Privacy Policy

Last updated: June 30, 2026

1. Data Controller

The data controller for personal data collected through this website and in connection with the Bosun software is Bosun (support@bosun.dev). For any questions regarding the processing of your data, please contact us at this address.

2. The Bosun Application Collects No Personal Data

Bosun operates entirely on your local Mac. The application reads operating system information — active network ports, process names and PIDs, Docker container images, Compose projects, active SSH -L port forwards, public tunnel URLs from ngrok and Cloudflare, and native macOS VPN status — solely for the purpose of displaying it to you in real time.

None of this information is transmitted to our servers or any third party at any time. Bosun contains no usage telemetry, does not log feature events, does not send automatic crash reports, and makes no network calls except those described in sections 3 and 4 of this policy.

3. License Activation and Trial Verification

License activation and validation (Lemon Squeezy):

Data processed: your license key and a device name (e.g. "Ben's MacBook Pro") that identifies the activation.

Purpose: to validate that your license key is genuine and to verify that your plan's device limit has not been exceeded.

Legal basis (GDPR Art. 6.1.b): performance of the license contract.

Sub-processor: Lemon Squeezy (United States) — the same payment processor described in Section 5. See Lemon Squeezy's privacy policy for full details.

International transfer: as described in Section 5.

Free trial abuse prevention (our own server):

Data processed: a one-way cryptographic hash (SHA-256) of a hardware identifier generated on your Mac. This hash is a pseudonymous identifier — we treat it as personal data, not as anonymous data, even though it cannot be reversed to reveal the original identifier.

Purpose: to prevent the same Mac from restarting its free trial period after clearing local application data.

Legal basis (GDPR Art. 6.1.f): legitimate interest (fraud and abuse prevention).

Recipient: Bosun's own server infrastructure (Cloudflare Workers) — this data is not shared with any third party and no other information is attached to the hash.

Retention: indefinitely, as the record only has value as a permanent registry.

4. Update Checks (Sparkle)

Data processed: installed macOS version, installed Bosun version, IP address of the request (processed by the web server; not stored by us).

Purpose: to detect whether a new version of the software is available at bosun.dev/appcast.xml.

Legal basis (GDPR Art. 6.1.f): legitimate interest in keeping the software up to date and secure.

Frequency: checks occur periodically per Sparkle's configuration. You may disable automatic update checks in Bosun's settings.

5. Payment Processing and License Delivery (Lemon Squeezy)

Data processed by Lemon Squeezy: name, email address, payment details (credit/debit card), billing address, and tax information required by the applicable jurisdiction.

Data we receive: only your email address, which we use solely to deliver your license key.

Purpose: to process payment and deliver the license.

Legal basis (GDPR Art. 6.1.b): performance of the purchase contract.

Sub-processor: Lemon Squeezy acts as merchant of record and data sub-processor. See Lemon Squeezy's privacy policy for full details on how your payment data is handled.

International transfer: Lemon Squeezy operates in the United States and is subject to its own international transfer safeguards.

6. Contact Form (Resend)

Data processed: first name, last name, email address, phone number (optional), and message content.

Purpose: to respond to support inquiries, Enterprise license requests, and other communications.

Legal basis (GDPR Art. 6.1.f): legitimate interest in responding to user communications; or Art. 6.1.a (consent) for EU users who voluntarily submit the form.

Sub-processor: Resend (transactional email delivery service, United States). Messages are routed through Resend's servers and delivered to our inbox.

Subsequent use: contact form data is used exclusively to respond to your inquiry. It is not used for marketing and is not shared with third parties.

International transfer: Resend operates in the United States. The transfer is based on standard contractual clauses or applicable contractual safeguards.

7. Website Analytics (Google Analytics 4 and Meta Pixel)

Data processed: browsing data (pages visited, session duration, traffic source, device type, anonymized IP address), cookie identifiers, and custom events (download click, pricing CTA click, contact form submission).

Purpose: to understand user behavior on the website and to measure the effectiveness of advertising campaigns (retargeting on Facebook/Instagram via Meta Pixel).

Legal basis (GDPR Art. 6.1.a): explicit consent provided via the cookie banner. These scripts are not loaded if you decline consent.

Sub-processors: Google LLC (Google Analytics 4, United States) and Meta Platforms Ireland Ltd. / Meta Platforms Inc. (Meta Pixel, Ireland/United States).

International transfer: Google and Meta process data on servers in the United States and other jurisdictions. Both companies maintain appropriate international transfer safeguards (Standard Contractual Clauses or EU-US Data Privacy Framework).

Withdrawal of consent: you may withdraw consent at any time by clicking "Decline" in the cookie banner. Withdrawal does not affect the lawfulness of processing prior to consent.

8. Cookies and Local Storage

We set no first-party cookies. The only cookies installed in your browser are those from Google Analytics 4 and Meta Pixel, and only if you have given your consent (section 7).

Your consent preference (accepted/declined) is stored in the browser's localStorage to avoid prompting you on every visit. This value is not transmitted to any external server.

9. Automated Decision-Making and Profiling

We do not make automated decisions that produce legal or similarly significant effects on you, nor do we engage in profiling within the meaning of GDPR Art. 22.

10. Security

We apply reasonable technical and organizational measures to protect the personal data we process, including encrypted communications (HTTPS/TLS), access controls on internal systems, and the use of sub-processors who maintain equivalent security commitments. However, no system is entirely secure. In the event of a security breach affecting your personal data, we will notify you in accordance with applicable law.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — obtain confirmation of whether we process your data and receive a copy.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data when it is no longer necessary for the purposes for which it was collected.
• Objection — object to processing based on legitimate interest.
• Restriction of processing — request that we suspend processing while a dispute is resolved.
• Data portability — receive your data in a structured, commonly used format.
• Withdrawal of consent — at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at support@bosun.dev. We will respond within 30 days (extendable to 60 days for complex requests, with prior notice).

12. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA): the right to know what personal information we collect, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising these rights. We do not sell personal information. To exercise your CCPA rights, contact us at support@bosun.dev.

13. Right to Lodge a Complaint

If you believe that our processing of your personal data violates applicable law, you have the right to lodge a complaint with the data protection authority in your country of residence (e.g., ICO in the UK, CNIL in France, AEPD in Spain, or your local supervisory authority).

14. Data Retention

• License data (email address, activation records): retained while the license is active and for the period required by Lemon Squeezy to meet tax and accounting obligations (generally 7 years).
• Contact form data: retained in our inbox until manually deleted or for a maximum of 3 years from the last communication.
• Analytics data (GA4): subject to Google Analytics retention settings (default: 14 months).
• Consent preference (localStorage): until you clear your browser storage.

15. Children

Bosun is a professional tool for software developers and is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can delete it.

16. Changes to This Policy

We reserve the right to update this privacy policy. In the event of material changes, we will publish the new version on this page with an updated date and, if we hold your email address, notify you by email at least 14 days before the changes take effect. Continued use of Bosun or this website after changes take effect constitutes acceptance of the updated policy.

17. Contact

For any privacy inquiries or to exercise your rights:
support@bosun.dev
Bosun