Privacy Policy

Who we are

“Ribbon,” “we,” and “us” mean the operator of the Ribbon product and this website. For questions about this policy or your data, email support@meetribbon.app.

Checkout is processed by Dodo Payments, which acts as merchant of record for tax, invoicing, and card processing. Their privacy policy also applies to payment data they collect: dodopayments.com/privacy-policy.

Summary

• Ribbon has no user account graph and no product analytics inside the Mac app.
• The app uses the network only for license activation or refresh, and for software update checks when updates are enabled.
• Accessibility permission is used locally to move and resize windows. Ribbon does not upload screen contents, keystrokes, or window titles for analytics.
• Purchase email and payment details are handled primarily by Dodo Payments. We store what we need to issue and seat a license key.

Data processed by the Mac app

Accessibility. macOS Accessibility APIs let Ribbon read enough window geometry to place windows on the strip and restore layouts. That processing happens on your Mac. We do not receive Accessibility event streams on our servers.

Local preferences. Settings such as shortcuts, gaps, and display choices stay in local storage on your Mac (for example User Defaults). They are not synced to Ribbon servers.

License activation. When you activate or refresh a license, the app sends your license key and a SHA-256 hash of a hardware identifier (machine id). The raw hardware UUID stays on the Mac. The server uses the hash to count seats and to re-issue a signed offline token for that Mac.

Update checks. When Sparkle (or an equivalent) update feed is configured, the app may request version metadata from our update endpoint. That traffic is for update availability, not product telemetry.

What we do not collect from the app. We do not collect keystrokes, screenshots, clipboard contents, file contents, browsing history, contacts, or which apps you open, for advertising or “product improvement” pipelines.

Website data

When you browse this site, standard web server and hosting logs may record IP address, user agent, referring URL, and pages requested. Those logs are used for security, debugging, and reliability.

If Plausible Analytics is configured for the site domain, we receive aggregate page-view counts. Plausible is designed not to use cookies for tracking and not to build advertising profiles. You can read their documentation at plausible.io.

Forms on this site (for example buy or license portal) collect only the fields you submit, such as email or license key, to complete that request.

Purchases and license records

When you buy Ribbon we (and our processors) may process:

• Email address (delivery of the license key and support)
• Plan selected (1, 3, or 5 Mac seats) and amount / currency
• Payment status, invoice or receipt identifiers from Dodo Payments
• A hash of the license key and hashes of activated machine ids
• Activation labels derived from machine id prefixes for the license portal

Card numbers and full payment credentials are collected by Dodo Payments on their checkout. Ribbon servers are not intended to store raw card data.

License keys may also be emailed via a transactional email provider (for example Resend) when we send fulfillment mail ourselves.

Why we process data

• Deliver the product (license key, download links, activation)
• Enforce seat limits and prevent abuse of shared keys
• Provide support and investigate failed deliveries or double charges
• Comply with tax, accounting, and legal obligations via the merchant of record
• Operate, secure, and improve the website and license service

Legal bases (where GDPR or similar laws apply)

We process data as needed to perform the purchase and license contract, to pursue legitimate interests in securing the service and preventing fraud, and where required to meet legal obligations. Where consent is required for optional analytics cookies or similar, we will only enable those tools in a way that matches that consent.

Retention

License, activation, and purchase records are kept for as long as the license may be used or as needed for accounting, dispute, and fraud prevention purposes, then deleted or anonymized when no longer required. Server logs are rotated on a shorter schedule. You may ask us to delete or correct personal data that we control; we may retain limited records where the law requires it or where needed to prove a past purchase.

Processors and subprocessors

Depending on configuration, we use:

• Dodo Payments — checkout, tax, invoices, merchant of record
• Hosting / edge (for example Vercel) — website and API
• Database (for example Neon) — license and activation records
• Transactional email (for example Resend) — license delivery mail
• Plausible (optional) — privacy-oriented site analytics

These providers process data under their own terms and only as needed to provide their service to us.

Sharing

We do not sell personal information. We share data with processors above, with professional advisors if required, and with authorities when legally compelled. If the Ribbon business is sold or reorganized, license and customer records may transfer to the successor under this policy or a successor notice.

International transfers

Servers and processors may be located in countries other than yours. Where required, we rely on appropriate transfer mechanisms used by those providers (such as standard contractual clauses) and on the fact that payment data for checkout is handled by Dodo Payments under their compliance program.

Security

We use HTTPS for the site and API, store license keys hashed where applicable, and limit access to production systems. No method of transmission or storage is perfectly secure. Protect your license key the way you would protect a software serial number.

Children

Ribbon is a productivity tool aimed at adults. We do not knowingly collect personal information from children under 16 (or the age required in your country). If you believe a child provided data, contact us and we will delete it.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal data, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. To exercise rights for data we control, email support@meetribbon.app. For payment records held only by Dodo Payments, you may also need to contact them directly.

macOS permissions and notarization context

Ribbon requests Accessibility so it can move and resize windows. The usage string shown by macOS describes that purpose. Ribbon is distributed as a Mac app outside the Mac App Store (Developer ID / notarized builds when signing is configured). Notarization confirms Apple scanned the binary for known malware; it is not a privacy audit. This policy is the disclosure of what the app does with permissions and network access.

Changes

We may update this policy as the product or law changes. The “last updated” date at the top will change. Material changes may also be noted on the site or by email when we have your address.

Contact

Privacy and data requests: support@meetribbon.app. Related pages: Terms of Service, Refunds, License portal.