Privacy Policy

1. Who we are

iSweepy is the data controller for the personal data described in this policy. For any privacy question, data request, or complaint, you can reach us at login@isweepy.com. We aim to respond to every request within 30 days.

2. What we collect — the complete list

We deliberately keep this list short. The only personal data we process is:

• Your email address — used as your account identifier and to send one-time login codes and purchase receipts.
• Hashed one-time login codes — stored briefly while a login is in progress, then expired. We never store passwords, because there are none.
• License records — your plan tier, license status, purchase and expiry dates, needed to activate Pro features.
• Device activation entries — an anonymous identifier per activated Mac, used only to enforce the 2-Mac limit. It cannot be traced back to your files or activity.
• Free-tier usage counters — monthly counts (e.g. Smart Care runs) used to apply Free plan limits fairly.
• Support correspondence — if you email us, we keep the conversation to help you.

3. What we never collect

Just as important is what does not exist on our servers:

• No file names, file paths, or file contents — ever.
• No scan results. What iSweepy finds on your Mac stays on your Mac.
• No passwords — accounts are email-only with one-time codes.
• No payment card numbers — payments are handled entirely by Paddle.
• No advertising identifiers, no ad networks, no data brokers.
• No behavioral tracking or profiling of any kind.

4. Scanning happens on your device

All file scanning, hashing, duplicate detection, image comparison, and malware signature matching run locally on your Mac using its own processor. iSweepy does not upload files for analysis, does not use cloud scanning, and works even with intermittent connectivity. The app only contacts our servers for account sign-in, license verification, and usage-limit synchronization.

5. Payments and Paddle

All purchases are processed by Paddle.com, which acts as Merchant of Record. When you buy a plan, your payment details (card number, billing address, tax information) are collected and processed directly by Paddle under its own privacy policy — we never see or store them. Paddle shares with us only what we need to activate your license: your email, the product purchased, and the transaction status.

6. Transactional email

We send only transactional email: one-time login codes, purchase confirmations, and important account or license notices. We do not send marketing newsletters, and we never share your email address with advertisers. Emails are delivered through a transactional email provider that processes your address solely to deliver the message.

7. Legal bases (GDPR & KVKK)

Where the EU General Data Protection Regulation (GDPR) or the Turkish Personal Data Protection Law No. 6698 (KVKK) applies, we process your data on these bases:

• Performance of a contract — account creation, license activation, and delivering the features you paid for.
• Legitimate interest — preventing license abuse (the 2-Mac limit, fair Free-tier limits) and keeping the service secure.
• Legal obligation — retaining purchase records where tax or accounting law requires it.

8. How long we keep data

Login codes expire within minutes and are then unusable. Your account data (email, license records, device activations, usage counters) is kept while your account exists. If you ask us to delete your account, we remove your personal data within 30 days, except purchase records we are legally required to retain for tax and accounting purposes, which are kept only as long as those laws require.

9. Who we share data with

We never sell personal data. We share it only with the minimum set of service providers needed to run iSweepy:

• Paddle — payment processing, as Merchant of Record.
• Our hosting provider — servers located in the European Union, where account and license data is stored.
• A transactional email provider — solely to deliver login codes and receipts.
• Authorities — only if legally compelled by a valid order, and only the minimum required.

10. International transfers

Account and license data is stored on servers in the European Union. Where a service provider processes data outside your country, we rely on recognized safeguards such as the EU Standard Contractual Clauses and the provider's own compliance certifications.

11. Your rights

Under GDPR and KVKK Article 11, you have the right to:

• Learn whether your data is processed, and request a copy of it (access & portability).
• Request correction of inaccurate data.
• Request deletion of your data ('right to be forgotten').
• Object to or restrict specific processing.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your supervisory authority (in Türkiye, the KVKK Board; in the EU, your local DPA).

12. Security

All connections between the app, the website, and our servers use TLS encryption. Login codes are stored only as cryptographic hashes. Pro licenses are Ed25519-signed files verified on your device, which means license checks don't require continuously transmitting data. Access to production systems is restricted and logged.

13. Cookies on isweepy.com

The isweepy.com website does not use advertising or third-party analytics cookies. Language preference is expressed in the URL (isweepy.com vs isweepy.com/tr), so no tracking cookie is needed for it.

14. Children

iSweepy is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

15. Changes to this policy

If we make material changes to this policy, we will update the date at the top and, for significant changes affecting your rights, notify you by email before they take effect.

16. Contact

For any privacy question, data access request, or deletion request, email login@isweepy.com. Please write from the email address associated with your account so we can verify the request.