The short version: we collect what we need to sell you apps and make them work, and nothing else. No ads, no tracking cookies, no profiling, and we never sell your data.
Who is responsible
The controller of your personal data is PROAF SOCIETA’ A RESPONSABILITA’ LIMITATA SEMPLIFICATA (ProAF S.r.l.s.), Via Genova 7, 52100 Arezzo (AR), Italy, VAT number and tax code IT02541950511, the company that runs Quits and publishes its apps.
For anything about your data, write to support@getquits.app with “Privacy” in the subject, or to our certified email (PEC) proaf@pec.it. We haven’t appointed a Data Protection Officer, because the law doesn’t require one for a business like ours.
What we collect, and why
The waitlist
- What: your email address, the date, the page you signed up from, your browser’s language and whether you ticked the box for the private beta.
- Why: to send you a single email when Quits opens. If you ticked the private beta box, we may also write to you once, in April 2027, to invite you to the beta. We don’t use it for anything else and we don’t share it.
- Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
- How long: until we send the launch email, then we delete it within 30 days. If you leave the list before then, you won’t get the email and we delete your address within 30 days.
The makers waitlist
- What: your email address, the name and web address of your app, and the date.
- Why: to contact you when Quits starts selling apps from independent makers.
- Legal basis: your consent, which you can withdraw at any time.
- How long: until we contact you about it, and no longer than 36 months after you sign up.
Your Account
- What: the email address you paid with, any other email addresses you link, and when each one was confirmed. If you sign in with Apple, we receive an account ID, your email address (or an Apple relay address, if you choose to hide yours) and your name only if you choose to share it. If you sign in with Google, we receive an account ID, your email address, your name and your profile picture. Apple and Google also send the technical tokens that confirm the sign-in. We never get your Apple or Google password, or access to anything else in those accounts.
- Sign-in links: each one works once and expires after a few minutes.
- Sessions: while you’re signed in, we keep a session record with the IP address and browser type it started from, so we can keep you signed in and spot misuse. We delete it when you sign out or it expires.
- Why: to give you your Library, let you sign in without a password, activate your apps and count your Level.
- Legal basis: the contract with you (Article 6(1)(b) GDPR).
- How long: as long as your Account exists, because your Licenses have no end date.
Orders and Licenses
- What we store: for each order, its number and date, the apps, their prices, discounts and Level, the currency and total, the email used, whether anything was refunded, and Stripe’s reference numbers for the payment. For each License, its keys, when they were issued and whether they were revoked.
- What Stripe shares with us: after checkout, Link (Stripe’s merchant of record, see below) shares the order details with us, as its terms explain: your name, email address, billing address, what you bought, the amounts and the type of payment method (for a card, its brand and last 4 digits). We can see these in our Stripe account, but we copy into our own database only what’s listed above. We never see your full card number.
- Why: to deliver your apps and updates, handle refunds, calculate Levels, answer support and keep our accounts.
- Legal basis: the contract with you, and our legal obligations (Article 6(1)(c) GDPR) for accounting and tax.
- How long: as long as your Account exists. If you close it, we keep order records for up to 10 years where we need them for accounting and tax obligations (article 2220 of the Italian Civil Code) or to defend legal claims.
Your Macs
- What: a License counts 5 active Macs, so each app sends us a code for the Mac it runs on: a keyed hash (HMAC-SHA256) of the Mac’s hardware UUID, computed on your Mac. The UUID itself never leaves your Mac, and the code can’t be turned back into it. The code stays the same for every Quits app on that Mac and after you reinstall macOS, so we recognise the same Mac instead of counting it twice. Because it still identifies a Mac, we treat it as personal data. With it we store, for each key, when the Mac was first activated and when it last checked in.
- When the app contacts us: once when you activate it, then at most once a day when it’s online, sending only the License key and that code. As with any connection, our server sees your IP address; we keep it only in the short-lived server logs described below.
- Why: to honour the limit of 5 active Macs and to revoke a key automatically when a 6th Mac becomes active.
- Legal basis: the contract with you, and our legitimate interest in preventing misuse of Licenses (Article 6(1)(f) GDPR).
- How long: a Mac stops counting 90 days after its last check-in. We delete its record 12 months after its last check-in, or when you close your Account.
Revocation at the 6th Mac is automatic: no person decides it. It doesn’t take anything away from you, because a new key reaches you by email right away. If you think it happened by mistake, write to us and a person will look at it.
Updates
Our apps check for updates with Sparkle, from getquits.app. An update check sends what any web request sends: your IP address, and the app’s name and version. Sparkle can also send a profile of your system (Mac model, macOS version and more): in our apps that option is turned off. Update files are downloaded from our file storage.
