive: your name, email address, country, order number, the price and tax paid, and your licence key.
- Why: to supply and support your licence, keep accounts, and meet tax and accounting obligations.
- Lawful basis: to perform our contract with you; to comply with our legal obligations (tax and accounting records).
- Who receives it: Polar; our accountant, if we use one.
- How long: for as long as your licence is supported, and then for as long as UK tax law requires us to keep records (currently about six years).
5.3.1 The free trial and licence activation
The 14-day trial runs entirely on your Mac: DiskFox records when you started the trial in your Mac's Keychain and doesn't send that anywhere.
When you activate a licence, and occasionally afterwards to confirm it's still valid, DiskFox connects to Polar and sends your licence key and a random identifier that DiskFox creates for that Mac, so you can see and remove your activations. Polar also receives your IP address. DiskFox doesn't send your Mac's name, your Apple ID, or anything about your files or storage.
- Why: to confirm your licence is valid and apply the two-Mac limit.
- Lawful basis: to perform our contract with you.
- Who receives it: Polar.
- How long: for as long as the licence is active, and then as described in section 5.3.
5.4 Our website and the beta programme
If you joined the beta waitlist on diskfox.app before launch, we received your email address and the time you signed up, plus your first name, macOS version and biggest storage frustration only if you chose to give them.
- Why: to invite you to the beta, tell you when DiskFox launches, and understand which storage problems matter most.
- Lawful basis: your consent, which you can withdraw at any time by emailing support@diskfox.app or replying to any email we send.
- Who receives it: Cloudflare, Inc., which hosts the website and stores sign-ups in a database restricted to the European Union. If we use an email delivery service to send invitations, we'll name it here before we do.
- How long: until you ask us to remove it, or twelve months after DiskFox's public launch, whichever comes first.
Cloudflare also processes your IP address and browser details to deliver and protect the website, and keeps short-lived request logs. The website uses the country Cloudflare works out from your IP address to show the price in your currency, and doesn't keep it. If a connection sends far more requests than a person could (over 60 a minute), the website blocks its IP address at Cloudflare for 24 hours to protect the site, and keeps that address only until the block is lifted. The sign-up form holds your IP address in memory for up to an hour to limit repeated attempts. The website has no advertising, no third-party analytics and no tracking cookies. It keeps anonymous counts of page views and button clicks for each hour: only the event, the hour, whether it came from a phone or a computer, where on the page it happened, and the name of the website that linked you here (such as reddit.com) or the name in a link's ?ref= tag. It never keeps the address of the page you came from. To show how many people are on the site at the moment, it also counts home page views for each minute and deletes those counts after two hours. Nothing that identifies you is recorded. A light or dark theme choice stays in your browser.
5.5 Legal matters
We may use or keep information where needed to establish, exercise or defend legal claims, or to comply with the law, under our legitimate interests or our legal obligations.
6. Summary of processing
| Data | Source | Purpose | Lawful basis | Recipient | Retention |
|---|---|---|---|---|---|
| IP address, app and Sparkle version, language, request time | Update checks from DiskFox | Offer and deliver secure updates | Legitimate interests; contract | Cloudflare | Up to 7 days |
| Email address, name, message, attachments | You, when you contact us | Support and fixing problems | Legitimate interests; contract | Cloudflare Email Routing; Google (Gmail); Resend | 24 months after last contact |
| Name, email, country, order and tax details, licence | You, via Polar's checkout | Supply the licence; accounts and tax | Contract; legal obligation | Polar; our accountant, if any | Licence lifetime, then about six years |
| Licence key, random Mac identifier, IP address | DiskFox, when activating or checking a licence | Confirm the licence and the two-Mac limit | Contract | Polar | Licence lifetime, then as above |
| Email address; optional name, macOS version and comment | You, on the website's beta form | Beta invitations and launch news | Consent | Cloudflare (EU storage) | Until you ask, or 12 months after launch |
| Information needed for legal claims | Any of the above | Legal claims and compliance | Legitimate interests; legal obligation | Professional advisers; authorities where required | As long as needed for the matter |
We don't sell personal information, use it for advertising, or combine it with information from other sources.
7. Apple and macOS
DiskFox uses standard macOS features on your Mac, such as notifications, login items and Apple's Foundation Models availability check. They don't send us any information. macOS itself may contact Apple, for example to check that downloaded apps are signed and notarised; Apple's own privacy policy covers that.
8. International transfers
Cloudflare, Inc. is based in the United States. It stores beta sign-ups in the European Union, and it is certified under the EU–US Data Privacy Framework and its UK Extension; its data processing agreement also includes the UK Addendum. Google, which hosts our support mailbox, is also certified under the EU–US Data Privacy Framework and its UK Extension. Resend, which sends our support replies, relies on the EU–US Data Privacy Framework and its UK Extension, and its data processing agreement also includes the UK Addendum. Polar is based in the United States and handles purchase and activation information under its own privacy policy and transfer safeguards.
9. Security
We protect the personal information we receive with measures appropriate to the risk, and we keep it only for as long as described above. DiskFox's Security and Your Data page (Help ▸ Security and Your Data) describes how DiskFox protects your Mac and its updates.
10. Your rights
You have the right to:
- ask for a copy of your personal information (access);
- ask us to correct inaccurate information (rectification);
- ask us to delete information (erasure);
- ask us to restrict how we use it (restriction);
- receive information you gave us in a portable format (portability);
- object to our use of your information where we rely on legitimate interests (objection); and
- withdraw consent at any time where we rely on consent.
These rights have conditions and exceptions. To use them, email support@diskfox.app. We normally respond within one month and don't charge a fee. Because DiskFox keeps your storage information only on your Mac, we can't access, correct or delete it for you; you control it through DiskFox's Settings.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. DiskFox's recommendations are produced on your Mac, and you decide whether to act on them.
11. Complaints
If you are unhappy with how we have handled your information, please tell us first at support@diskfox.app. We'll acknowledge your complaint within 30 days and let you know the outcome without undue delay.
You can also complain to the UK's data protection regulator, the Information Commission (which replaced the Information Commissioner's Office on 30 September 2026): ico.org.uk, telephone 0303 123 1113.
12. Children
DiskFox isn't designed for children, and we don't knowingly collect personal information from children. You must be 18 or over to buy a licence.
13. Changes to this policy
We'll update this policy if what we do changes, and show the version and date at the top. If a change affects how we use information you have already given us, we'll tell you before it takes effect.
14. Contact
Privacy: support@diskfox.app Support: support@diskfox.app
DiskFox is a trading name of Krishan Assi, a sole trader whose business address is 19 Britton Avenue, St Albans, Hertfordshire AL3 5EJ, United Kingdom.