Privacy Policy
Last updated: 3 August 2026
This policy explains what Deskmate does with your data. It is short because Deskmate does very little with it.
The short version
Deskmate has no servers. There is no account to create, nothing to log in to, and no backend belonging to us for your data to be sent to.
We collect no analytics, no telemetry and no usage statistics. We do not track you, we show no advertising, and we have never sold or shared anyone's data because we have never held any.
Everything Deskmate knows about you stays on your Mac, or in your own iCloud account if you switch that on.
What stays on your Mac
| Data | Where it is kept | Leaves your Mac? |
|---|---|---|
| Two-factor authentication secrets | Keychain (com.huunguyen.deskmate.authenticator) | Only if you turn on iCloud backup |
| Clipboard history | On disk, encrypted with AES-GCM under a key in your Keychain (com.huunguyen.deskmate.clipboard) | No |
| Clipboard sync key | Keychain (com.huunguyen.deskmate.clipboard.sync) | Through iCloud Keychain, and only if you turn sync on |
| VPN passwords | Keychain (com.huunguyen.deskmate.vpn) | No |
| VPN configurations, and your Cloudflare WARP device registration | Keychain (com.huunguyen.deskmate.vpn.config) | No |
| Screenshots you save | Wherever you chose to save them | No |
| Clean Up scan results | In memory only, discarded when the window closes | No |
| Settings, shortcuts, video library | Your app preferences file | No |
None of this is ever sent to us. The two rows that can leave your Mac go to your own iCloud, described below, and never anywhere else.
Your clipboard history is encrypted at rest. If you delete the Keychain item, the stored history becomes permanently unreadable, including to us.
iCloud
Deskmate can back up your authenticator accounts and VPN profiles, and sync your clipboard, through your own iCloud account using CloudKit. This is optional and under your control.
This is your iCloud, not ours. We have no access to it and no ability to read what is stored there.
Clipboard sync is off by default, because a clipboard is sensitive. When you turn it on, entries are end-to-end encrypted before they leave your Mac, under a key shared between your devices through iCloud Keychain. Apple's servers carry ciphertext only.
Silent push notifications (APNs) are used to tell your other devices that something changed. They carry no clipboard content.
When Deskmate talks to the internet
Deskmate contacts an outside service only when you use a feature that needs one. There is nothing in the background beyond the update check.
| Service | When | What leaves your Mac |
|---|---|---|
deskmate.huu.app | Checking for a new version | An ordinary request for the update feed. Sparkle's system profiling is disabled, so no information about your machine is sent. You can turn these checks off in About. |
ipinfo.io | Showing your public IP address | Your request, which necessarily reveals your IP to them |
api.cloudflareclient.com | Only if you use Cloudflare WARP | A newly generated public key, to register a device. The registration is kept in your Keychain and reused. |
cloudflare.com | Only if you use Cloudflare WARP | A connectivity check |
vpngate.net | Only if you open the public server list | Your request for the list, which reveals your IP to them |
These are run by other organisations under their own privacy policies. Where a feature depends on one, the feature will not work without it, and you can simply not use that feature.
Your VPN traffic itself never passes through anything we operate. Deskmate is a VPN client only, and connects to servers you choose.
Permissions Deskmate asks for
macOS asks your approval for each of these, and you can withdraw any of them at any time in System Settings.
- Accessibility so the window manager can move and resize other applications' windows, and so the clipboard can paste into the app in front of you.
- Screen Recording so screenshots can capture what is on screen.
- Location so the VPN can read your current Wi-Fi network name and decide whether to connect automatically. macOS requires Location permission to read a network name. Your location is not stored and never leaves your Mac.
- Full Disk Access, optional, so Clean Up can scan for large and old files in more places. Without it, that scan simply covers less.
Children
Deskmate is a utility for people managing their own computer. It is not directed at children and we do not knowingly collect anything from anyone.
Deleting your data
Deleting Deskmate removes the app. To remove what it stored:
- Move the app to the Trash
- Delete its preferences and application support files
- Remove its Keychain items (search for "deskmate" in Keychain Access)
- If you used iCloud backup, delete the Deskmate data from your iCloud storage
Because we hold nothing, there is nothing for you to ask us to delete.
Changes to this policy
We will update this policy if the app's behaviour changes. The current version is always the one in the app, under About. The date at the top says when it last changed.
Contact
Questions about privacy: privacy@huu.app
Deskmate is made by Huu Nguyen.