Privacy Policy

Last updated: March 30, 2026

Short version: NotchCode processes your AI session data locally on your machine and does not collect telemetry or analytics. The only data transmitted to our servers is your license key and a hashed hardware identifier for license validation, and standard HTTP information during update checks. We do not sell your personal information.

What NotchCode Does

NotchCode is a macOS application that monitors AI coding sessions (Claude Code, Gemini CLI, Codex) by reading event data from local hooks and JSONL files on your computer. All processing happens locally. No session data, conversation content, or code ever leaves your machine.

Local System Access

To provide its functionality, NotchCode performs the following activities locally on your Mac. None of this data is transmitted to any server or third party:

AI session file reading: The app reads JSONL files produced by AI coding tools (Claude Code, Gemini CLI, Codex) to display session status, conversation content, and tool results within the app.
Hook script installation: The app installs small hook scripts into AI tool configuration directories (e.g., Claude Code's hooks directory) to receive real-time session event notifications via a local socket.
Global event monitoring: The app registers global keyboard and mouse event monitors. Keyboard monitoring is used for the global hotkey. Mouse monitoring is used for detecting interaction with the notch area. This requires the macOS Accessibility permission.
Process enumeration: The app enumerates running processes to detect active tmux sessions and identify which AI coding tools are running.
Accessibility API: The app uses the macOS Accessibility API for window detection and focus management.

Network Connections

NotchCode makes the following network connections:

License activation (one-time): When you enter a license key, NotchCode contacts our license server to validate it. Your license key and a hashed hardware identifier are transmitted. This happens once at activation.
License re-validation (periodic): Approximately every 7 days when online, NotchCode verifies your license is still valid. If offline, this check is silently skipped.
Update checks (daily): NotchCode checks for new versions using the Sparkle update framework via an appcast file hosted on our servers. During these checks, the following information is transmitted: your app version, macOS version, and your IP address (as part of the standard HTTP request). No other identifying information is transmitted.

What NotchCode Does NOT Do

No analytics or telemetry of any kind
No crash reporting to external services
No tracking pixels, cookies, or fingerprinting
Your code and AI session content is read locally for display within the app but is never transmitted to any server or third party
No data sharing with third parties (beyond Paddle for license validation)
No advertising or ad tracking

Data Storage

NotchCode stores the following data locally on your Mac:

License information: Stored in your macOS Keychain (encrypted by the operating system).
Trial start date: Stored in Keychain, UserDefaults, and a local file for tamper resistance.
App preferences: Stored in UserDefaults (notification sounds, screen selection, enabled tools).

All data is stored in ~/Library/Application Support/NotchCode/ and macOS Keychain. You can delete this data at any time by removing the app and its support directory. Note: Keychain entries created by NotchCode (license information, trial dates) persist after you uninstall the app. To fully remove them, open the macOS Keychain Access application and search for "NotchCode" to delete these entries manually.

Hardware Identifier

For license activation, NotchCode generates a one-way SHA256 hash of your Mac's hardware UUID combined with the app's bundle identifier. This hash cannot be used to identify your device outside of NotchCode. It is used solely to enforce the one-device-per-license limit.

Payment Processing

Payments are processed by Paddle, our Merchant of Record. Paddle handles all payment information (credit cards, billing addresses). NotchCode never sees or stores your payment details. Please refer to Paddle's privacy policy for information about how they handle your data.

Data Processors

We use the following third-party service providers who process personal data on our behalf:

Paddle (paddle.com): Payment processing, license key management, and billing. Paddle acts as the Merchant of Record and independent controller for payment transaction data.
Cloudflare (cloudflare.com): Website hosting (Cloudflare Pages) and license server infrastructure (Cloudflare Workers). Data may be processed at any Cloudflare edge location globally. Cloudflare participates in the EU-US Data Privacy Framework.

Website

Our website (notchcode.dev) is a static site hosted on Cloudflare Pages. It does not use cookies, tracking pixels, or analytics of any kind. Cloudflare may log IP addresses as part of their standard CDN operation. See Cloudflare's privacy policy for details.

All fonts used on our website are self-hosted. No requests are made to Google or other third-party font services.

Your Rights (GDPR/CCPA)

If you are located in the European Union, European Economic Area, United Kingdom, or California, you have the following rights regarding your personal data:

Right to Access: You may request a copy of any personal data we hold about you.
Right to Deletion: You may request deletion of your personal data. Since NotchCode stores data locally on your device, you can delete it yourself by uninstalling the app and removing its support files.
Right to Rectification: You may request correction of inaccurate data.
Right to Data Portability: You may request your data in a portable format.
Right to Object: You may object to processing of your data.
Right to Restriction of Processing: You may request that we restrict the processing of your personal data under certain circumstances, as provided by GDPR Article 18.
Right to Lodge a Complaint: If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement (GDPR Article 77).

In practice, NotchCode holds minimal data about you: only your license key and hashed hardware identifier are transmitted to our servers during activation. To exercise any of these rights, email support@notchcode.dev.

California residents (CCPA): We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. You have the right to know what personal information we collect, to request deletion, and to not be discriminated against for exercising your rights.

Israeli Privacy Protection Law

If you are an Israeli resident, you have the right to access, correct, and delete your personal information under the Israeli Privacy Protection Law, 5741-1981 (Section 13). To exercise these rights, contact us at support@notchcode.dev.

Data Retention

License activation records are retained on our servers for as long as your license is active. Upon deactivation or refund, activation records are deleted within 30 days. Local data on your Mac (preferences, trial dates) is retained until you uninstall the app.

Legal Basis for Processing (GDPR)

Where GDPR applies, we process personal data on the following legal bases:

Contract performance: Processing license activation data is necessary to fulfill our agreement with you.
Legitimate interest: Update checks and license re-validation serve our legitimate interest in providing a functional, up-to-date product.

International Data Transfers

Your license activation data (license key and hashed hardware identifier) is processed on servers that may be located outside your country of residence. The data controller is based in Israel. The European Commission has issued an adequacy decision for Israel, recognizing that Israel provides an adequate level of data protection. This means that transfers of personal data from the EU/EEA to Israel do not require additional safeguards.

Data Breach Notification

In the event of a data breach that affects your personal data and poses a risk to your rights and freedoms, we will notify affected users by email without undue delay and, where required by law, within 72 hours of becoming aware of the breach. We will also notify the relevant supervisory authority as required by applicable law.

Data Controller

The data controller for any personal data processed by NotchCode is NotchCode.

Postal address: NotchCode, Tel Aviv, Israel.

Email: support@notchcode.dev.

Children's Privacy

NotchCode is not directed at children under 13. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date. For material changes to how we process your personal data, we will notify you by email at least 30 days before the changes take effect.

Contact

If you have questions about this privacy policy, contact us at support@notchcode.dev.

Postal address: NotchCode, Tel Aviv, Israel.