Privacy

It hears clicks and key presses only to play a sound, keeps what you make (recordings, screenshots, notes, snippets, clipboard history) on your Mac, and runs speech and AI on your Mac too. It shares anonymous usage stats that you can turn off with one switch, checks for updates, and checks your licence with Polar, who also handle payments and the card for the trial. The Calendar, Friends and the Dashboard go online only when you use them, and their sections below say exactly what they keep. This website stores nothing that identifies you.

Last updated 14 October 2026, for Clacky 2.7.

What Clacky never does

• ✕Record, store, log or send which keys you type, or capture any text you write.
• ✕Play or listen for keys in password fields (macOS Secure Input).
• ✕Upload your recordings, screenshots, captions, notes, snippets or clipboard. They stay on your Mac unless you share them yourself.
• ✕Send your screen, app or window names, file names, or where you click.
• ✕Send audio or speech anywhere: voice, captions and AI caption drafts run on your Mac.
• ✕Open your microphone unless you asked for it (a recording with a mic, Voice to Prompt, or the teleprompter following your voice).
• ✕See your card number. Polar, our merchant of record, takes the card for the trial and every payment.
• ✕Show your friends, or anyone else, your clicks, keys, screen, files or anything you type. Friends see only your Blip’s card.
• ✕Sell or share your data. There are no ads and no data business.

Every tool is off until you turn it on, and macOS asks for a permission only when a tool you switched on needs it: Input Monitoring for click and keyboard sounds, Screen Recording for the recorder and screenshots, the microphone for voice, Accessibility for window snapping, the text expander and Scrolling Capture’s automatic scrolling.

Clicks and keyboard sounds

Clacky listens for mouse buttons and scrolling, and for key presses only while keyboard sounds are on. A key press goes straight to the sound engine, which only learns the kind of key (an ordinary key, space, return, delete, an arrow, a modifier) to pick the right sound, then forgets it. Clacky never records, stores, logs or sends which keys you type, never captures text, and stays silent in password fields (macOS Secure Input). With keyboard sounds off, it doesn’t listen to the keyboard at all.

Your click and typing stats (how many clicks and keys, when, your streaks, your week card) are counted from timing alone and kept only on your Mac. They never include which keys you pressed.

Text Expander

Off until you turn it on, and it needs the Accessibility permission. To spot your own triggers (like :sig), it keeps the last few characters you typed in memory only, never more than your longest trigger, and only while they could still become one. That little buffer is cleared when you switch apps, click, press Return, Tab, an arrow or a shortcut, type a space, or enter a password field. It is never written to disk, logged or sent.

It does nothing in password fields, in password managers, or in apps you exclude. Your snippets are saved on your Mac (~/Library/Application Support/Clacky/snippets.json). The usage stats count that a snippet was expanded, never which one.

Clipboard history

Off by default. While it’s on, Clacky notices when the clipboard changes and keeps your last 50 items in memory on your Mac. Keeping them after a restart is a separate switch: then they’re saved in a local file that is left out of backups and never synced. While it’s off, Clacky doesn’t look at your clipboard at all.

It skips passwords: anything a password manager marks as concealed or temporary, and anything copied while a password manager is in front. Nothing in the history is ever sent anywhere.

Recordings, screenshots and sharing

Screen recordings are saved on your Mac (in ~/Movies/Clacky unless you pick another folder), and screenshots in the folder you choose (~/Pictures/Clacky Screenshots by default). GIFs, vertical clips and captioned videos are saved next to them. Nothing is uploaded. Clacky looks at your screen only while you record or take a screenshot (yourself, or an AI tool you allowed), and, if you pick that option in Menu Bar Tidy, to show pictures of your hidden menu bar icons.

The teleprompter is hidden from your recordings, screenshots and screen shares, and its script is saved only on your Mac.

