Privacy

What mango sends. All of it.

mango has no telemetry, no analytics, no crash reporter. The only network traffic the app itself makes is the license check described below and the sponsor list. Everything else on the wire is yours: your shells, your agents, your browser pane. This page is kept in step with PRIVACY.md in the repo and with the list shown in Settings → License.

1. To the mango license server

Only when you activate, when the app re-validates (at most once every 7 days, in the background, never blocking the UI), and when you deactivate a device. The server is license.mango-cli.com, a Cloudflare Worker; its data lives in a Supabase Postgres database.

• License key on activate (the server hashes it on arrival with SHA-256 and stores only the hash). On re-validate and deactivate the app sends the hash, never the key.
• Email on activate only, to check it matches the purchase. Stored, lowercased, so you can log in to your account page.
• Device fingerprint: sha256("mango-fp-v1|" + IOPlatformUUID). A 64-character hash; the hardware id itself never leaves your Mac and cannot be recovered from the hash.
• Device name, a label you can edit before activating (default: your Mac's name), so you can tell devices apart on the account page.
• App version, e.g. 0.3.2.
• IP address, inherent to any HTTP request. Used only for rate limiting (20 requests per minute) and kept no longer than 10 minutes in a counter. It is not written to the database.

Never sent: terminal contents, commands, file or folder names, workspace names, bookmarks, git branches, process names, agent conversations, anything from the browser pane.

2. To the mango website

The Free edition fetches the sponsor list, GET license.mango-cli.com/v1/sponsors, a small signed JSON with sponsor titles, text and links. The request carries no identifier, no key hash, no fingerprint: it is the same for everyone. Sponsor tiles are static text; they load no images from third parties and run no scripts. Premium does not fetch it.

3. To ad networks

None. mango shows house ads (for mango itself) and sponsor tiles that we sell directly. There is no ad-network SDK, no tracking pixel, no third-party script in the app. If that ever changes, this section will name the network and link its policy before the build ships.

4. When you buy

Checkout runs on Lemon Squeezy, the merchant of record. They collect what a payment needs (email, payment method, billing country for tax) under their privacy policy. They send us a webhook with your email, name and order id; that is all we receive from them. We never see card numbers.

5. What we store, and for how long

• Users: email, optional name, created date.
• Licenses: key hash, plan, status (active / revoked / refunded), expiry if any, the order id from checkout, revocation reason.
• Activations: fingerprint hash, device name, app version, first and last validation time, deactivation time. Rows for deactivated devices are purged 30 days after deactivation.
• Audit log: who did what to a license (activation, validation, revoke, admin actions). Contains ids and emails, never terminal data.

License records are kept while the license is valid plus the 14-day refund window. Refunded licenses are kept 90 days for chargeback evidence, then deleted.

6. Your controls

• Account page: magic link to your purchase email → see your licenses and devices, deactivate a device, request a new key.
• In the app: Settings → License shows exactly this list, the time of the last check, and a "Deactivate this Mac" button. Removing the license file (~/.local/state/mango/license.json) drops the app to Free without talking to the server.
• Deletion: email privacy@mango-cli.com from your purchase address. Users, licenses and activations are deleted within 14 days; the audit rows naming you are deleted with them. A deleted license cannot be re-activated.

7. Security of the system

• Signed license file (Ed25519). The private key lives only in the server's secret store; the public key ships in the app.
• Admin access requires a password plus a TOTP code; every admin action is logged.
• Database row-level security denies all client access except a signed-in customer reading their own rows.
• The app binary is signed and notarized; a modified binary is refused by Gatekeeper.

8. Changes

This page changes only together with the app's behaviour, in the same release. The repo history of PRIVACY.md is the changelog. Last updated 2026-11-08 for mango 0.3.x.