Privacy Policy

Who we are

Headroom is published by Swirl Creative (“we”, “us”). This policy covers the Headroom Mac app, its command-line tool, MCP server and Agent Skill, this website, and the Headroom plugin for ChatGPT. It goes with our Terms of Service.

In short: we collect very little, and most of what Headroom knows about your disk never leaves your Mac.

The Headroom Mac app

The app has no accounts and no telemetry: no analytics, no crash reporter, no advertising identifiers.

• Scanning stays on your Mac. Headroom reads folder and file names, sizes and dates to map your disk. It reads file contents in only two cases: to compare duplicates, and to check a project’s .gitignore when deciding whether a build folder is generated. None of it is sent anywhere.
• Saved scans. So a scan can reopen instantly, Headroom keeps a compact copy of each one (names, sizes and dates) in ~/Library/Caches/dev.headroom.Headroom. Your settings, license key and free-cleanup count live in Headroom’s preferences file, ~/Library/Preferences/dev.headroom.Headroom.plist. In Settings you can turn saved scans off or delete them, and the support page shows how to remove everything.
• Two network requests. Headroom contacts our website for only two things: to check for a new version (it fetches /latest.json when it opens and once a day) and to show the current price (it fetches /api/pricing when it shows you the price of a license). Neither carries your scans, your license key or any identifier. Like any internet request, they reveal your IP address to our host, along with the usual request headers, such as a user-agent naming the app and your macOS version. Headroom never installs updates by itself: when a newer version exists it offers a download link that opens in your browser.
• Buying and downloading use your browser. Choosing Buy, or Download on an update notice, opens a link in your browser: a page on our website, or wherever the new version is hosted. That’s an ordinary website visit, described under This website.
• Your license is checked offline. Headroom verifies your key on your Mac with a digital signature and never asks a server whether it’s valid.
• Full Disk Access. If you grant this macOS permission, Headroom can measure folders macOS otherwise hides from apps, such as Mail and Messages data. It uses that access only for the on-device scanning described above.

Buying a license

Payments are handled by Stripe, on Stripe’s own checkout page. Stripe processes your card or wallet details; they never reach us and we never store them. What Stripe does with them is covered by Stripe’s privacy policy.

From Stripe we receive your name (when you give one), your email address, the details of the purchase (amount, date and Stripe’s checkout ID) and any billing details Stripe collects at checkout, such as your country or postal code. We use them to issue your license key, process refunds, answer support requests, prevent fraud and keep the financial records the law requires.

Your license key is personal. We generate it from those details when you open the confirmation page after paying (or when we re-send it). It contains your email address, your name, the checkout ID and the purchase time, encoded rather than encrypted, and signed so Headroom can check it’s genuine. Treat it like a password: don’t post it publicly, because anyone who has it can read the email address inside it and use it to activate Headroom.

The website has no customer database of its own. Your purchase record lives in Stripe, and your key is recreated from it whenever it’s needed.

This website

• No cookies, no analytics. We don’t set cookies, store anything in your browser, or run analytics, advertising or social-media scripts. The site loads nothing from third parties, and there’s no cookie banner because there’s nothing to consent to.
• Hosting logs. The site is hosted by Vercel. Like any web host, Vercel receives and logs standard request information, such as your IP address, the time, the page requested and your browser’s user-agent, to run and secure the service. The Mac app’s update and price requests are logged the same way. We don’t use these logs to identify, profile or track anyone. See Vercel’s privacy policy.
• Checkout. Choosing Buy takes you to Stripe’s checkout page, which Stripe runs, with its own cookies and policies.
• The confirmation page. After you pay, the page that shows your key has your checkout ID in its address. Keep that address private: anyone who has it can see your key. The page asks browsers not to pass the address to other sites, and asks search engines not to index it.

The Headroom plugin for ChatGPT

The plugin is a hosted service that lets ChatGPT work with a disk scan you choose to share.

• What it receives. Only what you or ChatGPT send it in a conversation, typically file and folder names and their sizes from a Headroom scan. It can’t reach your Mac or your files.
• What we do with it. We process it only to answer that request, for example to chart where your space went, and nothing is kept afterwards. We don’t store it, log it, share it or sell it, and we don’t use it to profile you or to train models.
• No tracking. We don’t record IP addresses, timestamps or patterns in what people ask.
• Hosting. Plugin requests reach us through Vercel, so the standard hosting logs described under This website apply to them too. Those logs show that a request happened, not what it contained.
• Share with care. File and folder names can reveal personal or confidential things, such as client or project names. Share only what you’re comfortable sending, and never secrets. Your conversation with ChatGPT is handled by OpenAI under its own terms and privacy policy, not by us.

Command line, MCP server and Agent Skill

The headroom command-line tool, the MCP server (Headroom mcp) and the Agent Skill run on your Mac and send nothing to us. If you connect them to a coding agent or AI assistant, whatever they print, such as file and folder names and sizes, goes to that agent and its provider under their terms, so connect only tools you trust with that. Nothing here removes files: agents can only stage items, and you confirm in the app.

Who else handles information

We use two service providers: Stripe for payments and Vercel for hosting. If you use the plugin, OpenAI handles your ChatGPT conversation. They process information as described above and under their own policies, and may do so in the United States and other countries.

We don’t sell your personal information or share it for advertising. We may disclose information if the law requires it, to protect our rights or our users, or as part of a sale or reorganization of the business.

How long we keep information

• On your Mac: until you delete it. We hold none of it.
• Purchase records: in Stripe, for as long as your license exists (it’s for life, which lets us re-send your key and honor refunds) and as long as the law requires us to keep financial records. If you ask us to delete yours we will, except for what the law requires us to keep, and we may then be unable to re-send your key.
• Support emails: for as long as needed to help you and keep a reasonable record of it.
• Hosting logs: for a limited time, set by Vercel.
• Plugin data: not kept.

Children

Headroom is a tool for adults and isn’t aimed at children. We don’t knowingly collect personal information from anyone under 13, or under the age of digital consent where you live. If you think a child has given us information, contact us and we’ll delete it.

Your rights and choices

Depending on where you live, you may have the right to ask for a copy of your personal information, to have it corrected or deleted, to object to or restrict how it’s used, and to receive it in a portable format. We don’t sell personal information or use it for targeted advertising.

We hold little, usually just a purchase record. To make a request, contact us; we may ask you to write from the email address you bought with so we know it’s you. We’ll reply within 30 days. If you’re not happy with our answer, you can complain to your local data protection authority.

On your Mac you’re always in control: you can turn off or delete saved scans in Settings, and remove everything Headroom stores by following the uninstall steps.

Security

The website uses HTTPS, and payment details go straight to Stripe. The secret that signs license keys is held as a protected setting on our hosting account and never ships in the app. No system is perfectly secure, which is one reason we keep so little.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed, and if a change materially affects how we handle your information we’ll say so on this page before it takes effect.

Contact us

Questions about this policy, or want to use one of your rights?

Contact details coming soon.