Privacy Policy

• You sign in to the app with your email address. We send a one-time code to it through Resend, our email provider.
• We store your email address, when you joined and last signed in, and whether you asked for product updates. Each sign-in gets a session, stored as a hash along with the app and macOS version it came from.
• Sign-in codes are stored only as hashes, with the network address that asked for them, and are deleted within a few days after they expire.
• We email your license key to this address when you buy fr0stbyte Pro. If you asked for product updates, we may also send you news about fr0stbyte. Write to us to stop it.

• Signing in with an Apple ID is optional. You need it to download apps from the App Store.
• When you sign in with your Apple ID for App Store downloads, our server keeps an encrypted session and an encrypted copy of your Apple ID password, so downloads keep working without asking you to sign in again. Both are deleted when you sign out of your Apple ID in fr0stbyte or sign out of fr0stbyte. We never log your password or use it for anything else, and two-factor codes are never stored.
• If you delete the app without signing out, both stay on our server until you ask us at support@fr0stbyte.app to remove them.
• With the session we also keep your Apple ID email address and its App Store country.
• We log each download you ask for (your fr0stbyte account, the app, version, result and size) for 180 days.
• When you download a version of an app from Apple through fr0stbyte, our server also saves that version's app file in our file storage and serves it to other fr0stbyte users who download the same version. The saved file holds no Apple ID and no license data. If Apple refuses a version you ask for, we may record the request and fetch that version ourselves.
• App files reach your Mac either straight from Apple or from our file storage.

• Paddle sells fr0stbyte as our Merchant of Record. Paddle collects your payment and billing details under its own privacy policy. Your full card number never reaches us, and we don't store card details.
• From Paddle we receive the order: its transaction ID, what you bought, the amount, currency and discount, and Paddle's ID for you as a customer.
• The checkout carries a random reference made by the app, so the purchase reaches your Mac. It contains no personal details.
• Credits are kept with your fr0stbyte account: your balance and its history, meaning each purchase, refund and download (the app, its version and its size).
• The free trial is recorded with your account too: which IPA it used (a fingerprint of the file, never the file) and which App Store app it downloaded.
• For fr0stbyte Pro we create a license key and store it encrypted. To count the Macs a license is active on, the app sends a salted hash of the Mac's hardware ID, never the ID itself. We record when each Mac activated and last checked in.

When you use an AI-powered feature, our server sends the text it needs to an AI provider and returns the answer.

• Ask AI: a summary of the app's file list (names, sizes, categories and counts), the frameworks it bundles, its public App Store details, your questions and the results of the lookups it runs to answer them. Never the files themselves, Info.plist values, strings or entitlements.
• Rebuild as SwiftUI: the structure of the one interface file you choose, including its text and image names.
• Crash summaries: the crash report you choose to summarize.
• PDF report text: public App Store details and counts from the app, such as sizes and framework names.
• Review summaries and insights: public App Store reviews.

• App Store searches and app lookups go through our server, which asks Apple. So do the reviews, screenshots, release notes and charts you look at, which our server collects from the App Store.
• To keep its references current, fr0stbyte reports identifiers it does not recognize in an app you inspect: framework bundle IDs, Info.plist key names (never their values) and SKAdNetwork IDs, with the app's App Store ID. We do not store them with your account, and we may look them up with our AI provider.
• To show whether a framework an app uses has newer releases, the app may contact GitHub (api.github.com), Bitbucket (api.bitbucket.org) and the npm and pub.dev package registries directly, sending the framework's repository or package name. Those services see your network address.

The Mac app uses Google Firebase, so this data goes to Google.

• Crash reports (Firebase Crashlytics): when the app crashes, a report with the crash details, the app and macOS versions, your Mac model, a trail of recent screens and events (which may include the bundle IDs of apps you inspected) and your fr0stbyte account ID.
• Usage statistics (Google Analytics for Firebase): automatic events such as first launch, sessions and app updates, with an ID for your installation of the app, device and app details, and a location derived from your network address.

• Survey: the first time you open fr0stbyte you can answer a short survey. We keep your answers, a random ID for your install, the app version and a hash of your network address, and link them to your account once you sign in.
• Sign-in statistics: the sign-in window reports which steps you reached and whether they worked, with timings and your app and macOS versions. They are linked to your account once you sign in and carry a keyed hash of your network address, never the address itself.
• Install counts: each launch reports the app version, build and update channel, counted per day with a keyed hash of your network address. Kept 90 days.
• Abuse protection: short-lived counters per network address and account limit requests. A security log records sign-in attempts with a partly hidden email address and the network address.
• Server logs: our servers keep standard request logs (network address, time, the address requested, the app or browser version) to run and protect the service.

• This website has no analytics, ads or tracking scripts. Your browser's local storage keeps your theme choice, whether you saw the intro animation, and which background icons the homepage shows this week.
• The free IPA analyzer runs in your browser. The file you drop never leaves your device.
• Opening /buy loads Paddle.js from Paddle, which receives your network address to show prices and tax for your location, even if you buy nothing. Paddle may set its own cookies under its privacy policy.

We share data only with the providers that run parts of fr0stbyte for us, and only for the purposes above.

• Paddle: payments, tax and receipts, as Merchant of Record.
• Google (Firebase Crashlytics and Analytics), USA: crash reports and usage statistics from the Mac app.
• Resend: sign-in codes and account email.
• Hostinger: our servers and this website.
• Backblaze B2: file storage and database backups.
• DeepSeek and Anthropic: the AI models behind AI-powered features.

Apple receives your Apple ID sign-in and App Store requests and handles them under its own privacy policy. We do not sell your personal data or use it for advertising.

Our servers are in Indonesia. Our providers process data in these countries:

• United States: Google, Resend, Backblaze and Anthropic.
• United Kingdom and United States: Paddle.
• China: DeepSeek.

So your data may be processed in countries whose data protection laws differ from those where you live.

• Contract: to provide what you signed up for or bought, such as your account, downloads, purchases and licenses.
• Legitimate interests: to keep the service secure, stop abuse, fix crashes and understand how fr0stbyte is used.
• Consent, where the law requires it: for example product update emails and the optional survey.

• Account data: while your account exists.
• Apple session and password: until you sign out of your Apple ID in fr0stbyte or sign out of fr0stbyte. If you deleted the app without signing out, until you ask us to remove them.
• Orders, licenses, credits, trial records and Mac activations: as long as your account, license or credits need them, or longer where the law requires.
• Logs: the download log 180 days, install counts 90 days, request counters about two days. Sign-in codes are deleted within a few days after they expire.
• Crash reports and usage statistics: kept by Google under its Firebase retention rules.
• Survey answers, sign-in statistics and the security log: until we no longer need them, or until you ask us to delete them.
• Backups: we back up the database every other day and keep the two newest copies, so deleted data can remain in a backup for up to about 4 days.

• To get a copy of your data, correct it or delete your account, email support@fr0stbyte.app from your account address.
• Sign out of your Apple ID in fr0stbyte at any time to delete your Apple session and password from our server.
• You may also complain to the data protection authority where you live.

We answer as soon as we can, and within the time the law sets.

Connections to our servers use HTTPS. Sessions are random tokens we store only as hashes. Apple sessions, Apple ID passwords and license keys are encrypted at rest.

You must be at least 18 years old, or the age of majority where you live if that is higher, to use or buy fr0stbyte. We don't knowingly collect personal data from anyone younger, and we delete it when we learn of it.

When our practices change we update this page and its date. For a change that matters, we tell you in the app or by email.

fr0stbyte by Malik Ghani is responsible for your data in fr0stbyte. Write to support@fr0stbyte.app.