Privacy Policy

Super Shortcuts is local-first and anonymous by default. This page explains what leaves your Mac, what doesn't, the macOS permissions the app asks for, and your rights over your data.

Last updated: August 4, 2026

Super Shortcuts is made by Cmon Labs Inc. ("we", "us"). For privacy purposes we are the data controller for the personal data described here. Our contact details are at the bottom of this page.

The macOS app

Your workflows and your voice stay on your Mac. The app needs no account and stores no email to use. Your commands aren't uploaded to us - there's no black box and no cloud sync of your workflows. Voice is transcribed on-device with a local Whisper model; audio is never persisted and never sent anywhere. (The voice models themselves are downloaded on demand from Hugging Face the first time you turn voice on.)

Workflows, settings, and usage history live in a local database on your Mac. Regardless of any setting below, these things never leave your machine as part of any report or event:

• Voice transcripts or any recognized speech
• Workflow names, descriptions, or contents
• What you type, the URLs you open, or file paths
• Foreground app names, window titles, or browser page contents
• Clipboard contents
• Your name, email, or any hardware serial number

App analytics & diagnostics

To improve the app we use two small, separate channels - plus local logs that never leave your Mac. You can change both choices anytime in Settings → General → Privacy & Telemetry.

macOS permissions

Super Shortcuts is a non-sandboxed, notarized app. To drive your other apps it asks for the standard macOS automation permissions, and explains each one before you grant it:

• Accessibility - lets the app send keystrokes and read the on-screen UI state it needs to run a command in the app you're in.
• Automation (Apple Events) - for workflows scoped to a website, the app reads the URL of your frontmost browser tab so a command (e.g. one meant for github.com) only fires on matching pages. It does not read page contents.
• Microphone - only if you use voice commands; audio is transcribed on-device and discarded.

You can revoke any of these anytime in System Settings → Privacy & Security.

Super Shortcuts Pro & licensing

If you buy Pro, checkout and payment are handled by Lemon Squeezy, our Merchant of Record - they collect your name, email, and billing details on their own checkout page. We never see or store your card number.

To activate your license on a Mac (up to 3 devices), the app contacts our licensing API and sends a one-way hash of a hardware identifier(the "machine ID"), a friendly device model such as "MacBook Pro", and the app version. We deliberately do not send your Mac's name (which is often a person's name), serial number, or raw hardware UUID. Your license key is verified and stored only as a hash - never in the clear - and the signed license token on your Mac contains no personal data, so Pro keeps working offline.

Feedback you send

If you use the in-app feedback form, we receive your message and, only if you choose to add them, your email address (so we can reply) and an opt-in diagnostics summary. We use this solely to answer you and improve the product.

This website

If you sign up for email updates, we store the address you submit (via our API and our email provider) so we can send the occasional product update. We don't sell or rent it, and you can unsubscribe or ask us to remove it at any time. We use a bot-protection check to keep spam off the form; it briefly processes your IP for that purpose.

The download page offers the same thing at install time: if you leave your email there, we store and use it exactly as described above. It is entirely optional - "Skip and download" gets you the identical file, and the app itself never asks you to sign in. The "Download" and "Buy now" buttons simply redirect you - to our update host and to our payment provider's checkout, respectively.

Cookies, analytics & advertising

The site uses cookies for two separate purposes, and you can accept one without the other.

Analytics. To understand how the site is used and improve it, we measure aggregate website usage with Google Analytics 4 and PostHog. These set analytics cookies on your device, so we ask for your consent first. We record events like page scroll depth and which links get clicked - never anything that identifies you personally.

Advertising measurement. We advertise on social platforms - today that's Reddit - and we need to know which ads work. With your consent, Reddit's measurement pixel sets two cookies (_rdt_uuid, _rdt_cid) so Reddit can connect your visit to an ad you clicked. What it sends is narrow, and stays that way by design:

• Conversions, not browsing. Reddit is told three things only: you went to checkout, you started a download, or you joined the email list. Each one carries the address of the page you did it on - Reddit's pixel attaches that itself. Reading a page reports no event at all. The pixel script does still load from Reddit on each page once you've consented, so Reddit sees your IP address and sets the cookies named above whether or not you ever convert. Beyond that we attach no further detail of our own.
• Never your email address. Reddit's pixel is able to accept one. We don't send it.

