Privacy Policy

Last updated 25 October 2026

Squeaky is built to keep your data on your Mac. Your files never leave your Mac. Scans and cleanups happen locally; nothing you clean is uploaded anywhere. The same goes for Squeaky for iPhone and iPad: your photos and videos never leave your device. This policy explains the small amount of data we do process, under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller is Vimmy B.V., Beechavenue 54, 1119PW Schiphol-Rijk, Netherlands, Chamber of Commerce 72255900, VAT NL859048731B01. For anything about your data, email [email protected].

2. What we collect, and why

When you purchase a licence

• Your email address. The licence key is sent to it, and it is the name of your account.
• Purchase records through Stripe: what you bought, when, the amount, VAT, the country used for VAT, and the Stripe customer, subscription and payment identifiers. Stripe collects your card details; we never see the full card number.
• The licence itself: key, plan, status and renewal dates.

Our landing pages load Stripe.js from js.stripe.com, which Stripe uses for the payment and for fraud prevention. If you are not on a Mac, “Email me the download link” uses the address you enter to send that one email; only a hash of it is kept, for about a day, to limit repeats. If you reached a landing page from an ad, the campaign parameters in its link (such as utm_source, utm_campaign and the ad network’s click ID like gclid or fbclid) are stored with your purchase in Stripe, so we can tell which ads lead to sales; they are kept as long as the purchase record.

If you came to Squeaky through an advertising network’s link, we tell that network that a purchase happened, with the network’s own click identifier and the amount paid, so it can count the sale. We do not share your name, email address or payment details with it.

Basis: performance of the contract with you (Art. 6(1)(b) GDPR) and our legal obligation to keep accounting and tax records (Art. 6(1)(c)). For the campaign parameters and click identifiers kept with your purchase and for the purchase notice to the advertising network: our legitimate interest in measuring which ads lead to sales (Art. 6(1)(f)).

When you activate Squeaky

When you enter your licence key, and from time to time afterwards, the app sends to our licence server:

• an anonymous machine identifier (a SHA-256 hash computed on your Mac, not your serial number);
• an install identifier and the app version;
• the time of the first and last check-in.

We use this to enforce the two-Mac limit and to show you your Macs in your account, where you can deactivate them. Basis: performance of the contract (Art. 6(1)(b)).

When you sign in to your account

We email you a sign-in link and a code. The link and code are valid for 15 minutes; the record is deleted within about an hour. We keep a browser session for 30 days in one cookie, __Host-sq_session, on api.squeaky.site (see the Cookie Policy). Basis: performance of the contract (Art. 6(1)(b)).

When you ask us to resend a key

We store a hash of the email address you entered, not the address itself, for about a day, so the resend form cannot be abused. Basis: our legitimate interest in preventing abuse (Art. 6(1)(f)).

When you email us

We keep your message and our reply so we can help you and look up earlier conversations. Basis: performance of the contract and our legitimate interest in giving support (Art. 6(1)(b) and (f)).

AI assistant. An AI assistant helps us answer support messages, whether they come by email, through the support form or from the app. It reads your message, the earlier messages in the same conversation and the details sent with it, and, for a purchase linked to your email address, your licence status (plan, status, purchase and renewal dates, activated Macs and the app and macOS versions they last reported, and whether our licence-key email was delivered). With that it drafts a reply for us or answers you directly. Every reply written by the AI says so, and a person can take over at any time: just ask. The assistant cannot issue refunds or change your purchase; questions about money always go to a person. We also use it to summarise, for ourselves only, what people asked about during the week. The AI model is Claude by Anthropic, reached through OpenRouter (see section 3). Basis: our legitimate interest in answering you quickly (Art. 6(1)(f)).

Analytics

In the Mac app. Squeaky sends anonymous usage counts to TelemetryDeck so we can see which features are used and where people get stuck: for example “a scan completed” or “the paywall was shown”. Specifically:

• the identifier is an anonymous hash generated by TelemetryDeck’s client; it is not your email, licence key or serial number;
• amounts of data are sent only as rough buckets (such as “2–10 GB”), never as exact numbers;
• no file names, paths, app names or licence keys are ever sent.

