Privacy Policy

Last updated: September 23, 2026

1. Who we are

Tinto Labs is the trade name of Jairo Alejandro Pinto Garzón, an independent software developer based in Ibagué, Colombia ("Tinto Labs", "we", "us"). We are responsible for the personal data described in this policy. You can reach us at support@tintolabs.com.

This policy covers this website (tintolabs.com) and our macOS apps: Tempo, MiniTray, Pulso and Arcadoro.

2. This website

• We don't use cookies, advertising, social media widgets or third-party tracking. Fonts and images are served from our own site.
• To know how many people visit the site, which pages they view and which site they come from, we use Cloudflare Web Analytics. It uses no cookies and stores nothing in your browser, doesn't identify you and doesn't build a profile of you: it counts visits in aggregate from the page visited, the referring site, the country, the browser and device type, and the load time.
• The site is hosted by Cloudflare, Inc., which necessarily processes technical data (such as your IP address, browser type and the pages requested) to deliver the site and protect it against attacks. We don't use this data to identify you.

3. Purchases

Our apps are sold through Lemon Squeezy (Lemon Squeezy LLC), which acts as our reseller and Merchant of Record. When you buy, Lemon Squeezy collects your name, email address, billing country and address, payment details and, if you provide one, your tax ID. It uses them to process the payment, calculate and remit taxes, issue invoices, deliver your license key, handle refunds and prevent fraud. We never see your full payment details.

We receive the order information we need to support you: your name, email address, country, the product purchased and your license key. Lemon Squeezy's own privacy policy applies to the data it processes.

4. Our apps

4.1 Your content stays on your Mac

Screenshots and annotations (Tempo), the contents of the tray (MiniTray), system measurements and process lists (Pulso) and your tasks, focus sessions, credits and scores (Arcadoro) are processed only on your Mac. We never receive them.

4.2 Free trial and license activation

When you start the free trial or activate a license, the app contacts our license server (hosted on Cloudflare) and sends:

• the name of the app;
• an anonymous identifier of your Mac: a one-way SHA-256 fingerprint derived from the Mac's hardware identifier, which cannot be turned back into the original identifier;
• when you activate a license, your license key.

Our server stores only:

• the anonymous Mac identifier and the date your trial started, for each app;
• for activations, a hash of your license key (not the key itself), linked to the anonymous Mac identifier;
• a salted hash of your IP address, used only to limit abuse (for example, repeated trials) and to rate-limit requests. Your IP address is not stored in readable form;
• the license type linked to that key hash (a single app or the bundle);
• if you release a Mac, the key hash and that Mac's anonymous identifier, so the other apps in the bundle don't take the seat again on their own;
• if an order is refunded, a hash of its order number (not the number itself), which Lemon Squeezy sends us, to withdraw the license for that order.

To validate and activate your license, our server sends your license key, together with a label made from part of the anonymous Mac identifier, to Lemon Squeezy's license service. Lemon Squeezy uses it to count your activations (up to three Macs).

Periodic checks. Once your license is activated, the app checks it again with our server about every three days, sending the same data as when you activated it; nothing new is added. Without a connection, the license keeps working for up to two weeks in a row; after that, the app asks you to go online for a moment to continue, and all your content is kept. During the free trial, the app renews it with our server about every 12 hours while it's online, sending the same data as when the trial started. Without a connection, the trial keeps working until its last day.

4.3 Update checks

Unless you turn it off in the app's settings, each app checks for new versions about once a day by downloading a small update feed from our website. This is a standard web request: like any website visit, it reveals your IP address to our hosting provider, and it includes the app version and macOS version. We don't add identifiers and we don't build profiles from these requests.

4.4 Crash reports (optional)

If an app crashes or freezes, it can send a technical report so that we can fix the problem. Reports are processed by Sentry (Functional Software, Inc.) and contain: the app and macOS versions, your Mac's model, memory information, your language and region settings, the technical trace of the error and a random installation identifier. Before a report is sent, the app strips user names, file paths and names, and email addresses from it; for an error, it only sends its type and code. We have configured Sentry not to store IP addresses or the approximate location (country and city) that could be derived from them.

