The short version
ShabuBox collects no personal data. There is no account and no sign-up. All document processing happens on your device. The developer operates no servers and cannot access your documents or your library.
Stated plainly: we collect no personal data through the app itself. The only personal information we ever hold is what you send us directly — an email when you write to support, and the minimum needed to issue and support your license when you buy.
Data we do not collect
- No accounts — there is no login, profile, or user identifier.
- No analytics, telemetry, usage tracking, or crash-reporting SDKs of any kind.
- No advertising identifiers and no third-party trackers.
- No document content is ever transmitted off your Mac.
On-device processing
OCR (Apple Vision), document-type identification, entity extraction (GLiNER2), auto-filing, and document chat (Apple Foundation Models and local MLX models) all run on your Mac inside Apple’s App Sandbox. Your documents are read and understood locally.
Limited network use
ShabuBox uses the network for a small, fixed set of purposes. None of them transmits your document data:
- One-time model downloads
- If you choose a richer local chat model, it is downloaded once from the HuggingFace CDN. Only the model is downloaded; nothing about your documents is sent.
- Local-network scanner discovery
- To find AirScan / eSCL scanners, ShabuBox looks on your local network. This traffic stays within your network.
- Update checks
- Because ShabuBox is distributed from shabubox.com rather than a store, it checks for new versions itself. It fetches a small appcast file from shabubox.com or GitHub and compares it to the version you have. Like any HTTP request, this reveals your IP address and the app version to the server that serves the file. There is no account, no installation identifier, and no document data in the request. You can turn automatic update checks off in the app’s settings.
- Weekly license revocation check
- Your license is validated offline — the app does not phone home on launch to ask whether you’re allowed to run it. About once a week it downloads a small list of revoked license IDs so that refunded licenses stop unlocking the app, and it keeps working for 30 days offline if it can’t reach the list. The list is the same file for everyone; the app downloads it and checks locally. Nothing about your machine, your license, or your documents is sent.
Optional iCloud sync
iCloud Drive sync is optional and off unless you enable it. When enabled, it uses your own Apple iCloud account under Apple’s terms. The developer operates no servers and cannot access synced data.
Calendars & Reminders
ShabuBox accesses Calendars and Reminders only with your permission, and only to provide the reminders feature (including sync with Apple Reminders). This data is not collected by or transmitted to the developer.
Support correspondence
If you email support, the developer receives your message and email address, and uses them solely to respond to you. Along with the purchase details described below, this is the only personal data the developer ever receives.
Purchases and licensing
When you buy ShabuBox, the payment is handled by Paddle (Paddle.com Market Ltd) as merchant of record. Paddle is the seller of record: it collects and processes your payment and billing details — card information, billing address, tax data — as its own controller, under its privacy policy. We never see or store your card details.
From that transaction we receive only what we need to issue and support your license:
- Your email address, so we can send you the license and you can reach us.
- The transaction or order ID, so a purchase can be matched to a license.
- Your country, which we keep for tax records.
We store those three things to issue your license, to let you recover it if you lose it, and to handle refunds. We don’t use them for marketing or profiling, and we don’t sell or share them.
Contact
Questions about this policy can be sent to hello@shabubox.com. This policy is offered by Alan Wizemann, LLC, a Delaware limited liability company.