From version 1.5 the app also sends the same events, plus which room you opened and which main button you pressed, to our licence server (api.squeaky.site) with the app’s install identifier: a random number created when Squeaky is first opened, which is also sent when you activate a licence. This lets us see whether someone who bought Squeaky Pro got it working, and where people get stuck. These events are kept for 90 days. On first launch, if this Mac is not Pro yet, Squeaky also reads the download link of the Squeaky disk image in your Downloads folder (for the purchase code in it) and may ask our server whether a purchase was made from your network in the last 3 days (see “On this website”).

You can turn this off at any time in Squeaky → Settings → General → “Share anonymous usage statistics”: it stops both. Basis: our legitimate interest in improving the app (Art. 6(1)(f)).

Update checks. The app asks squeaky.site for its update feed (appcast.xml) through the Sparkle framework. That request carries your IP address and the app version, like any web request. You can turn automatic checks off in Settings.

On this website. We use Cloudflare Web Analytics, which counts page views without cookies and without tracking you across sites. When you start the free download, we count it with the landing page and campaign parameters (utm_*) it came from — no IP address, email or other identifier. On the payment pages we also record which steps of the payment you reach (for example “card form ready”, “Pay pressed”, or the error code of a declined payment) with the time since the page opened and the same campaign parameters. These steps are grouped by a random number that exists only while the page is open; it is not stored in your browser, and we record nothing you type, no IP address and no ad click identifier. We also record the country Cloudflare reports for the visit (not the IP address). If you purchase, that number is kept with your purchase, so we can see which steps led to it and whether the licence was activated. When you start a payment we also keep a one-way hash of your network (your IPv4 address, or the first half of your IPv6 address) for 7 days: if Squeaky is then installed on the same network, the app can offer to email an activation code to the purchase address, and it never shows who purchased. The Download link after payment and in the key email carries a one-time code; on first launch Squeaky reads that link from the downloaded file on your Mac and uses the code to turn on Pro, so you don’t have to paste the key. The code works for 30 days. Basis: legitimate interest in finding where payments fail (Art. 6(1)(f)).

Server logs and abuse prevention

Our servers see your IP address when you use the site or the API. We use it to rate-limit requests and to find faults, and do not use it to identify you. Basis: legitimate interest in security (Art. 6(1)(f)).

Squeaky for iPhone and iPad

Your photos and videos never leave your device. The app looks at your photo library on the device to find duplicates, similar shots, screenshots and large videos, and to find photos of cards and documents and photos that carry a location. It reads the text in candidate photos with Apple’s on-device text recognition. Nothing it looks at or reads is uploaded. The index it builds and your cleanup history are stored only in the app on your device and are deleted with the app.

Wi-Fi check. iOS shows the security type of the Wi-Fi network you are on only to apps with location permission, so the app asks for it when you open the check. It reads the network’s security type; your location is not stored or sent.

Subscriptions. Subscriptions in the app are paid through Apple’s App Store. Apple handles the payment; we never see your payment details. RevenueCat, Inc. tells the app which subscription you have. It receives the App Store purchase records (product, dates, amount, currency, country) under a random identifier it creates for the app, not your name or email address, together with device identifiers: the identifier for vendor, Apple’s ad attribution token and, only if you allow tracking, the advertising identifier. Basis: performance of the contract (Art. 6(1)(b)); for the advertising identifier, your consent (Art. 6(1)(a)).

Signing in (optional). You need no account to use or subscribe to the app. If you have a Squeaky Pro licence that includes iPhone and iPad, you can sign in to use it here. The app sends your email address to our licence server (api.squeaky.site), which emails you a 6-digit code. When you enter it, the app activates this device with an anonymous device identifier (a SHA-256 hash of a random number made on the device, not a hardware identifier), an install identifier, the app version and the device type (iPhone or iPad), and checks the licence about once a day. Your email address, licence key and these identifiers are kept in the device’s Keychain. Signing out releases the device. To delete your account, choose Delete account in the app’s Settings, which opens an email to us, or write to [email protected]. Basis: performance of the contract (Art. 6(1)(b)).