You can turn crash reports off at any time in the Privacy section of each app's settings.

4.5 macOS permissions

Some apps ask for macOS permissions to work: Tempo asks for Screen Recording, to capture your screen, and MiniTray asks for Input Monitoring, to notice the shake gesture while you drag files (it never reads your keyboard). What these permissions give access to is processed on your Mac and is never sent to us.

4.6 Network latency check (Pulso)

To show how responsive your connection is, Pulso opens a brief connection to 1.1.1.1, a public address run by Cloudflare, about every 20 seconds while it's running, and measures how long it takes to open. It sends no data: no measurements, process names or identifiers. Like any connection, it lets Cloudflare see your IP address. You can turn it off in Pulso's settings, under General.

5. Support emails

When you write to us, we use your email address and message to reply and help you. If you write from an app's help link, the email already includes the app's name and version, the license status, the last error code and a 12-character reference of your Mac's anonymous identifier, so we can help without asking for more details; it never includes your license key, and you can delete anything before sending it. Our email is provided by Zoho Mail (Zoho Corporation): messages sent to support@tintolabs.com are received and stored there. We keep support conversations as long as needed to help you and to keep a record of your requests, and we delete them on request.

6. Why we process your data (legal bases)

• To provide what you asked for (contract): selling you a license, starting your trial, activating and validating your license, answering your emails.
• Our legitimate interests: preventing abuse of the trial and the license system, keeping our services secure, measuring site visits in aggregate, checking for updates and diagnosing crashes. You can object at any time; crash reports and automatic update checks can be switched off in the apps.
• Legal obligations: keeping purchase records for tax and accounting purposes (done by Lemon Squeezy as Merchant of Record).

We process personal data in accordance with Colombian Law 1581 of 2012 and its regulations on the protection of personal data (habeas data), and, where applicable, the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws.

7. Who receives data

We share data only with the service providers needed to run our business, and only for the purposes above:

• Lemon Squeezy — payments, taxes, invoices, license keys and refunds.
• Cloudflare — website hosting, cookie-free visit analytics, the license server and the address Pulso uses to measure latency.
• Sentry — crash reports.
• Zoho — our email.

We do not sell or rent personal data, and we don't share it for advertising.

8. International transfers

These providers may process data in the United States and other countries. They protect it with appropriate safeguards, such as the European Commission's standard contractual clauses.

9. How long we keep data

• Trial and activation records: while we sell the app, so that trials can't be restarted and your activations keep working. We delete them on request (you'd lose your trial status or the activation on that Mac).
• Crash reports: up to 90 days.
• Support emails: as long as needed to help you, and deleted on request.
• Purchase records: kept by Lemon Squeezy for the period required by tax law.

10. Your rights

You can ask us to access, correct, update or delete your personal data, to restrict or object to its processing, to receive a copy of it, or to withdraw a consent you gave. In Colombia, these are your habeas data rights. To exercise them, email us at support@tintolabs.com. We'll answer queries within 10 business days and requests or complaints within 15 business days, as required by Colombian law.

If you believe we haven't respected your rights, you can complain to Colombia's Superintendencia de Industria y Comercio or to the data protection authority of your country.

11. Children

Our apps and website are not directed to children under 13 (under 16 in the European Economic Area), and we don't knowingly collect their personal data.

12. Security

All connections use encryption (HTTPS). We store identifiers and license keys as one-way hashes where possible, and we collect as little as we can.

13. Changes to this policy

If we change this policy, we'll publish the new version here with a new date. If the changes are significant, we'll say so clearly on this website.

14. Contact

Tinto Labs — Jairo Alejandro Pinto Garzón, Ibagué, Tolima, Colombia. Email: support@tintolabs.com.

This policy is available in English and Spanish; if there is any discrepancy, the English version prevails.