1. Scope and operator
This policy applies to the PowerTrackpad website, Mac application, trial and licensing service, purchase fulfilment records received from our merchant of record, and support communications. In this policy, “PowerTrackpad”, “we”, “us”, and “our” mean the operator identified in the pre-release notice above and, after registration, the legal operator named there.
PowerTrackpad acts as the data controller for information it decides to collect and use. Paddle separately acts as merchant of record and determines how it processes checkout and payment information under its own privacy notice.
2. Data that stays on your Mac
Gesture recognition happens locally. PowerTrackpad does not send your individual gestures, gesture history, rule contents, keyboard shortcuts, shell commands, URLs, application names, or file paths as analytics. Local usage counters, such as successful activation count, active and configured rule counts, and distinct usage days, remain on your Mac.
Your saved rules are stored locally. When trial and licensing support launches, a private installation credential will be stored in macOS Keychain, and a signed, non-secret entitlement may be cached in your Application Support folder. You control these local files through the app and macOS.
3. Data we collect and its source
Website delivery
When you request a page or download, hosting and content-delivery systems necessarily process network information such as IP address, request time, requested path, user agent, response status, and security signals. PowerTrackpad has not enabled visitor analytics, advertising trackers, or CloudFront access logs on the pre-release website.
Anonymous trial and licensing
When the commercial service launches, it will process a randomly generated installation public identity or its cryptographic hash, trial start and expiry dates, signed entitlement identifiers, license and activation status, activated-device slots, validation timestamps, and the minimum protocol information required to operate and secure the service. The private installation credential remains in Keychain. We do not collect a Mac serial number, disk serial number, MAC address, or broad hardware fingerprint.
Purchases
Paddle collects checkout and payment information directly. Paddle may provide us with your name, email address, country or region, product and price, transaction identifiers, payment status, refund or dispute status, and other information necessary for fulfilment, fraud prevention, accounting, and support. We do not receive or store your full payment-card number.
Support
If you contact us, we receive the address and name you use, message content, timestamps, and any files or diagnostic information you choose to provide. Please do not send passwords, private installation credentials, full payment-card details, or unrelated sensitive information.
4. Why we process data, and your choices
We use the information described above only to:
- deliver and secure the website and downloads;
- start and enforce one anonymous trial per Mac on a best-effort basis;
- issue, validate, restore, and revoke signed entitlements;
- enforce the two-device allowance and support device replacement;
- fulfil purchases and handle refunds, disputes, fraud, and accounting;
- answer support and privacy requests; and
- comply with legal obligations and protect PowerTrackpad and its users.
Depending on the applicable law and context, processing is necessary to perform a contract or take steps you request, comply with law, pursue legitimate security and service interests, or act with your consent.
You may browse public information without creating an account. Support information is voluntary; without it, we may be unable to investigate or reply.
The anonymous installation record is required to start and restore a trial. If you decline it, you may continue using Basic without a trial.
Purchase and license records are required to activate and restore Pro. If you decline them, we cannot provide paid activation or restoration.
We do not sell personal data, serve behavioural advertising, send marketing email without a separate lawful choice, or use personal data for automated decisions that produce legal or similarly significant effects.
5. Website analytics, cookies, and downloads
The current website does not set first-party analytics or advertising cookies and contains no third-party behavioural analytics. Basic website assets are delivered through Amazon CloudFront. If privacy-conscious download measurement is introduced, this policy will be updated before it is enabled to explain the fields, purpose, and retention period.
A future Paddle checkout may use cookies or similar technologies under Paddle's Privacy Notice. Those technologies are controlled by Paddle, not by the current PowerTrackpad landing page.
7. Processing outside Malaysia
PowerTrackpad is operated from Malaysia, while service providers operate internationally. Planned licensing records will be hosted primarily in the AWS Singapore Region. CloudFront may process requests at global edge locations, and Paddle and Zoho may process information in countries where they and their subprocessors operate.
Where personal data is transferred outside Malaysia, we will assess the destination and provider safeguards and rely on a permitted transfer basis under applicable law. Foreign laws may differ from Malaysian law and may permit lawful access by authorities.
8. How long we keep data
- Ordinary API and licensing logs: 30 days.
- Raw Paddle webhook payloads: no more than 30 days; normalized event identifiers, outcomes, transaction state, and required evidence remain afterward.
- Trial-to-purchase attribution: deleted or irreversibly unlinked 90 days after trial expiry.
- Trial enforcement record: the minimal installation hash and authoritative trial dates remain while the trial service operates.
- Perpetual-license and activation records: while the license and restoration service are supported.
- Support correspondence: two years after the case closes.
- Purchase, payout, refund, tax, and accounting records: seven years, or longer when law requires.
- Encrypted backups: deletable data ages out within 90 days, except records governed by a longer legal schedule.
A specific record may be retained longer when documented security, abuse, dispute, litigation, or legal handling requires it.
9. Security and incidents
PowerTrackpad uses, and the commercial service is designed to use, measures appropriate to the data and risk, including encrypted transport, restricted administrative access, least-privilege cloud permissions, encryption at rest, Keychain protection for the private installation credential, signed entitlements, secret separation, log redaction, and protected backups. No system can be guaranteed completely secure.
If a personal-data breach creates a risk requiring notice, we will investigate, contain it, and notify the Malaysian Personal Data Protection Commissioner and affected individuals as required by applicable law.
10. Access, correction, deletion, and complaints
Subject to applicable law, you may ask whether we hold personal data about you and request access, correction, withdrawal of consent, restriction, or deletion. Email support@powertrackpad.com with the subject “Privacy request”. We may request proportionate information to verify your identity and protect another person's data.
Some records cannot be deleted immediately where they are required for tax, accounting, fraud prevention, disputes, or another legal obligation. Before deleting an active license identity or restoration record, we will explain that deletion may prevent future activation, device recovery, or license restoration and ask you to confirm.
Requests concerning checkout data controlled by Paddle should also be directed through Paddle's privacy channels. If a concern is not resolved, you may contact the Personal Data Protection Commissioner of Malaysia.
11. Children
PowerTrackpad is a general-purpose productivity utility and is not directed to children. We do not knowingly request children's personal data. A parent or guardian who believes a child supplied personal data may contact us to request review and deletion.
12. Changes and contact
We may update this policy when the product, providers, or law changes. The effective date and version will be revised, and material changes will be communicated where required. We will not silently apply a materially less protective use to data already collected where notice or consent is required.