We also tag our own checkout with Reddit's click identifier, so we can tell internally which ads led to a sale. It stays between us and our payment provider - we send Reddit nothing about your purchase. On your device it lasts 30 days at most, and only with your advertising consent.

Your choice, by region. If you're in the EU/EEA, the UK, or Switzerland, nothing loads until you answer the cookie banner. It offers three equally-weighted answers: Reject (no cookies at all), Analytics only (measurement, no advertising), or Accept all. Elsewhere, both are enabled by default under an opt-out model. Either way you can change your mind anytime: use Cookie settings (or Your privacy choices) in the footer to re-open the banner and grant or withdraw either one. Withdrawing takes effect immediately on the page you're on - we stop sending, and delete the cookies we can reach. Strictly necessary storage (like remembering your choice) is exempt and always used.

Who processes your data

We keep the list of third parties ("sub-processors") small, and only use ones that handle data on our behalf under contract:

This list is current as of August 4, 2026, and we'll update it as our providers change. Two US-based providers also work behind the scenes: a cloud hosting and security service that runs our website and app, and an email service that sends product-update and support messages.

Data location & how long we keep it

• Website analytics (Google Analytics 4 and PostHog) are processed in the United States, so for EU/EEA/UK visitors this involves a transfer to the US - which is why we only collect it with your consent. Events are aggregate and retained up to 14 months (GA4) then discarded; IP addresses are not stored for reporting.
• Advertising measurement data is processed by Reddit in the United States - another reason it is consent-first for EU/EEA/UK visitors. Reddit's own cookies live on your device for up to 90 days; the ad click identifier we keep to attribute a purchase expires after 30 days, and is erased immediately if you withdraw advertising consent.
• App analytics are stored in PostHog's EU region and retained for up to 3 years to support long-horizon retention analysis, then discarded. IP addresses are minimized/not stored.
• Email-update, licensing, and feedback data are stored in our database and kept while they're needed for that purpose (to email you, validate your license, or follow up). We delete them on request.
• On your Mac, the app keeps detailed usage for 90 days plus lifetime aggregates, fully under your control. Uninstalling removes it.

Your rights

Depending on where you live, you have rights over your personal data. We honor these regardless of location.

If you're in the EU/EEA or UK (GDPR): you can request access to, correction of, deletion of, or a copy of your data; you can object to or restrict certain processing; and you can withdraw consent at any time - for website analytics via Cookie settings in the footer, and for in-app product analytics by toggling it off (withdrawal doesn't affect anything already lawfully processed). Our legal bases are your consent (website and app analytics), our legitimate interest in a stable, secure product (crash diagnostics, anti-abuse), and performing our contract with you (licensing).

If you're in California (CCPA/CPRA): you have the right to know what we collect, to delete it, to correct it, and to opt out of "sale" or "sharing." We never sell your personal information. Our Reddit advertising pixel does count as "sharing" for cross-context behavioral advertising under California law, so you have the right to opt out - one click, any time: Your privacy choices, also in the footer of every page. It turns advertising off and deletes the cookies involved; Analytics only and Reject do the same. We also honor Global Privacy Control as a valid opt-out.

You can act on most of this yourself at any time: grant or withdraw analytics and advertising consent separately via Cookie settings in the footer, turn app analytics on or off and disable crash diagnostics in the app's settings, unsubscribe from emails, or remove a device from your license. For anything else - access, deletion, or a copy of your data - email privacy@super-shortcuts.com and we'll take care of it. You also have the right to complain to your local data protection authority.

Children

Super Shortcuts is a tool for professionals and isn't directed at children. We don't knowingly collect data from anyone under 16.

Changes to this policy

If we change how we handle data, we'll update this page and its "last updated" date, and disclose material changes in the app before they take effect.

Contact

Questions about privacy or permissions, or want to exercise a right above? Email privacy@super-shortcuts.com.