Privacy policy

Floodtide is made by an independent developer trading as Bhop Studio ("we"). Bhop Studio is a trading name, not a registered company. This policy covers the Floodtide app for macOS and this website. The short version: the app works without an account, everything it sends home is either anonymous or something you typed and chose to send, and we never sell or share data for advertising.

Questions or requests: raf@bhopstudio.com. The request-by-request technical breakdown lives on the docs page.

What the app sends, and when

Floodtide scans your Mac locally; what leaves it is listed below.

• Checking for updates. To find out what is current, the app fetches public sources directly: Homebrew's catalogue (formulae.brew.sh), app vendors' own Sparkle and Electron update feeds, GitHub's API, Microsoft's update manifests and Apple's App Store lookup. It also fetches Floodtide's own signed catalog from bhopstudio.com. Those servers see your IP address the way any website you visit does. Floodtide adds no account, identifier or app inventory to those requests.
• Anonymous usage line (optional, off until you say yes). If you agree on the consent screen, the app sends at most one line a day: a random install ID, whether the copy is in trial, licensed or lapsed, the Floodtide version, and broad update outcomes (source, installed, failed or skipped, and for a failure the step it stopped at, one word from a fixed list). It never includes your email, licence key, Mac identity, app names or error text. You can read the exact payload and turn this off in Settings, Privacy.
• Coverage sharing (on by default, one switch turns it off). Floodtide sends, at most once a day, a list of app name, bundle identifier, version and build, whether Floodtide could check it and which updater it carries, any update feed address or the source repository an app names, and whether macOS recorded that the app was downloaded from the internet (yes or no, never the address). It carries no name, account or device identifier, and the server keeps no IP address. It is on in every copy from the release that opened the Tide; the first launch says so, and Settings, Privacy turns it off. The server keeps a count per app version so that a version one Mac alone reports is never shown to anyone. Sharing does not depend on subscribing to the Tide, and the Tide works with it off.
• Coverage requests (only when you click). Requesting coverage for an app sends that app's name, bundle identifier, version and whether this copy has the Tide, after a dialog that shows you exactly what will be sent.
• What happened to your requests (once a day). Once a day, for apps you asked Floodtide to cover: their bundle IDs, to show what happened.
• Bug reports (only when you send one). A report contains what you wrote, the app version, and, if you attach it, the failure diagnostic the row shows you. Adding your email is optional; if you add it, we use it only to reply and to tell you when the fix ships.
• Floodtide's own updates. The app checks our server for new Floodtide versions using Sparkle. No system profile is attached.
• Licences. Activating a licence sends your key and an anonymised device identifier so the three-Mac limit works. Deactivating a Mac frees the seat. A signed receipt is kept in your Mac's Keychain so the app works offline.

What the website collects

• Anonymous visit counts. Page views, downloads and checkout starts are recorded against a hash of your IP address that changes every day, with the page, the referring site and your country. We cannot turn the hash back into you, and these rows delete themselves after 13 months. There are no third-party analytics or advertising scripts. Source and campaign labels may be carried in internal links and purchase forms, without adding a tracking cookie or persistent visitor identifier.
• Purchases. Stripe processes payment. Your card details never touch our servers. We keep your email address, the amount, and Stripe's transaction identifiers, because we have to: they are how licences are recovered, refunds are honoured and accounts are kept. If you add the Tide, it is a Stripe subscription; we keep its identifier and the date it is paid through against your licence. Your licence key is emailed to you via Resend.
• Account sign-in. Signing in to the account page uses a one-time code emailed to you, then a session cookie so you stay signed in.
• Cookies. Five, all first-party: the session cookie above; a one-year language cookie (ft_lang) holding only "en" or "de", set only when you press the language switch in the header, so the site keeps the language you picked instead of following your browser's; a currency cookie (ft_cur) holding only "gbp", "eur" or "usd", worked out from the country your IP address is in so prices show in your currency, and gone when you close the browser; a 90-day referral cookie (ft_ref) set only if you arrive through someone's referral link, so their credit lands when you buy (following the link also records the day and your country against a daily hash that is not your IP address, so the referrer sees how many people clicked, never who); and a 90-day creator cookie (ft_creator) set only if you arrive through a creator's link, holding their link name and a random number, so they are credited if you buy; they see your country and the days you clicked, downloaded and bought, never who you are. No tracking cookies, no ad cookies.

What we never collect

Your installed app list once the sharing switch is off. File paths. Screen contents. Contacts. Your location beyond country. Anything from Full Disk Access, Accessibility or screen recording, because the app never asks for those permissions.

Who processes data for us

Stripe (payments), Vercel (website hosting), Supabase (database), Resend (transactional email). Each receives only what its job needs.

How long we keep things

Website and download events: 13 months, deleted automatically. Purchase records: as long as accounting law requires. Licences and activations: while the licence exists. Bug reports: until resolved and a reasonable period after. Tide subscriptions: the identifier and the paid-through date, while the licence exists. The anonymous usage lines and coverage counts are not linked to you and are kept in aggregate.

Your rights

If you are in the UK or EU, you can ask for a copy of the personal data we hold about you (in practice: your purchase, licence and any bug reports you sent with your email), have it corrected or deleted, or object to processing. Email raf@bhopstudio.com and a person will read it. Deleting purchase records is limited by accounting law; everything else we can honour. You can also complain to the ICO (ico.org.uk).

Changes

If this policy changes in a way that matters, the change is dated here and noted in the release notes. We will not quietly widen what is collected.