Privacy Policy

This policy explains how the WashBear team ("we") handles your information when you use the WashBear app for macOS, the washbear.app website, and our online services for updates, feedback and phone remote access. If you have any questions, contact us through Feedback.

#Summary

• Scanning, cleanup and operation history happen on your Mac. File contents, file names and scan results are not uploaded.
• You don't need an account to use WashBear.
• We don't show ads or sell your information. The website uses no third-party analytics and no advertising or tracking cookies.
• Data leaves your device only when you check for updates, send feedback, turn on phone remote access or set up an AI service. The sections below explain what is sent, what it is used for and how long it is kept.

#Information that stays on your device

The following is stored only on your Mac, and we cannot see it:

• scan results and the operation history of cleanups, uninstalls, startup items and System Optimization;
• app settings, and the readings and preferences of the system status monitor;
• logs (sent to us only if you choose to attach them to feedback);
• your AI service configuration, including the API key;
• the keys for phone remote access and the list of paired phones.

#Installation ID

On first use, WashBear creates a random installation ID on your Mac. It does not come from your hardware, Apple Account or any other identity. It only tells installations apart: update checks use it to count active installations, and feedback uses it to connect reports from the same installation so we can troubleshoot.

#Update checks

While WashBear is running, it periodically contacts our update server (currently about every six hours), and you can also check manually in Settings. Each check sends the current version, processor architecture, macOS version, the app's interface language and your system's language and region setting, the package type and the installation ID. The server also receives your IP address.

We use this information to decide whether an update suits your Mac and to count active installations per version. The server does not store the raw installation ID, only a salted hash of it.

#Feedback

When you send feedback from the app or the Feedback page, we receive:

• the feedback type and what you wrote;
• the contact email address, if you provide one;
• screenshots and attachments you add;
• if you select Include diagnostic logs in the app, your three most recent log files. Logs record operation steps and errors. They don't include file contents, but they may include names and paths of files or folders related to a problem;
• when sent from the app, the app version, macOS version, processor architecture, interface language and installation ID;
• your IP address.

We use this information only to understand and fix problems, improve WashBear and reply to you if you left an email address. Feedback records are deleted after 12 months, and you can ask us to delete them sooner; see Your rights.

#Phone remote access

Phone remote access is off by default. Once you turn it on, your Mac keeps a connection to the relay at remote.washbear.app, through which your phone communicates with your Mac.

• Dashboard data (such as CPU, memory, battery and app rankings) and remote commands are end-to-end encrypted between your Mac and your phone with the Noise protocol. The relay only forwards encrypted data; it cannot read it or forge commands.
• To forward data, the relay necessarily handles connection information: the IP addresses of your Mac and phone, connection and disconnection times, the size and frequency of data, and your Mac's random mailbox ID. We use it to forward data and prevent abuse, and the service log records part of the mailbox ID and connection times.
• The pairing secret in the QR code sits after the # in the link, so your browser never sends it to the server.
• Keys stay on their own devices: on your Mac in WashBear's data folder, and on your phone in the browser's website data.
• The phone web app loads from remote.washbear.app, which creates access log entries like any other web page.

#AI explanations

We do not currently operate an AI service. Only when you have set up a custom AI service and click AI explanation does WashBear send the selected item's name, description, status, relevant paths and similar details, directly from your Mac to the provider you chose, without passing through our servers. The provider's own terms and privacy policy govern how it handles that data. See AI Explanations for exactly what is sent.

#Website

washbear.app uses no third-party analytics, shows no ads and uses no advertising or tracking cookies. Like most websites, our server keeps access logs with your IP address, browser identification, the pages you request and the time, for security and troubleshooting. We count downloads and use only the totals.

#Sharing

We don't sell or rent your information, and we don't use it for advertising or profiling. We share it only:

• with the provider that hosts our servers, which stores and transmits data only on our instructions;
• when required by law, or when necessary to protect our users, the public or our legitimate rights.

#Where data is stored and for how long

Our servers are located in Hong Kong, China. If you use our services from elsewhere, the related information is transferred to Hong Kong for storage and processing.

• Feedback: deleted after 12 months.
• Server access logs and relay service logs: kept for 30 days.
• Salted hashes of installation IDs used for update statistics: kept for up to 12 months, after which only totals without IDs remain.
• Phone remote access dashboard data and commands: not stored; the relay only handles encrypted data while forwarding it.

#Your rights

• You can ask to see, correct or delete feedback you sent. Contact us through Feedback with your feedback reference or the email address you provided, so we can find the record.
• Because the server stores only a hash of the installation ID, we cannot use it to identify you.
• You can turn off phone remote access, remove paired phones in Settings → Remote Access, delete your AI configuration, or leave out diagnostic logs when sending feedback at any time.
• Uninstalling WashBear and deleting its data removes all of the information above from your Mac.

#Children

WashBear is meant for a general audience and is not directed at children. If you are under 14, please use it with the consent and guidance of a parent or guardian. If you believe we have received personal information from a child, contact us and we will delete it.

#Payments

WashBear Pro is not on sale yet. Before it goes on sale, we will add how purchase and payment information is handled to this policy.

#Changes to this policy

We may update this policy and change the date at the top of the page. We will point out significant changes on the website or in the app.

#Contact

Operator: the WashBear team. Contact: washbear.app/feedback.