Sharing is always your move. Share… opens the macOS share sheet, and the app you pick takes it from there. If you choose to connect SeenPaid (a social scheduler) by pasting your own SeenPaid key, Clacky keeps that key in your Mac’s Keychain and sends SeenPaid the file, the caption, the accounts and the time only when you press Post now or Schedule.

Posting to your social accounts (Calendar)

If you connect a social account to Clacky’s Calendar (Bluesky, Threads, Instagram, Facebook Pages, YouTube, TikTok, LinkedIn, X, Mastodon, Telegram, Discord, Tumblr or Pinterest), Clacky posts only what you write and schedule, on the accounts you pick, at the time you pick. It never posts on its own, never reads your messages, and never follows, likes or comments for you. X posts by itself only if you add your own X API keys; without them, when an X post is due, Clacky shows you the text with Copy and Open X, and you post it yourself.

The Calendar uses your Dashboard account (see below); your Mac keeps only that account’s sign-in, in its Keychain. In our database at Cloudflare (D1) we keep: which accounts you connected (platform, account id and name); the access token each platform gave us, or what you pasted to connect (a Bluesky app password, X API keys, a Mastodon access token, a Telegram bot token, a Discord webhook), encrypted with AES-256-GCM, decrypted only on our server when a post goes out, a token is renewed or a post’s numbers are fetched, and sent only to that platform; and your scheduled posts (text, time, the accounts, the result link and its likes, comments, shares and views). Photos and videos you attach are stored in our file storage at Cloudflare (R2) so the platform can fetch them, and deleted after 30 days. We ask each platform only for permission to publish, to read your basic profile and, where it offers them, your posts’ numbers and the Pages or boards you post to.

We never sell this or use it for ads, and we don’t use it to train AI. Google user data from YouTube is used only to upload the videos you choose, in line with the Google API Services User Data Policy, including its Limited Use requirements.

Or post with SeenPaid. If you pick SeenPaid in the Calendar instead, your own SeenPaid key stays in your Mac’s Keychain, your accounts are connected on SeenPaid’s site, and Clacky sends your posts, and asks for their numbers, only to SeenPaid.

Disconnect any time. Removing an account in Clacky deletes its token right away and cancels its scheduled posts. You can also revoke Clacky in the platform’s own settings. To delete everything (accounts, posts and files), email [email protected] from your account’s address; we do it within 7 days and confirm.

Friends and People

Off until you turn it on. Nothing is sent until you press Turn on Friends. Then our database at Cloudflare (D1) keeps a random id for you, a one-way hash of a random key (the key itself stays in your Mac’s Keychain), a one-way hash of a random ID made for this Mac (so invite rewards count once per Mac), your invite code, the @username you pick, your friends and friend requests, and your Blip’s card: its name, look, level, streak, badges and, if Blip House is on, its room. Never your clicks, keys, screen, files or anything you type.

Cheers are one of four kinds (clap, fire, cookie, wow), never text, and are kept for 30 days. Friend requests are kept for 30 days. Cookies you give a friend are stored too.

Who sees what. Your friends see your Blip’s card. Anyone can see your public profile (clacky.app/@username): only your @username, your Blip’s look, its badges and its level, unless you hide the level. People can find you in search unless you turn off “Can people find me in search?”. The weekly leaderboards (clicks, streak, cookies) show you only if you join them, and leaving removes your scores at once. Never public: your email, real name, Mac, licence, invite code or detailed stats.

Block and Report. Block removes the friendship and any requests, and works both ways: neither of you can find or ask the other, or see the other on the leaderboards, and the other person is never shown that you blocked them. Report sends us the @username and the reason you picked (spam, offensive, impersonation or other), with your account id so we can act on it; a person at Clacky reads every report.

Turn it off any time. Turning Friends off deletes your card, friends, requests, cheers, cookie gifts, blocks, leaderboard scores and username from our server, then the key on your Mac. Your username stays reserved for 30 days, so no one else can take it straight away. Reports you sent stay with us so we can act on them.

