Privacy Policy
Super Shortcuts is local-first and anonymous by default. This page explains what leaves your Mac, what doesn't, the macOS permissions the app asks for, and your rights over your data.
Last updated: June 9, 2026
Super Shortcuts is made by Cmon Labs Inc. ("we", "us"). For privacy purposes we are the data controller for the personal data described here. Our contact details are at the bottom of this page.
The macOS app
Your workflows and your voice stay on your Mac. The app needs no account and stores no email to use. Your commands aren't uploaded to us — there's no black box and no cloud sync of your workflows. Voice is transcribed on-device with a local Whisper model; audio is never persisted and never sent anywhere. (The voice models themselves are downloaded on demand from Hugging Face the first time you turn voice on.)
Workflows, settings, and usage history live in a local database on your Mac. Regardless of any setting below, these things never leave your machine as part of any report or event:
- Voice transcripts or any recognized speech
- Workflow names, descriptions, or contents
- What you type, the URLs you open, file paths, or scripts you run
- Foreground app names, window titles, or browser page contents
- Clipboard contents
- Your name, email, or any hardware serial number
App analytics & diagnostics
To improve the app we use two small, separate channels — plus local logs that never leave your Mac. You can change both choices anytime in Settings → General → Privacy & Telemetry.
Product analytics
If you turn this on, the app sends anonymous, aggregate usage to PostHog (EU) so we can see which features get used — keyed to a random per-install ID, never your name, email, or content.
Crash & diagnostics
To find and fix crashes, the app sends crash reports to Sentry (EU), scrubbed of personal data and your content. This includes simple yes/no flags for whether a feature has the macOS permissions it needs — so we can see how many installs can't function — never your activity.
Local logs
Ordinary diagnostic logs stay on your Mac. We never auto-upload them; you can export a log bundle yourself if you need support.
macOS permissions
Super Shortcuts is a non-sandboxed, notarized app. To drive your other apps it asks for the standard macOS automation permissions, and explains each one before you grant it:
- Accessibility — lets the app send keystrokes and read the on-screen UI state it needs to run a command in the app you're in.
- Automation (Apple Events) — for workflows scoped to a website, the app reads the URL of your frontmost browser tab so a command (e.g. one meant for github.com) only fires on matching pages. It does not read page contents.
- Microphone — only if you use voice commands; audio is transcribed on-device and discarded.
You can revoke any of these anytime in System Settings → Privacy & Security.
Super Shortcuts Pro & licensing
If you buy Pro, checkout and payment are handled by Lemon Squeezy, our Merchant of Record — they collect your name, email, and billing details on their own checkout page. We never see or store your card number.
To activate your license on a Mac (up to 3 devices), the app contacts our licensing API and sends a one-way hash of a hardware identifier (the "machine ID"), a friendly device model such as "MacBook Pro", and the app version. We deliberately do not send your Mac's name (which is often a person's name), serial number, or raw hardware UUID. Your license key is verified and stored only as a hash — never in the clear — and the signed license token on your Mac contains no personal data, so Pro keeps working offline.
Feedback you send
If you use the in-app feedback form, we receive your message and, only if you choose to add them, your email address (so we can reply) and an opt-in diagnostics summary. We use this solely to answer you and improve the product.
This website
The waitlist form stores the email you submit (via our API and our email provider) so we can notify you when a seat is ready. We don't sell or rent it, and you can unsubscribe or ask us to remove it at any time. We use a bot-protection check to keep spam off the form; it briefly processes your IP for that purpose.
We measure aggregate website usage with privacy-respecting analytics (PostHog and Google Analytics) configured to run cookieless — no tracking cookies are set, advertising storage is disabled, and we don't build advertising profiles. That's why you won't see a cookie banner. We record anonymous, aggregate events like page scroll depth and which links get clicked, never anything that identifies you.
Who processes your data
We keep the list of third parties ("sub-processors") small, and only use ones that handle data on our behalf under contract:
| Service | What it does | What it may receive |
|---|---|---|
| Lemon Squeezy | Payments and license issuance for Super Shortcuts Pro (Merchant of Record). | Your name, email, and billing details — entered on their checkout, not by us. We never see your card number. |
| PostHog (EU Cloud) | Product analytics for the app and website. | Anonymous, bucketed usage events. No account, no content. App analytics are opt-in. |
| Google Analytics | Aggregate website traffic measurement. | Anonymous, cookieless website usage. No advertising profiles or cross-site tracking. |
| Sentry (EU region) | Crash and diagnostics reporting for the macOS app. | Crash traces and a PII-scrubbed health posture. Opt-out (on by default). |
This list is current as of June 9, 2026, and we'll update it as our providers change. Two US-based providers also work behind the scenes: a cloud hosting and security service that runs our website and app, and an email service that sends waitlist and support messages.
Data location & how long we keep it
- App analytics are stored in PostHog's EU region and retained for up to 3 years to support long-horizon retention analysis, then discarded. IP addresses are minimized/not stored.
- Waitlist, licensing, and feedback data are stored in our database and kept while they're needed for that purpose (to notify you, validate your license, or follow up). We delete them on request.
- On your Mac, the app keeps detailed usage for 90 days plus lifetime aggregates, fully under your control. Uninstalling removes it.
Your rights
Depending on where you live, you have rights over your personal data. We honor these regardless of location.
If you're in the EU/EEA or UK (GDPR): you can request access to, correction of, deletion of, or a copy of your data; you can object to or restrict certain processing; and you can withdraw consent at any time (for product analytics, just toggle it off — that doesn't affect anything already lawfully processed). Our legal bases are your consent (analytics), our legitimate interest in a stable, secure product (crash diagnostics, anti-abuse), and performing our contract with you (licensing).
If you're in California (CCPA/CPRA): you have the right to know what we collect, to delete it, to correct it, and to opt out of "sale" or "sharing." We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
You can act on most of this yourself at any time: turn analytics on or off and disable crash diagnostics in the app's settings, unsubscribe from emails, or remove a device from your license. For anything else — access, deletion, or a copy of your data — email privacy@super-shortcuts.com and we'll take care of it. You also have the right to complain to your local data protection authority.
Children
Super Shortcuts is a tool for professionals and isn't directed at children. We don't knowingly collect data from anyone under 16.
Changes to this policy
If we change how we handle data, we'll update this page and its "last updated" date, and disclose material changes in the app before they take effect.
Contact
Questions about privacy or permissions, or want to exercise a right above? Email privacy@super-shortcuts.com.
Cmon Labs Inc.122 Avento
Irvine, CA 92602
United States