Privacy Policy

Last updated: 29 October 2026

In short: traffic you capture stays on your Mac unless you export or share it yourself. With telemetry on (the default), we receive usage and crash diagnostics through Google Firebase to improve the app, never your proxy sessions. We do not sell personal data or use it for ads. Personal data we handle is limited to purchases, license activation and support.

This Privacy Policy explains how MinPin ("we", "us") handles information when you use the MinPin macOS application and the minpinproxy.com website. We are the data controller for the personal data described here. Questions: support@minpinproxy.com.

Definitions

• Personal data: information that identifies you or can reasonably be linked to you (for example, your email address or order ID).
• Diagnostic data: technical information about app crashes, stability, and product usage (for example, app launches and version). We design telemetry to avoid collecting the network traffic you capture. Diagnostic and usage data is not used to identify you, but it is linked to a pseudonymous installation identifier, and crash logs can occasionally include incidental details (such as a file path that contains a macOS username). We use this data only to debug, improve, and understand use of the app, not to profile users or inspect proxy sessions.
• Captured traffic: HTTP/HTTPS and related data you intercept locally with MinPin. We do not receive this unless you choose to export or send it somewhere yourself.

What we collect

1. Captured traffic: not collected by us

MinPin processes captured traffic on your Mac so you can debug it. That data stays on your machine unless you export it or use a feature that sends data to a destination you choose. We do not receive, store, or analyze your captured traffic on our servers. The built-in MCP server for AI tools listens only on your Mac and is not reachable from other devices or from us.

2. Diagnostic and usage data (telemetry)

When telemetry is enabled (the default), MinPin sends diagnostic and usage data to us through Google Firebase (Firebase Crashlytics for crash reports and Google Analytics for Firebase for usage events). Crash data is sent after a crash, usually on the next successful app launch. Usage data (such as app opens and which features you use) is sent while you use the app. You may opt out at any time (below).

Examples of telemetry data:

• app version and build number;
• macOS version, Mac model and processor type, and your language and region setting;
• app-launch and session events (no captured traffic);
• which MinPin features you open, the setup steps you complete or that fail (such as trusting the certificate or installing the helper), license activation results, and when an upgrade prompt appears and which button you choose;
• at the end of a session, rounded ranges such as how many requests were captured and how long the app was open, never the requests themselves;
• whether this copy of MinPin still carries our code signature;
• stack traces and crash logs;
• with a crash report, which MinPin features were switched on and simple counts (for example, the number of captured requests, SSL-decoded hosts or breakpoints, but never their contents or hostnames), the proxy port, and whether the copy is free or PRO;
• a pseudonymous installation identifier used only to group related events and crash reports;
• an approximate location (country or region) that Google derives from the IP address of the connection.

Not included by design: captured requests or responses, hostnames, decrypted bodies, session cookies or headers from your proxy work, license keys, or your CA private key.

Opt out: turn off Send anonymous usage & crash data in Settings → General, or email support@minpinproxy.com.

Retention: telemetry is kept only as long as needed to investigate issues, understand product usage, and improve the app, then deleted or aggregated. We do not retain raw crash reports indefinitely.

3. Other app connections

Apart from telemetry (when enabled) and forwarding the traffic you proxy to its destination, the app connects to the internet only to:

• check for updates about once a day from our website (minpinproxy.com), and download updates you install from our download server (download.minpinproxy.com);
• check a signed minimum-version file on our website when MinPin starts;
• activate a PRO license on your Mac and check it in with our license server when MinPin starts and about once a day while it runs (see "License activation" below);
• perform optional actions you start, such as publishing a HAR export to GitHub Gist with your own GitHub token, or, after you give consent in Security Mode, downloading public threat intelligence lists from abuse.ch (a download only: nothing about your traffic is sent).

4. Personal data: purchases, licenses and support

• Purchase data: if you buy PRO, Paddle, our payment processor and merchant of record, processes payment and shares your email address, order and subscription identifiers, and for a Commercial purchase the business name entered at checkout, with us so we can issue and email your license. We do not receive full payment-card numbers. We keep a log of each license we issue, renew, replace or revoke (license ID, purchase email, plan, expiry, and for Commercial licenses the business name and seat count) so we can re-send keys and resolve problems.
• License activation: when you activate PRO, the app sends our license server your license key, a one-way SHA-256 hash of your Mac's hardware identifier combined with a fixed prefix (never the identifier itself), and your Mac's name as set in System Settings; for a Commercial license, also the name or work email you enter to take a seat. Later check-ins send only the license key and the hash. We store the hash, Mac name and seat holder with the activation date and last check-in time, to enforce the number of Macs or seats purchased and so the license owner can see and remove Macs and people on their management page. Our license server uses the IP address of each request to limit abuse; those rate-limit counters expire within two hours. A full refund or a chargeback revokes the license.
• Support: your email address and message contents when you email us. If you use the contact form on our support page, it sends your email address, your name (optional), the topic you choose, your message and your MinPin version (optional) to our server, which emails them to our support inbox. The form is not stored in a database; the server uses your IP address only for a rate-limit counter that expires within two hours. The form is protected by Cloudflare Turnstile, which processes your IP address and information about your browser and device to tell people from automated bots.
• Email updates (optional): if you sign up for tips and release notes on our website, we store your email address, where you signed up, and when you signed up, confirmed or unsubscribed. We email you once to confirm; nothing else is sent until you click the confirmation link. Every email has an unsubscribe link that works with one click. The sign-up form uses the same Turnstile check and rate limit as the contact form.