Dashboard: your websites

Your Dashboard account. When you open the Dashboard, Clacky signs you in by itself, no email: it sends your licence key (Polar tells us which customer it belongs to) or, on the trial, a random ID kept in your Mac’s Keychain, and gets back a sign-in that lasts 180 days, also kept in the Keychain. The Calendar and Settings → Plan & usage use the same account.

Website analytics. If you add your website and paste the snippet, its visitors are counted the way we count our own: no cookies, and nothing stored on their device. Their IP address and browser are used only for a moment, to make an anonymous ID that changes every day, and are never stored. We keep the page (without the query string), the referring site, campaign tags, country, city (rounded to about 10 km), device type, browser, operating system, screen-size range and language, plus the events your site sends (at most 10 small values each). Raw visits are deleted after 90 days; daily totals are kept.

Who sees it. Only you, and people you invite to your workspace. A visitor can be followed through one day at most, because the ID resets every day, and no ID is ever shown. We don’t use your visitors’ data for anything else, and we never sell it.

Revenue and newsletter. If you connect Polar or Stripe, the read-only key is checked, encrypted with AES-256-GCM, decrypted only on our server to read orders and subscriptions, and never sent back; customers are stored as salted one-way IDs, never emails. Disconnecting deletes the key and that revenue data. If you use the newsletter, your subscribers’ emails are stored in our database for your list (double opt-in by default, an unsubscribe link in every email), and you can export or remove them.

Microphone, speech, captions and AI

The microphone is used only when you pick one for a recording, while Voice to Prompt shows “Listening”, and while the teleprompter follows your voice as it scrolls. macOS shows its orange dot whenever it’s on.

Everything is turned into text on your Mac, with Apple’s on-device speech recognition: Clacky asks for on-device recognition only, so it fails rather than send audio to a server. Voice to Prompt keeps the text in memory until it’s on your clipboard, and stores nothing. Captions are made the same way from your recording, and their temporary audio file is deleted straight away. Caption translation uses Apple’s on-device translation with the languages installed on your Mac, and AI caption drafts use Apple’s on-device model (macOS 26). macOS may download a language model from Apple the first time, like Dictation does; your audio and text are never part of that.

Quiet during calls and the automatic Call mode only check whether another app is using the microphone. Clacky never opens the microphone to find out.

AI tools (MCP) and agent alerts

Connecting AI tools (MCP) is off by default. When you switch it on, a small helper inside Clacky talks to the app through a private connection on your Mac (a local socket only your user account can open, with its own key). Nothing goes over the network. Your AI tool can ask Clacky for a few things, like a notification, a note, Mac health numbers or a screenshot; Clacky asks you before every screenshot unless you allow it in Settings. It never gives an AI tool your keystrokes, typed text or clipboard.

Agent alerts add a hook to Claude Code or Codex only when you click Install, after showing you exactly what it adds (and backing up the file). The hook tells Clacky on your Mac that a session started, finished or needs you; it never passes your prompts or your code.

Mac Health, cleanup, notes and the rest

Mac Health reads memory, CPU, disk and battery numbers on your Mac and shows them; they stay there. The storage cleaner and the app uninstaller only scan when you ask, show you what they found, and move files to the Trash only after you confirm; the uninstaller never touches Apple’s own apps. Notes and tasks, modes, focus timer stats, colour picker history and your settings are all saved on your Mac.

Keep Awake’s lid-closed mode changes a sleep setting through macOS’s own password prompt, so Clacky never sees your password, and it switches back when you turn it off or quit.

