Privacy Policy

Effective Date: 2026-09-17

1. Introduction

This Privacy Policy explains how Coffee Break Ideas, LLC ("we," "our," or "us") handles data in connection with ChassisWatch, our menu bar automation app for Mac, and this website at chassis.watch.

ChassisWatch is built to run entirely on your Mac. The sensor readings it watches, the automations you build, and the actions it takes stay on your device. The only things that ever leave your Mac are what's needed to activate and validate your license, and, if you choose to send one, a diagnostic report. This policy covers all of it in detail, including what our website and payment processor handle when you make a purchase.

By using ChassisWatch or this website, you agree to the practices described here. If you have questions we haven't answered, email us at support@chassis.watch.

2. Data the App Processes

Here's everything the ChassisWatch app itself reads, stores, and sends, broken down by what it's for.

Sensor and automation data (never transmitted)

ChassisWatch reads local hardware signals, chassis taps, lid position, ambient light, battery state, USB connections, and display changes, to trigger the automations you build. This processing happens entirely on your Mac. Your automations, the triggers and actions you configure, and any file paths or scripts they reference are stored locally in the app's state file and are never uploaded to us or to any third party.

If you grant ChassisWatch Accessibility access so it can take actions like simulating input, that permission is enforced by macOS on your device. It does not cause any data to be sent anywhere.

Licensing

Activating, validating, or deactivating a license is the only routine network activity the app performs, and it only talks to our own licensing API at chassis.watch. Each call sends:

• A one-way device identifier. This is a SHA-256 hash of your Mac's hardware platform UUID combined with an app-specific value. The raw hardware UUID and your Mac's serial number are never transmitted or stored, only this irreversible hash, which lets us recognize the same Mac on a later validation without ever holding a real hardware identifier.
• A device name you choose, shown during activation (e.g. "Zoran's MacBook Pro"). This is sent once, at activation, and used only as the label attached to that activation in our payment processor's system so you can tell your Macs apart if you manage your license later. We don't store it on our own servers.
• Your license key and a static product identifier, needed to look up and validate the license.

Our licensing backend stores, in our own database, a record per activation: the license key, the hashed device identifier, the product identifier, the activation timestamp, and which environment issued it. This is what makes validation and deactivation possible. It's deleted when you deactivate that Mac.

In response, our server issues a cryptographically signed lease (Ed25519), which the app verifies locally to confirm your entitlement. The signing key never leaves our server, and the app only ever holds the public verification key.

Diagnostic reports (only if you choose to send one)

ChassisWatch can generate a diagnostic report to help us troubleshoot hardware compatibility or bugs. This only happens when you explicitly ask for it. The app never generates or sends one automatically. A report may include your macOS version, app version, Mac model identifier, per-sensor status, and bounded technical details about the hardware interfaces ChassisWatch reads from. It is designed to exclude your name, email address, serial number, raw hardware UUID, license key, script contents or file paths, and your automation names or content.

You review the full report before doing anything with it. Sending it is entirely up to you, either by pasting it into our support form (see below) or emailing it to us directly. We never place it in a URL, and it's never uploaded on your behalf.

Software updates

ChassisWatch checks chassis.watch/appcast.xml over HTTPS to see if a new version is available, using the open-source Sparkle framework. This check isn't tied to your license or device identity.

3. Data the Website Processes

Separately from the app, here's what chassis.watch itself, the site you're reading right now, handles when you browse, buy, or contact us.

Purchases

Checkout, payment, receipts, and subscription or license management are handled by Polar (polar.sh), our payment processor and merchant of record. When you buy a license, Polar collects your payment details and the email address you provide to deliver your license key and receipt. We never see or store your card number. Polar's own privacy policy governs that data: polar.sh/legal/privacy.

The "N claimed" counter on our pricing page

To show a live count of how many licenses have sold, our server listens for a specific purchase event from Polar and reads only the event type, the product ID, and the order ID, enough to count it once and avoid double-counting a duplicate delivery. No customer name, email, or payment information is read or stored by this process.

Sale notifications

Separately, Polar is configured to post its own sale notifications directly to our internal Slack workspace when an order comes in. This is set up in Polar's dashboard and doesn't pass through our servers at all. It's for our team's internal awareness and isn't shared further.

Support requests

If you use the contact form at chassis.watch/support, we collect the name, email address, topic, and message you provide, plus a diagnostic report if you choose to attach one. This is sent to an internal Slack channel so we can respond to you. We use basic anti-spam checks (a hidden field bots tend to fill in, a minimum time-to-submit, and an origin check) that don't collect anything beyond what a normal form submission already includes.

What the website does not do

This site does not use cookies, analytics, advertising trackers, or any crash-reporting service. The only thing stored in your browser is your light/dark theme preference, kept in local storage on your device and never sent to us.

4. Third-Party Service Providers

We share the minimum data necessary with the following providers:

• Polar (payments, license key delivery, customer portal): billing information, email address, and the device name/label described above. See polar.sh/legal/privacy.
• Slack: support-form submissions and sale notifications, for our internal use only.
• Our hosting provider (EU, Nuremberg, Germany): runs the licensing API and website; holds the licensing database described in Section 2.

We do not sell or rent any data to advertisers or data brokers.

5. Data Retention

• Licensing activation records are kept until you deactivate that Mac, at which point the record is deleted from our database.
• Support-form submissions and diagnostic reports live in our Slack workspace's message history, governed by Slack's own retention settings.
• Purchase and payment records are retained by Polar according to its own policy and applicable financial recordkeeping requirements.

6. Security

• All communication between the app and our servers uses HTTPS/TLS.
• Device identifiers are one-way hashes; the underlying hardware UUID and serial number are never transmitted.
• License leases are signed with Ed25519 and verified locally by the app before being trusted.
• License keys are never written to our server logs.
• The private key that signs your license lease is generated directly on our production server and never on a developer machine, so it never passes through a local git checkout.

No system is perfectly secure, but the amount of data we hold is intentionally small, which limits what's at risk in the first place.

7. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or export the limited data we hold about you, and to object to or restrict its processing. To exercise any of these, email support@chassis.watch. Because we hold so little personal data ourselves, most requests about payment or billing information are best directed to Polar directly, and we're happy to help route them.

8. International Data Transfers

Our own servers, including the licensing database described in Section 2, are hosted in the EU (Nuremberg, Germany). Polar, our payment processor, is a US company (Polar Software Inc., Delaware), and its own privacy policy states that payment and billing data may be transferred to and stored in the United States, Canada, or other destinations outside the EEA and UK. See polar.sh/legal/privacy for the details of how Polar handles that transfer.

9. Children's Privacy

ChassisWatch and this website are not directed to children, and we do not knowingly collect information from anyone under 13. If you believe a child has provided us with information, email support@chassis.watch and we'll delete it.

10. Changes to This Policy

We may update this policy as the app or website changes. The "Effective Date" above reflects the most recent revision. Material changes will be reflected here, and if they meaningfully affect how we handle your data, we'll do our best to make that clear on this page.

11. Contact

Questions about this policy or how we handle data can go to support@chassis.watch.