In short
- What Aegisrook finds on your Mac stays on your Mac. We never receive it.
- No account. Your licence is checked on your Mac, not on our server.
- This website counts visits with our own counter and with Google Analytics. Where the law asks for consent first, it waits until you agree.
- No advertising trackers, and we never sell or share data for advertising.
Who we are
Aegisrook ("we", "us") is based in Singapore. We decide how the personal data described here is used. For anything about privacy, including reaching our data protection officer, email hi@aegisrook.com.
The app
What stays on your Mac
Alerts, history, your decisions, your settings and your licence key are stored only on your Mac. We never receive them. You choose how long history is kept, from 1 day to 1 month.
What the app contacts, and why
Aegisrook contacts these services, and no others. Most are contacted only when you turn on the feature that needs them.
| Service | Why | What it receives |
|---|---|---|
| Update server (aegisrook.com) | Checks for new versions | The usual request for a file, including your IP address |
| Public threat-list providers (abuse.ch, a criminal-network list, and lists hosted on GitHub or jsDelivr) | Downloads lists of known bad sites and servers | A download request. Your activity isn't sent |
| db-ip.com | Downloads a country database, about once a month | A download request |
| rdap.org, and DNS | Looks up a domain's registration date when you check a website | The domain you are checking |
| The website you check | Reads its certificate, redirects and status when you ask it to | One request and a ping, only if you turn that option on |
| VirusTotal | Looks up files and websites | A file's fingerprint or a domain, and only if you add your own key |
| Cloudflare or Quad9 | Encrypted DNS | Your DNS lookups, and only if you turn encrypted DNS on |
| ntfy.sh | Sends alerts to your phone | The alert text, and only if you turn phone alerts on |
Reports you send us
Report a False Alarm and Save Diagnostics create files on your Mac. Nothing is sent until you choose to send it. Reports leave out the websites and servers your apps connected to, and secrets such as your VirusTotal key are removed.
This website
aegisrook.com counts visits so we can tell which pages help people. It uses two counters: our own, which runs on our server and uses no cookies, and Google Analytics, which sets cookies. There's no advertising, and visit data isn't sold.
Google Analytics
Google Analytics records the pages you open, how you arrived and your approximate location, using cookies that start with _ga. Google receives your IP address to do this; Google Analytics 4 doesn't store it. Google's use of this data is covered by Google's privacy policy. Google Analytics only loads under the same choices as our own counter below: declining, or a Global Privacy Control signal, means it never loads.
What our own counter records
- The pages you open, the site that sent you here, and any campaign tags in the link (such as
utm_source). - Clicks on Buy, Download and our email address, and how long a page was open.
- Your approximate location (country and city, worked out from your network), device type, browser, operating system, screen size and language.
How visits are told apart
Each visitor gets a code made from the IP address and browser, mixed with a secret that changes every day. The IP address itself is never stored, and the code can't be turned back into it or linked across days. If you allow counting, your browser also keeps a random number (in its local storage), so a purchase or message can be linked to the visits before it.
When you're asked
- In the EU, the UK and Switzerland: nothing is counted until you choose Accept.
- Elsewhere: visits are counted, with this policy as notice, unless you choose No thanks.
- Everywhere: if your browser sends a Global Privacy Control signal, nothing is counted.
If you decline, nothing is counted at all. You can change your choice at any time with Privacy choices, also at the bottom of every page.
Server logs
Like every website, the servers that deliver these pages keep basic request logs (IP address, page and time) to keep the site running and secure.
When you buy
Purchases are handled by Paddle, our payment provider and merchant of record. Paddle collects your payment details; we never see your card number. Paddle shares your name, email address, country and order details with us so we can send your licence key, answer questions about your order, and handle refunds. Paddle's own privacy policy covers what Paddle does with your data.
When you write to us
Messages from the contact form go to our own server, which saves them and emails them to our inbox. If you allowed visit counting, the message is linked to your earlier visits, so we can see which pages you read. We keep your messages and our replies so we can help you and see the history if you write again. We don't add you to a mailing list.
Who helps us
These companies process data for us, only to provide their service, under their data protection terms. Some are outside your country, including outside the EU and UK; where the law requires it, transfers rely on safeguards such as standard contractual clauses.
| Company | What for |
|---|---|
| Paddle | Taking payments, sales tax, refunds |
| Cloudflare | Our licence server, the visit database and the contact form |
| Maileroo | Sending licence keys and delivering contact-form messages to us |
| Our web host | Delivering the pages of aegisrook.com |
Why we may use it
If you're in the EU or the UK, the law asks us to say on what basis we use your data:
- Consent for counting your visits, which you can withdraw at any time.
- Contract for selling you a licence and sending your key.
- Legitimate interests for answering your messages and keeping our servers secure.
- Legal obligation for keeping order records for tax.
In Singapore, we collect and use personal data under the Personal Data Protection Act, for the purposes in this policy.
How long we keep it
- Visit counts: deleted automatically after 13 months.
- Orders: as long as tax law requires (in Singapore, five years).
- Messages: as long as they help us support you. We delete them on request.
Your rights
You can ask to see the personal data we hold about you, have it corrected or deleted, get a copy of it, or object to how we use it. You can withdraw consent to visit counting at any time with Privacy choices. Email hi@aegisrook.com and we'll reply within 30 days.
If you're unhappy with our answer, you can complain to Singapore's Personal Data Protection Commission, or to the data protection authority where you live.
Aegisrook isn't directed at children, and we don't knowingly collect data from anyone under 16.
Changes to this policy
If the app starts contacting something new, or this website starts counting something new, we'll update this page first. The date at the top shows when it last changed.