Security and privacy

Signed and notarized by Apple

Every app is signed with an Apple Developer ID certificate, team ID DUP2U7JCR6, and notarized by Apple. Notarization means Apple scanned the build for malware before it shipped. You don't have to take our word for it. Run these in Terminal after installing:

spctl -a -vvv /Applications/SupaClip.app

codesign -dv --verbose=2 /Applications/SupaClip.app

The first command should end with source=Notarized Developer ID. The second should show TeamIdentifier=DUP2U7JCR6. Swap in SupaGrab, SupaNext, SupaJot, SupaPick or SupaMeter. Updates have their own check. Each one carries an Ed25519 signature, and the app refuses an update that doesn't match.

What each app connects to

None of the apps has an account or a cloud service for your data. Your clipboard history, screen captures, notes, picked colors and calendar events stay on your Mac. This table is the full list of network connections.

What SupaPick reads from your screen

SupaPick needs the Screen Recording permission in macOS. It asks once, during setup. The permission is used for one thing: when you press the shortcut, SupaPick takes a snapshot of each display so the loupe can show and read the pixels under your cursor. The snapshot is held in memory while the loupe is open. SupaPick has no code that saves it to a file or sends it anywhere. The cursor is left out of it.

What you pick is stored on your Mac. Your recent colors and palettes are in ~/Library/Application Support/SupaPick/library.json. Your settings are in the standard macOS preferences (UserDefaults). The trial start date is in your Keychain. SupaPick's only network connections are the update check and the license call in the table above.

Updates

The apps update through Sparkle, the standard Mac updater. It reads a small file from the app's own website, and if there is a newer version it downloads the zip from download.<app>.app. We do not turn on Sparkle's optional system profile, so no hardware or OS details are sent beyond what a web request carries.

What SupaMeter sends to Anthropic and OpenAI

SupaMeter asks each provider how much of your limit you have used. It reads your Claude token from the Keychain item that Claude Code created (macOS may ask you to allow that), and your Codex token from ~/.codex/auth.json. The token goes only to that provider's host, as a Bearer header. The request uses a session with no cookies and no cache, and the app refuses redirects, so a token can't be passed on to another host. SupaMeter never refreshes a token. If it expired, it asks you to sign in again in the tool. Spend estimates come from your local logs and a price table bundled in the app. Nothing about your usage is sent to us.

Do the apps have analytics?

No. We searched every app's source for analytics and crash-reporting code and found none. The only dependencies are SupaKit, our own shared code, and Sparkle. The only network code is the update check and, in the paid apps, the license call. SupaMeter adds the two usage requests above. SupaClip says the same in its own settings: no account, no cloud sync, no analytics.

How licenses work

The paid apps cost $4.99 once. After you buy, you get a license key by email, and it is also shown on the page you land on after checkout. The key is a signed piece of text. The app checks the signature itself, offline, against a public key built into the app. That check is what unlocks it.

Right after, the app tells the license server about the activation. It sends the key and a Mac ID, which is a SHA-256 hash of your Mac's hardware UUID, so it can't be turned back into the UUID. The server uses this to enforce the limit of three Macs per license and to switch off a key after a refund. If the server can't be reached, nothing happens and the app stays unlocked. Only an explicit answer from the server, "three Macs already" or "refunded", takes a key away.

Your trial clock is kept in your Mac's Keychain, not on a server.

For each purchase, the license server keeps your email address, your license key, the time of purchase, whether the key was refunded, the hashed IDs of up to three Macs, and a reference to the Stripe payment. It needs these to email you the key again, to enforce the Mac limit and to revoke on refund. It does not hold your card number. That never reaches us.

What the websites measure

The SupaTools sites use SupaPulse, our own analytics, with its script served from the site itself. It sets no cookies and writes nothing to localStorage or sessionStorage, so there is no banner to click. It sends this when a page loads:

• A random visit ID. It is created in memory when the page loads and is gone when you leave or reload. It is never stored on your device.
• The page address, page title and the page you came from.
• Your browser language and any utm_ tags in the address.
• While you read: how far you scrolled, as a percentage, and how many seconds you were active on the page.
• A few click events, such as clicks on Buy and Download buttons.

Like any request, it reaches SupaPulse with your IP address and browser details. The script has a function that asks the SupaPulse server for a visitor fingerprint. Our pages never call it, and the script itself reads no canvas, fonts, screen size or other device details.

When you click a Buy button, we add that visit ID to the Stripe link as client_reference_id. It lets us credit the purchase to the site and visit it came from. Because of this, the visit ID is tied to your purchase, along with your email and the amount, which the license server reports to SupaPulse as a sale. Without that link, we couldn't tell which page sold what.

Where purchases go

Buy buttons open a Stripe checkout page. Stripe takes your payment and handles tax. Your card details go to Stripe and never touch our servers or our sites. After payment, Stripe tells the license server, which creates your key and emails it to you.

Report a security issue

Email support@supatools.app with what you found and how to reproduce it. A person reads that inbox. Please give us a reasonable chance to fix the problem before you share it publicly. We'll tell you when it's fixed.

Questions and answers