5. Website

Our website is hosted on Cloudflare and does not use advertising trackers. On the pricing page, Paddle's checkout may set cookies required to complete a purchase; on the support page, Cloudflare Turnstile runs a human check for the contact form. Our hosting provider processes standard request data (IP address, browser type, pages viewed) when you visit the site, used only for security and operation, not for profiling.

6. Website analytics

We use Google Analytics 4 to understand how the website is used: which pages people visit, how they arrived (the referring site), roughly where they are (country and city, derived by Google from the IP address, which Google Analytics does not store), their device and browser, how far they scroll, and actions such as clicking Download, opening and completing checkout, or sending the contact form. Google Analytics sets first-party cookies (_ga and _ga_*) to recognise a returning browser. We turn off Google signals, advertising features and ad personalisation, and we don't send your name, email or license details to Google.

If you are in the EEA, the UK or Switzerland, analytics cookies stay off until you choose Accept in the banner; if you decline, Google receives only cookieless, anonymous pings it uses for aggregate modelling. Elsewhere analytics is on by default. You can change your choice at any time: analytics settings. Browser settings and content blockers also stop it.

Downloads from download.minpinproxy.com are counted on our own server: we record the time, whether it came from the website or the in-app updater, the build, the country (from Cloudflare) and the referring site's name. We do not record your IP address there.

How we use information

• deliver, activate and support licenses;
• respond to support requests and process refunds;
• diagnose crashes, understand product usage, and improve stability;
• check for and deliver app updates;
• meet tax, accounting, and legal obligations;
• protect the service against abuse, spam and fraud.

We do not sell personal data, share it for cross-context behavioral advertising, or use captured traffic for any purpose.

Legal bases (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we rely on:

• Contract: to provide the app, deliver and activate your license, and support you.
• Legitimate interests: to improve stability and understand product usage through telemetry, secure our services (including the contact-form human check and rate limits), and prevent fraud. You may object to telemetry by opting out; that does not affect other processing necessary to provide the app.
• Legal obligation: for tax, invoicing, and record-keeping.
• Consent: for website analytics cookies, and where else required (for example, the optional email updates above). We never send marketing email without your consent, and you can withdraw it at any time with the unsubscribe link. Counting downloads on our own server relies on legitimate interests.

Service providers

We use these service providers:

• Paddle (Paddle.com Market Ltd): checkout, payment, invoicing and tax as merchant of record. Paddle is the seller of record and also processes your purchase data under its own privacy policy.
• Cloudflare: website hosting, app downloads and updates, our license and contact-form server and its database and logs, and Turnstile human checks.
• Resend: delivery of license emails, contact-form messages and email updates.
• Google (Firebase): crash reporting and usage analytics, when telemetry is on.
• Google (Google Analytics 4): website analytics, as described above.
• GitHub: Gist publishing, if you use it with your own GitHub account.

Except where they act as independent controllers (such as Paddle as merchant of record), these providers process data on our instructions and may not use it for their own marketing. Questions about them: support@minpinproxy.com.

International transfers

We and our service providers may process data in countries other than yours (including the United States). Where required, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms.

Retention

• License and purchase records: kept as long as needed for support, warranty, tax, and legal compliance, then deleted or anonymized.
• Activation records: kept as long as the license exists, including Macs and people that were removed, so the license owner can see recent changes and decide who may activate again. Ask us to delete them at any time.
• Support email and contact-form messages: kept as long as needed to resolve your issue and for a reasonable period afterward. Our email delivery provider keeps delivery records for a limited period.
• Email updates: kept while you are subscribed. An unconfirmed sign-up is never emailed again after the one confirmation email. After you unsubscribe we keep your address and the unsubscribe date so we don't email you by mistake. Ask us and we will delete your address entirely, whether or not you confirmed.
• Rate-limit counters: expire within two hours.
• Telemetry data: kept only as long as needed for debugging and product analytics, typically months not years, then deleted or aggregated.
• Website analytics: Google Analytics keeps event data for 14 months; the cookies expire after up to two years unless you clear them.
• Download counts: kept for product statistics; they contain no IP address.
• Server logs: rotated on a short schedule.

Security

We use reasonable technical and organizational measures to protect personal data. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export personal data, restrict or object to certain processing, and withdraw consent where processing is consent-based.

California residents (CCPA/CPRA): we do not sell or share personal data for cross-context behavioral advertising. You may request disclosure of categories collected, deletion, and correction. We do not discriminate against you for exercising these rights.

To exercise any right, email support@minpinproxy.com. We may need to verify your identity (for example, via your purchase email). We respond within the time required by applicable law.

If you are in the EEA or UK and believe we have not addressed your concern, you may lodge a complaint with your local data-protection authority.

Children

MinPin is a professional developer tool not directed to children under 16. We do not knowingly collect personal data from children. Contact us if you believe a child has provided personal data.

Changes

We may update this policy from time to time. Material changes will be posted here with a new "Last updated" date. Continued use after changes means you accept the updated policy, to the extent permitted by law.

Contact

Privacy requests and questions: support@minpinproxy.com.

This policy is provided for transparency and does not constitute legal advice. If you need advice for your specific situation, consult a qualified attorney.