Privacy

The app has no account, sends no analytics, and embeds no third-party crash reporter. It makes no network request you did not start. This website is a separate matter, covered below.

That is enforced rather than promised: a script in the repository (Scripts/verify-no-network.sh) checks the app's own sources for any way to open a connection, and it runs as a build phase — so the build fails if that stops being true. It deliberately does not search DuckDB's own code, because the engine does reach the network, only ever to a source you configured.

What the app stores, and where

• Credentials — passwords, tokens and access keys go to the system Keychain, keyed per connection. They are never written to a configuration file, a log, or exported history. Removing a connection removes its Keychain item with it.
• Saved connections — host, port, database and user name, in the app's own preferences. No secret is stored here; the type that describes a connection cannot hold one, and a test asserts that.
• Query history — statements, timings and outcomes, in ~/Library/Application Support/Datapuddle/history.sqlite. Local, searchable, and there is a Clear button in the History tab that deletes all of it. Credentials that appear inside a statement are redacted before the row is written.
• File access — files you open are remembered as security-scoped bookmarks rather than paths, so the app holds only the permission you granted it, and a saved reference survives the file moving without widening that permission.

When the app uses the network

Only when you ask it to, and only to where you pointed it:

• Opening an https:// or s3:// URL.
• Attaching a Postgres, MotherDuck, S3 or Quack connection you configured.
• Buying or restoring the licence, which goes to Apple through the App Store and never to us. We receive no payment details.

There is no update check, no licence call home, no first-run ping and no background sync. The DuckDB extensions the app uses are compiled into the binary, so it never downloads one at runtime.

Crash reports

The app embeds no crash-reporting SDK. macOS has its own, and if you have turned on Share with App Developers in System Settings ▸ Privacy & Security ▸ Analytics & Improvements, Apple may send us an anonymised crash log through App Store Connect. That is Apple's mechanism and your setting; turning it off stops it, and nothing in the app reads or changes it.

What we receive

Nothing about your data. There is no server to receive it. Your files, your queries and your credentials do not leave your machine unless a query you wrote sends them somewhere you configured.

This website

This page is about the website, which is not the app. Everything above describes Datapuddle itself and still holds: the app sends nothing, to us or to anyone. This site does use analytics.

It runs Google Analytics to count visits and see which parts of the page people reach — how many arrived, what they read, whether they went on to the App Store. There is no way to sell an app without knowing whether anyone is looking at it, and this is how that is measured. It is configured with Google's advertising features turned off, so there is no cross-device profile and no remarketing audience; it records pages and a handful of events, not people.

The events are: following a download or App Store link, reaching a question in the FAQ, opening a screenshot, clicking a support email address, and following a link off the site (the destination's domain only, never the full address). No identifier of our own is ever attached to any of them.

Turn on Do Not Track and none of it loads. Google Analytics ignores that header by default; this site does not — the script checks it before it loads anything, so the request to Google is never made. A content blocker works too, and nothing on the page depends on analytics running.

Two other things are stored in your browser. Analytics sets its own cookies when it runs. And if you pick a light or dark theme, that choice is kept in localStorage under dp-theme so the right one is painted on your next visit — a single word that never leaves your browser. Clearing site data removes both.

The page still uses no webfonts: it is set in the fonts already on your Mac. It is static hosting, and the host keeps its own access logs, as every web server does.

Changes

If any of this changes, it changes here first — this page is updated before the behaviour it describes ships, not after.

Contact

Questions about any of this: support@datapuddle.app.

← Back to Datapuddle