Privacy Policy

Overview

Origami is a macOS terminal workspace manager operated by Ricardo Bucho, trading as Origami, based in Portugal. This policy explains what data we collect, why, and how we handle it. The short version: we collect the minimum needed to run the licensing system and we don't track, profile, or sell your data.

What we collect

When you subscribe

Your email address and payment details are collected by Stripe during checkout. We receive your email address and Stripe customer and subscription identifiers. We do not receive or store your card number, CVC, or billing address — Stripe handles all payment data directly.

When you activate a device

The Origami app sends your license key, a device fingerprint (a hardware identifier unique to your Mac), your device's hostname, and the app version to our server. We store these to enforce the device limit on your license and to let you manage your devices.

When you check for updates

The app periodically checks a Cloudflare R2 endpoint for the latest version. This request includes your IP address in standard HTTP headers. We do not log these requests. Cloudflare may process them according to their own privacy policy.

When you visit the website

We do not use analytics, tracking pixels, or advertising cookies. The website sets a session cookie required for form submissions (CSRF protection). Certain forms use Cloudflare Turnstile to prevent abuse - this may process your IP address and browser signals to verify you are human. No tracking cookies are set. Your IP address appears in standard server logs, which are retained for up to 30 days for security and debugging purposes.

What we don't collect

Origami does not collect, transmit, or have access to: the contents of your terminals, your shell commands or history, your files or code, your clipboard, your AI agent conversations, or any data from the projects you work on. Everything you do in Origami stays on your Mac.

How we use your data

• + Email address — to send your license key, magic links for device management, and critical service communications (e.g., subscription changes). We do not send marketing emails.
• + Device fingerprint and hostname — to enforce the 5-device limit and let you identify and manage your devices.
• + App version — to understand which versions are in use, in case we need to communicate about critical updates or deprecations.
• + Stripe identifiers — to link your subscription to your license and process billing events (renewals, cancellations).

Third parties

• + Stripe — processes payments and manages subscriptions. Stripe receives your email and payment details at checkout. See Stripe's privacy policy.
• + Mailtrap — delivers transactional emails (license keys, magic links). Mailtrap processes your email address to deliver messages. See Mailtrap's privacy policy.
• + Cloudflare — hosts downloads, serves the update manifest, and provides bot protection (Turnstile) on website forms. Cloudflare may process IP addresses and request metadata. See Cloudflare's privacy policy.

We do not share your data with anyone else. We do not sell data. We do not use advertising networks.

Where your data is stored

Our servers are hosted in Western Europe through Cloudflare. Stripe and Mailtrap process data according to their own data residency policies, which include EU-based infrastructure. All data transmitted between the Origami app and our servers is encrypted in transit via TLS. License keys are stored encrypted at rest.

Data retention

We retain your license and device data for as long as your account is active. If you cancel your subscription, your data is kept in case you resubscribe (your existing license key and devices are preserved). If you want your data deleted, email us and we will remove your license, device records, and email from our systems within 30 days.

Your rights (GDPR)

As we operate from Portugal and serve users in the European Union, you have the right to:

• + Access the personal data we hold about you
• + Correct inaccurate data
• + Request deletion of your data
• + Export your data in a portable format
• + Object to or restrict processing of your data

To exercise any of these rights, email [email protected]. We will respond within 30 days.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the application. The "last updated" date at the top of this page reflects the most recent revision.

Contact

For privacy-related questions or requests, email [email protected].