Usage events. The app sends usage events to Mixpanel, Inc., for example “a scan completed” or “the paywall was shown”, with a few details such as the cleanup category and amounts rounded to whole gigabytes, and the device model and iOS version. They are tied to a random identifier Mixpanel creates in the app. No file names, photo contents, recognised text, email addresses or photo identifiers are ever sent. The request carries your IP address, like any web request. Basis: our legitimate interest in improving the app (Art. 6(1)(f)).

Ad attribution and tracking. If you came to the app from an ad, we use AppsFlyer to learn which ad it was. When the app first opens, AppsFlyer receives information about the device (such as the model, iOS version, IP address and the identifier for vendor), and later three events: onboarding finished, a free trial started, and your first cleanup. Purchases reach AppsFlyer from RevenueCat, with the amount. The app asks whether you allow tracking. Only if you allow it do AppsFlyer and RevenueCat receive the advertising identifier, which can link your use of Squeaky with data from other companies’ apps and websites; on the App Store this is listed as “Data Used to Track You”. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking. Basis: our legitimate interest in measuring which ads bring people to the app (Art. 6(1)(f)); for the advertising identifier, your consent (Art. 6(1)(a)).

Crash reports. If the app crashes, Firebase Crashlytics (Google) receives a crash report: where in the code it happened, the device model, iOS version, app version, and the random RevenueCat identifier, so we can match a crash to a support request. Basis: our legitimate interest in fixing faults (Art. 6(1)(f)).

Support messages. When you write to us from the app, we receive your email address and your message, and with them the app version, iOS version, device model, language and region setting, the random RevenueCat identifier and whether Squeaky Pro is active. No photos are sent. We keep them like an email to us (see “When you email us”).

3. Who processes data for us

We use these processors. Each one processes data under its data processing terms with us and only for the purpose listed.

Where data is transferred to the USA, this happens under the EU–US Data Privacy Framework where the provider is certified, and otherwise under the European Commission’s Standard Contractual Clauses.

We do not sell your data and do not share it with anyone else, except the purchase notice to an advertising network described in section 2 (“When you purchase a licence”), the ad attribution described in section 2 (“Squeaky for iPhone and iPad”), and when the law requires it.

4. How long we keep data

• Accounting records (purchases, invoices): 7 years, as Dutch tax law requires.
• Licence and activation records: for as long as your licence exists, so that you can keep using it and recover your key, and then with our accounting records for 7 years. Activations you deactivate are removed at once.
• Sign-in links and codes: valid for 15 minutes; the record is deleted within about an hour. Sessions: 30 days, or until you log out.
• Key-resend and download-link throttle hashes: about a day.
• Support conversations (email and the support form): 24 months after the last message in the conversation, then deleted together with any attachments; daily backups keep a copy for up to 14 more days.
• Payment page steps: 90 days, then deleted.
• Usage counts (Mac app): anonymous; they cannot be linked back to you.
• Photo index and cleanup history (iPhone and iPad app): on your device only, until you delete the app.

5. Your rights

Under the GDPR you can ask us to:

• tell you what data we hold about you, and give you a copy;
• correct it;
• delete it, where we are not required to keep it (for example, accounting records);
• restrict or object to processing based on legitimate interest;
• receive the data you gave us in a portable format.

Email [email protected] from the address on your account. We answer within one month. We may ask you to confirm the request from that address, so we do not hand your data to someone else.

If you are unhappy with how we handle your data, you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in the country where you live.

6. Children

Squeaky is not aimed at children, and we do not knowingly collect data from anyone under 16.

7. Changes

We update this policy when our product or the law changes, and show the date at the top. If a change matters to you, for example a new processor, we aim to tell you by email or in the app.