Anonymous usage stats

New installs ask first: the welcome tour’s “help Boop get smarter? 🍪” question, and nothing is sent until you say yes (a “not now” sends nothing at all). Macs that had Clacky before 2.5 keep the choice they already had until they answer one gentle ask; “no thanks” turns it off. If a new install never answers, it counts as “not now”: nothing is sent, and Boop asks once more a week later. One switch turns it off any time: Settings → “Share anonymous usage stats”. They show which tools are used, so the next version gets better. About every 15 minutes and when you quit, the app sends:

• a random install ID made on your Mac (not linked to your licence, email, hardware or trial; a new one is made if you turn sharing off and on again),
• the app and macOS versions, whether Clacky runs as a trial, licensed or locked, and whether keyboard sounds are on,
• events from a fixed list, like “opened the dashboard”, “turned on clipboard history”, “picked the Droplet sound”, “saved a 40-second recording” or “an error with code X”,
• daily totals of clicks and scrolls, and how many keys you press and of what kind (like space or enter), numbers only, never which letters or words. Yesterday’s click and scroll totals also add to a public total on clacky.app.
• since 2.7, also: how many cookies you earned in Clacky since the last report, at most once a day (the count only, never what earned them). It adds to the public “cookies baked” total on clacky.app.
• since 2.5, also: which welcome-tour screens you see or skip and how long the tour took, which starter-kit switches you kept or changed, Demo Studio export settings (format, shape, quality, frame rate, captions on or off) and whether the export worked, how Ask Boop answered and whether “Do it for me” was used (never your question or the answer), your Blip’s level, streak and glow per day, ⌘K picks (the kind of row, never what you typed), which shortcut actions you change (never the keys), Scrolling Capture heights and why one stopped, which plan you click on the paywall, which Blip share cards you make (the kind, size and whether you copied, saved or shared one; never the image or its numbers) and which achievements your Blip unlocks. Lengths, sizes and days only in rough ranges.

Never: which keys you press, any text, your screen, app, window or file names, where you click, your licence key, your email, or anything you typed into Clacky. Our server adds your country from the connection and never stores the IP address. Events are deleted after 400 days.

The full list of event names, with every value each one can have, is in the app: Settings → General → More options → “Every event Clacky can send”, with a Copy button.

Everything else that goes online

• Updates: about once an hour, and shortly after launch or wake, while automatic updates are on (a switch in Settings), the app downloads clacky.app/appcast.xml, a list of versions. The request carries only what every web request does (your IP address and the app version). We count checks and downloads per day by app version only.
• Licence: when you activate, the app sends your licence key and your Mac’s model name (like “MacBook Air (M1, 2020)”, so you can tell your Macs apart) to Polar, and re-checks the key with Polar at most once a week. Never your name, your computer’s name or a serial number.
• Dashboard, Calendar and Friends: only when you use them (see their sections above).
• Trial check: to keep the trial to once per Mac, Clacky sends an anonymous, one-way ID of your Mac (not your serial number or anything personal) the first time it opens. We store only that ID and when the trial started.
• First-open count: Clacky counts, anonymously, that it was opened for the first time and that its permission step worked. No ID, nothing about you or your Mac: just one more in a daily total.
• Boop Support: only when you press Send (see below).

Payments and plans

Payments are handled by Polar, our merchant of record: they take the payment for monthly, yearly and lifetime plans, handle tax and receipts, and issue your licence key. Monthly and Yearly start with a 7-day trial at checkout, where you add your card with Polar; Lifetime ($19.99) is paid once. We never see your card details. You manage or cancel a subscription in Polar’s customer portal.

Polar shares your email address and order details with us so we can provide your licence and help when something goes wrong. We don’t use them for anything else, and we don’t sell or share them. See Polar’s privacy policy.

Boop Support and feedback

When you write to Boop Support (in the app or on the support page), we store your messages, your email only if you add one, and the Clacky and macOS versions only if you tick “Include”, in our database at Cloudflare (D1). Each message is emailed to Justinas, who answers. It’s private. Your browser, or the app, keeps a ticket number and a private key so you can see replies, which are fetched only while the chat is open. No account.

Reviews you send (the stars on the home page or the review form) are stored the same way and never published automatically. If you said we may quote you, we still ask before quoting, with your first name only.

To stop spam, these forms keep a one-way hash of your connection (never your IP address itself) for one hour, then delete it. Want a conversation deleted? Email [email protected].

