Privacy Policy

Tusk is built with privacy as a core principle. Your files stay on your Mac unless you configure a cloud destination. If you choose Google Drive or Dropbox, Tusk transfers backup files to that provider. We collect minimal data, we are transparent about what we collect and why, and we do not sell personal information. Limited service providers process data for the purposes disclosed later in this policy.

This policy covers both the Tusk macOS App and the Tusk website.

License verification

When you activate a license, the App sends a hashed machine identifier to our servers to verify your license key. This hash is a one-way fingerprint — it cannot be used to identify you or your device beyond license management. This data is stored securely in Supabase.

Product usage (App)

When you opt in, the App sends pseudonymous usage data to help us understand how Tusk is used and improve the product. This includes an anonymous install identifier (separate from your license machine ID), your app version, and aggregate feature usage — for example, which screens you opened, wizard steps completed, or when you created a project. File names, project names, folder paths, and file content are never transmitted.

Activation analytics and masked session replay are processed by PostHog (EU cloud). Session replay records UI interactions with all on-screen text and inputs masked before anything leaves your Mac. Aggregate usage summaries are also sent to our first-party backend (Supabase). You can opt out at any time in Tusk → Preferences → Privacy. Raw usage events are retained for 90 days.

In-app feedback

If you submit feedback from the app, we store your message and any screenshots you attach, linked to a device identifier (and your beta code when one is activated). This is optional and only sent when you choose to submit feedback.

Error reporting (App)

The App uses Sentry for crash and error reporting. If the App encounters an error, anonymised diagnostic information — including macOS version, device type, and a stack trace — may be sent to Sentry. No file content, file names, or personal data are included in error reports. If you have opted in to product usage data, error reports also carry the same anonymous install identifier, so we can match an error to the usage data from that session. Opting out of usage data removes it. You can opt out of error reporting at any time in Tusk → Preferences → Privacy.

Website analytics

The Tusk website uses Plausible Analytics, a cookieless, privacy-first analytics tool. Plausible does not use cookies and does not build visitor profiles. We collect aggregate page visits, referral sources, and interaction events to understand how people find and use our website.

Campaign measurement (website)

For YouTube and other campaign links, we count aggregate short-link clicks and landing-page visits matched to a campaign name (UTM parameters). If you sign up for beta access during the same browser session after clicking a campaign link, we attribute that signup to the campaign in aggregate counters only — we do not store the campaign beside your email or beta code, and we do not use cookies, localStorage, or sessionStorage for this. A page reload may lose in-session attribution; that is an intentional privacy tradeoff.

Download attribution (website)

Since September 9, 2026, the website stores the first landing pathname (for example /blog/hedge-alternatives-mac) and the referrer host (for example google.com, or an explicit direct-traffic token) in first-party localStorage for 30 days. The first write wins. On Download, Checkout, and Purchase we increment aggregate counters keyed by that pathname and host so we can see which pages lead to download starts (a successful download redirect, not a completed file transfer). We never join this to a license, trial, or email record. Those first-touch properties are used only for first-party counters; they are stripped before events are forwarded to Plausible. Pageviews are the attribution denominator: they count summed daily unique visitors (visitor-days) for the same first-touch keys, not range-unique people. Affiliate attribution is separate: see Cookies and local storage below.

Same-day visit dedup (website)

To avoid double-counting downloads and visitor-days in a single UTC day, we store a 16-character HMAC of IP address plus user-agent, keyed with a server secret and rotated daily, in mkt_ingest_keys. That digest is not a stable visitor id and is not used to build a profile. Rows older than 48 hours are deleted by the event-log prune job. We do not store the raw IP or user-agent in that table.

Beta signup (website)

When you request beta access, we process your email address to send your invite or waitlist confirmation. Legal basis: performance of steps at your request (pre-contractual) and, where applicable, legitimate interest in operating a waitlist. Processors: Resend (email delivery), Supabase (waitlist and beta-code storage). We do not sell your email. You can ask us to delete waitlist data by contacting niklas@tuskbackup.com.

Payment processing

Payments are handled by Stripe. Your payment information is processed directly by Stripe and is never stored on Tusk's servers. Stripe's own privacy policy applies to data collected during payment.

Operational logs (website)

When you purchase, sign up for beta, or activate a license via the website, we store short-lived technical logs to diagnose failures — for example, webhook processing or email delivery. These logs may include a partially redacted email address (first character and domain only), truncated device identifiers, event outcomes, and external reference IDs (such as Stripe event IDs). No payment card data is stored. Logs are automatically deleted after 7 days. Legal basis: performance of contract for purchase-related events and, otherwise, legitimate interest in keeping the service reliable. Processor: Supabase.

Google Drive integration

If you choose to connect Google Drive as a backup destination, Tusk requests access only to files it creates (drive.file scope). Tusk does not access, read, or transmit any other files in your Google Drive. Your Google account credentials are never stored by Tusk — authentication is handled entirely by Google's OAuth system. You can revoke this access at any time via your Google account settings at myaccount.google.com/permissions.

Dropbox integration

If you choose to connect Dropbox as a backup destination, Tusk uploads, verifies, and restores files only within the backup folders you configure. Your Dropbox account credentials are never seen or stored by Tusk — authentication is handled entirely by Dropbox's OAuth system, and access tokens are stored in your Mac's Keychain. You can revoke this access at any time via your Dropbox settings at dropbox.com/account/connected_apps.

We do not collect your files, file names, or folder structure. We do not collect your project names or any content from your machine. We do not use cookies for public analytics. We do not build visitor profiles on the website. First-touch download attribution is pathname plus referrer host only, stored in first-party localStorage, and counted in aggregate. Same-day dedup stores a rotating HMAC digest for 48 hours. Affiliate links may also store a partner slug in a first-party cookie and localStorage. Product usage summaries contain only aggregate counts and feature flags — never identifying content from your projects. We do not sell personal information.

The Tusk website does not use cookies for Plausible analytics. First-touch SEO attribution stores the first landing pathname and referrer host in first-party localStorage for 30 days (first write wins). Affiliate attribution, used only when you arrive through a partner link, stores a partner slug in a first-party cookie (tusk_aff) and in localStorage for 30 days so a later purchase can be credited to that partner. Strictly necessary cookies may also be used for basic website functionality. Whether a consent banner is required is a legal call, not a product one; Niklas should confirm that with counsel before treating the current setup as exempt.

Tusk uses the following third-party services:

• Stripe — Payment processing (stripe.com/privacy)

• Plausible Analytics — Website analytics (plausible.io/privacy)

• PostHog — App activation analytics and masked session replay (posthog.com/privacy)

• Sentry — App error reporting (sentry.io/privacy)

• Supabase — License verification, usage analytics backend, and operational logging (supabase.com/privacy)

• Google OAuth — Drive integration (policies.google.com/privacy)

• Dropbox — Dropbox backup integration (dropbox.com/privacy)

License activation records are retained for as long as your license is active. Anonymised error reports and raw usage events are retained for 90 days. Usage snapshots may be retained longer in aggregated form. Operational website logs are retained for 7 days. You may request deletion of your data at any time by contacting us.

Depending on your location, you may have rights under GDPR, CCPA, or other applicable privacy laws to access, correct, or delete data we hold about you. To exercise any of these rights, contact us at privacy@tuskbackup.comand we will respond within 30 days.

Tusk is not directed at children under 13. We do not knowingly collect data from children under 13.

We may update this policy from time to time. We will note the date of the most recent update at the top of this page. For significant changes, we will notify users via the website or the App.

For any privacy-related questions or data requests, contact us at niklas@tuskbackup.com.