Privacy

There is no account, no analytics, and no third-party crash reporter. The app makes no network request you did not start.

That is enforced rather than promised: a script in the repository (Scripts/verify-no-network.sh) checks the app's own sources for any way to open a connection, and it runs as a build phase — so the build fails if that stops being true. It deliberately does not search DuckDB's own code, because the engine does reach the network, only ever to a source you configured.

What the app stores, and where

• Credentials — passwords, tokens and access keys go to the system Keychain, keyed per connection. They are never written to a configuration file, a log, or exported history. Removing a connection removes its Keychain item with it.
• Saved connections — host, port, database and user name, in the app's own preferences. No secret is stored here; the type that describes a connection cannot hold one, and a test asserts that.
• Query history — statements, timings and outcomes, in ~/Library/Application Support/Datapuddle/history.sqlite. Local, searchable, and there is a Clear button in the History tab that deletes all of it. Credentials that appear inside a statement are redacted before the row is written.
• File access — files you open are remembered as security-scoped bookmarks rather than paths, so the app holds only the permission you granted it, and a saved reference survives the file moving without widening that permission.

When the app uses the network

Only when you ask it to, and only to where you pointed it:

• Opening an https:// or s3:// URL.
• Attaching a Postgres, MotherDuck, S3 or Quack connection you configured.
• Buying or restoring the licence, which goes to Apple through the App Store and never to us. We receive no payment details.

There is no update check, no licence call home, no first-run ping and no background sync. The DuckDB extensions the app uses are compiled into the binary, so it never downloads one at runtime.

Crash reports

The app embeds no crash-reporting SDK. macOS has its own, and if you have turned on Share with App Developers in System Settings ▸ Privacy & Security ▸ Analytics & Improvements, Apple may send us an anonymised crash log through App Store Connect. That is Apple's mechanism and your setting; turning it off stops it, and nothing in the app reads or changes it.

What we receive

Nothing about your data. There is no server to receive it. Your files, your queries and your credentials do not leave your machine unless a query you wrote sends them somewhere you configured.

This website

No cookies, no analytics, no tracking pixels, and no webfonts — the page is set in the fonts already on your Mac, so rendering it fetches nothing from anyone. It is static hosting; the host keeps its own access logs, as every web server does.

One thing is stored in your browser: if you pick a light or dark theme, that choice is kept in localStorage under dp-theme so the right one is painted on your next visit. It is a single word, it never leaves your browser, and clearing site data removes it. Saying "no cookies" without mentioning it would be true and incomplete.

Changes

If any of this changes, it changes here first — this page is updated before the behaviour it describes ships, not after.

Contact

Questions about any of this: support@datapuddle.app.

← Back to Datapuddle