Boop Assistant (AI help on this website)

When you ask Boop Assistant a question (the “Ask Boop” button on this website, or Ask Boop in the Mac app’s Boop Support, which also sends the app’s version and which of its features are on), we send your question, the page you’re on, your language and your last 3 questions and Boop’s answers in this chat (for context) to Anthropic, the company that makes the Claude AI model, so it can write the answer. Anthropic processes it to answer and doesn’t use it to train its models. Nothing else is sent: no name, no email, no account or licence data, no IP address from us.

We keep an anonymised copy in our database at Cloudflare (D1): the question, shortened to 300 characters with email addresses, links and long numbers removed, plus the page, the language, the topic Boop matched, whether Boop was sure, and your 👍/👎 or whether you chose to talk to Justinas. No IP address, name or email. Justinas reads these to fix what confuses people. To limit abuse, the same one-hour connection hash as the support forms is used. Please don’t type personal details into the question.

Email lists

Updates list. If you ask for an email when something new drops, we store your email and when you signed up in our database at Cloudflare (D1). One email per release, nothing else. Reply to any of them or email [email protected] to be taken off.

Trial email. If you leave your email on the download form, we use it only for the download link, the setup guide and a few tips during the trial, sent through Resend, our email provider. Every email has an unsubscribe link. The Mac app never sends your email, and its anonymous stats carry nothing that could tie them to it.

Link for your Mac. If you ask on your phone for the link by email, we store your email, the site language, the campaign tag in the link you arrived with (like ?ref=tt) and when you asked. We send the download link and, only if you haven’t started the trial on the site or bought, one reminder a day later, through Resend. Then nothing more. Every email has an unsubscribe link.

Windows list. If you join it, we keep your email for one email if Clacky comes to Windows, and to count how many people want it.

These forms check that your email’s domain can receive mail and keep a one-way hash of your connection for one hour to limit signups. We never sell your email or share it for anyone else’s marketing.

Justinas’s newsletter (“Get my newsletter” in the footer) lives on his own site, justinasrolando.com, with its own sign-up. Clacky doesn’t send it your email or anything from the app.

This website

No ads and no tracking cookies. We count visits with Umami, a cookie-free analytics tool we host ourselves: the pages viewed, the referring site, the browser, device type and country, without identifying you. We also count anonymous interactions, like button clicks and how far people scroll; never what you type.

Our own analytics. We also count visits with our own cookie-free analytics, the same one the Dashboard uses. Nothing is stored on your device and your IP address is never saved: an anonymous ID that changes every day is made from it and thrown away. We keep the page, the referring site, campaign tags, country, city (rounded to about 10 km), device type and browser. Raw visits are deleted after 90 days; daily totals are kept.

Heatmaps and session replays. For some visits (a random sample), Umami also records where people click and scroll, and an anonymised replay of the page, so we can see where the site is confusing. Everything typed into a form (like an email address) is masked before it leaves your browser; the page itself is recorded as you see it, and it never runs on the checkout thank-you page (your licence key), the feedback form or the admin pages. No cookies, nothing that identifies you.

The live click map and counter. When you click on this site, the shared counter goes up by one, and the city-level location Cloudflare (our host) derives from your connection (rounded to about 20 km) and the sound you used are kept for up to 24 hours to show the live map. Each city also keeps a running count. Never per person, never your IP address or precise location, and the page never asks for your location. The “online now” number counts open tabs with a random ID that lives only in that tab.

Games. If you put a score on a game’s top-10 board, we store the nickname you pick, your score and a random ID for this browser. The nickname and score are public on the board.

The sounds and the island are made in your browser. Your sound, theme and other choices on the page are saved in your own browser (local storage) and never sent to us. Like any website, our host keeps standard request logs, such as IP addresses, to run and protect the site.

Questions or deletion

Anything unclear, or want something deleted? Email [email protected]. A real person answers.