What the apps do on your Mac
The apps contain no analytics and no advertising code. Apart from activation, the License check and the update check described above, an app sends data only when a feature you use needs it, and its page on the Store says so.
Apps bought on the Mac App Store don’t contact us for Licenses or updates: Apple handles both, under Apple’s privacy policy.
Support emails
- What: what you write to us, your email address, and what we need from your Account to help you.
- Why: to answer you.
- Legal basis: the contract with you, or our legitimate interest in answering people who aren’t customers yet.
- How long: 24 months after the last message of the conversation.
Visitor statistics
We count visits with Umami, which runs on our own server. It uses no cookies, doesn’t store IP addresses and doesn’t follow you across websites. It records the page, the site you came from, your browser, operating system, device type, screen size, language and country (worked out from the IP address, which is then discarded). We use these anonymous numbers to see which pages work and how many people join the waitlist. Legal basis: our legitimate interest in running the Store.
Server logs and backups
- Our server keeps technical logs of each request (IP address, time, page, browser type, errors) for security and troubleshooting, and deletes them after 14 days. Legal basis: our legitimate interest in keeping the Store secure.
- We back up the database every day to storage in the EU, and keep each backup for 30 days.
Cookies and browser storage
The Store sets only the cookies it needs, so there is no cookie banner:
| Cookie | What it does | How long |
|---|---|---|
| Session | Keeps you signed in | Until you sign out or the session expires |
| Sign-in | Protects a sign-in with Apple, Google or an email link from forgery | A few minutes |
currency |
Remembers the currency you chose | 12 months |
cart |
Remembers the apps in your cart | 30 days |
None of them is used to track you.
Our pages load fonts and scripts only from getquits.app, not from Google or other companies. The payment page is Stripe’s, on Stripe’s own website, and it uses Stripe’s cookies under Stripe’s privacy policy.
Who else sees your data
Our service providers, who handle data only on our instructions, under a data processing agreement:
| Provider | What for | Where the data is |
|---|---|---|
| IONOS SE, Germany | The server that runs the Store, the database and the visitor statistics, and receiving email sent to support@getquits.app and forwarding it to our company mailbox | EU |
| Backblaze, Inc., United States | Storage for app files and database backups | EU (EU Central region) |
| Postmark, a service of ActiveCampaign, LLC, United States | Sending our emails: sign-in links, purchases, new keys, refunds and the launch email | United States |
Postmark is the email provider we plan to use. If we change any provider, we’ll update this list before the change.
Our emails contain no tracking pixels and no tracked links.
Companies that decide for themselves how to use your data, under their own privacy policies:
- Stripe. Sold through Link, LLC and the other Stripe companies take your payment, issue receipts and invoices, handle tax, refunds, disputes and fraud checks, and look after the Link account you may use at checkout. They are responsible for the data they collect at checkout: see Stripe’s privacy policy.
- Apple and Google, only if you choose to sign in with them.
- Public authorities, only when the law requires it.
We never sell your data or share it for advertising.
Transfers outside the EU
Postmark and Stripe’s merchant of record are based in the United States, and Backblaze is a US company even though our data stays in its EU region. Where data goes to the United States, the transfer relies on the EU-US Data Privacy Framework when the company is certified under it, and otherwise on the European Commission’s standard contractual clauses.
Your rights
You can ask us to:
- see the data we hold about you and get a copy of it;
- correct it;
- delete it;
- limit how we use it, or object to a use based on our legitimate interest;
- receive the data you gave us in a machine-readable format;
- stop using data based on your consent: withdrawing it doesn’t affect what we did before.
Write to support@getquits.app with “Privacy” in the subject. We reply within 1 month, and we may ask you to confirm the request from your Account’s email address so nobody else can make it for you.
Closing your Account deletes your Account, your linked email addresses and the records of your Macs. It also ends your Licenses, so we’ll confirm with you first. We keep order records only as explained above. For the data Stripe holds about your payments, ask Link at support.link.com.
If you think we’re handling your data unlawfully, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority of the EU country where you live or work.
Security
Every page and connection uses HTTPS. The database is not reachable from the internet, and only the people at ProAF who need it can access our systems. License keys are signed with a private key that stays on our server, and your Mac’s hardware ID never reaches us.
Children
Quits is not meant for children under 14, and we don’t knowingly collect their data.
Changes to this policy
When we change this policy, the date at the top changes too. If a change affects how we use data you have already given us, we’ll tell you before it applies.