Privacy

Screen content

Protected Share uses macOS ScreenCaptureKit locally. Configured apps are excluded by the capture filter before a frame reaches the Protected Share window. The current product path does not upload screen frames, run cloud OCR, or save screenshots.

Data stored on your Mac

• Excluded-app preferences and presentation settings.
• Trial state tied to the current Mac.
• License material in macOS Keychain when a key is entered.

Network services

The beta download is hosted on Vercel Blob, and the website is hosted on Vercel. Those providers may receive standard request metadata such as IP address, browser type, and download time. The current beta has no configured screen-upload or crash-reporting endpoint.

Personal invitation licenses

If you receive a personal lifetime code and activate it in an invitation-enabled version of Unshown, we keep your contact email, a one-way code hash, one registered Mac identifier hash, activation and last-verification times, and license administration records in our private database. These records provide and support your access and are separate from website analytics retention. Email is a contact record, not an email-verified account.

License verification sends your code, an app-specific one-way identifier derived from your Mac, and app version information over HTTPS. It never sends your screen contents or raw hardware serial number. The app keeps its code and signed verification certificate in Keychain. A certificate allows up to 30 days offline; the lifetime grant itself has no expiry. Moving or revoking a license may not affect an offline Mac until its existing certificate expires.

We use one-way network-address hashes to limit activation requests; request processing removes rate-limit buckets older than two days. Contact support below to request license transfer or deletion of your license-related personal information.

Website analytics

The website uses Vercel Web Analytics for aggregate traffic reports. A page-view record may include its timestamp, page URL and dynamic route, external referring site, city, region and country, device type, browser and version, operating system and version, and the analytics script version. Unshown removes URL query strings and fragments before sending page views.

Vercel Web Analytics does not use cookies. Vercel distinguishes a visitor using a hash derived from the incoming request, discards that visitor-session identifier after 24 hours, and reports analytics without associating a data point with an individual or IP address. Unshown uses these reports to understand site traffic and improve the product launch.

Founder-offer demand research

Paid Google-ad visits first pass through a same-site redirect that stores a random session identifier, the event type, time, page path, referring page without its query string, available campaign tags, a Google advertising click identifier when one is present, and a one-way network-address hash. This lets Unshown measure an ad arrival even when a page is closed before its client-side code loads. The website separately records clicks that open the download page, views of that page, and explicit clicks on the published DMG file link, as well as when the founder pricing card becomes visible or its purchase button is clicked. A file-link click does not confirm a completed download, installation, or app launch. If you submit the checkout-notification form, it also stores your normalized email address and a one-way hash used for deduplication.

These records are kept in a private server-side database and are used to measure pricing interest, contact people who requested checkout access, and improve the launch offer. Unshown does not sell this information. Demand-research records are deleted after no more than 180 days. You can request earlier deletion by emailing the address below.

Google Ads conversion measurement

The website uses a Google Ads tag to measure successful founder waitlist submissions and explicit DMG file-link clicks attributed to Unshown ads. Google may process standard advertising-measurement data such as browser and device signals, IP address, and an advertising click identifier when one is present.

After the waitlist form is successfully saved, or when you explicitly click the DMG download button, Unshown sends Google a separate conversion event. The file-click event uses a random event identifier to avoid duplicate counting and is an installation proxy, not proof that an app was installed. Merely visiting the download page does not trigger this conversion. These events do not include the submitted email address, screen content, or other form fields. This measurement occurs on the website, not inside the macOS app. Enhanced conversions are not enabled, and Unshown disables ad-personalization signals for this tag.

Optional website chat

The live chat button is provided by Channel Talk. The widget begins with an anonymous visitor session and may use browser storage and standard service metadata, such as IP address, device, and browser information, to operate the conversation. Unshown disables Channel Talk's default page-view, UTM, and referrer tracking and does not send founder-offer emails, support-form records, or screen content to Channel Talk.

If you choose to send a chat or share contact details, the message, attachments, and details you provide are processed by Channel Talk so the Unshown team can reply. Unshown does not copy live-chat content into its Neon demand database. Do not send passwords, license keys, or private screen content through chat.

Support requests

If you use the on-site support form, Unshown stores your email, request category, message, optional app and macOS versions, request time, and one-way network-address hash in the same private database. Support requests are deleted after no more than 180 days.

Contact

Send privacy questions or deletion requests through the Unshown support form and choose Privacy request.