Privacy Policy

The short version

The MacGet app does not collect, transmit, or sell any personal information. There is no analytics SDK, no crash reporter, no remote logging, and no account system. There is no MacGet server for your data to be sent to, because none exists.

This website is the one exception, and it is a small one: it uses Google Analytics to count visits and their rough country. It runs without cookies unless you allow them, which is what the prompt on your first visit was asking. That is described in full below, where you can also change your answer. It is separate from the app — installing MacGet does not opt you into it, and it cannot see anything you download.

Everything below is verifiable — MacGet is open source under the MIT license, so you don't have to take this document's word for any of it.

What MacGet stores, and where

All application state lives on your Mac, in ~/Library/Application Support/Macget/:

• queue.json — your download queue: URLs, destination paths, per-chunk progress, and status.
• settings.json — your preferences, including the default download folder and any proxy you configured.
• host_caps.json — the parallelism limit MacGet learned for each host it has downloaded from. Hostnames only.
• incoming/ — the handoff directory the browser extension writes into. Entries are consumed and removed as they are ingested.
• Partial downloads, as .macget-partial files alongside their destination, until they finish.

Credentials are the exception. Usernames and passwords you save for authenticated downloads are stored in the macOS Keychain, not in any of the files above and not in plain text.

None of this is backed up to, synced with, or reported to anyone. To erase all of it, delete that directory and remove any MacGet entries from Keychain Access — the install guide has the exact commands.

When MacGet uses the network

A download manager obviously makes network requests. Here is the complete list of what it connects to and why.

1. The servers you download from

When you download a file, MacGet connects to that file's host — the same connection your browser would make, split across multiple HTTP-Range requests. Those servers see what any HTTP server sees: your IP address, a Macget/1.3.0 User-Agent, and any credentials or cookies required for that specific download. MacGet adds nothing else and sends nothing to anyone but that host.

2. Update checks

MacGet uses Sparkle to fetch a signed appcast feed hosted on GitHub Pages. This is an ordinary HTTPS request, so GitHub can observe your IP address and User-Agent, subject to GitHub's privacy statement. The request contains the current app version so it can tell whether an update applies. It carries no identifier for you or your machine. You can disable automatic checks in MacGet's update settings.

3. Media extraction, if you turn it on

MacGet bundles yt-dlp for video and audio downloads. This is off by default. When enabled, media links are handed to yt-dlp, which contacts the media site directly to resolve formats — again, only that site. Leaving the feature off means yt-dlp is never invoked.

There is no fourth case. MacGet makes no other outbound connections.

The browser extension

The optional capture extension needs broad-looking permissions, and you should know what each is for before installing it. It requests downloads, cookies, webRequest, tabs, nativeMessaging, storage, and host access to all URLs.

That set exists because the extension has to notice a download starting on any site, and then reproduce it faithfully outside the browser. When a download begins, it collects the URL, the suggested filename, the referrer, the file size, the MIME type, your browser's User-Agent, and the cookies for that URL.

Cookies are the sensitive part, so to be exact:the extension calls the browser's cookie API scoped to the specific download URL. It reads the cookies that would be sent to that one address, not your cookie jar. They are included because that is what makes a download from behind a login work outside the browser — without them, a session-protected file returns an error page instead of the file.

Where that data goes:to MacGet on the same machine, over Chrome and Firefox's native-messaging channel, into ~/Library/Application Support/Macget/incoming/. The extension contains no code that contacts a remote server — no fetch, no XHR, no endpoint of any kind. The captured data never leaves your computer, and it goes to no one but MacGet.

The extension is entirely optional. MacGet works without it, and removing it from your browser ends any collection immediately.

This website

macget.suryansh.work is a static site hosted on Vercel. Vercel keeps standard server logs (IP address, User-Agent, requested URL) as part of serving the site, described in Vercel's privacy policy. Fonts are self-hosted; apart from the analytics script below, nothing loads from a third-party CDN.

Google Analytics. The site loads Google Analytics 4 (gtag.js, from googletagmanager.com) so I can see how many people visit, which pages they read, and roughly which countries they come from — the numbers that decide whether it's worth putting more money into MacGet, starting with Apple notarization.

Every visit sends Google the same basic measurements: the page URL, the referring URL, your device type, browser, and language, and a coarse location that Google derives from your IP address and then discards — GA4 does not log or retain IP addresses. Google Analytics never receives your name or email, it is not linked to any MacGet account (there are none), and it runs only on this website — never inside the app or the browser extension.

The cookie is the part you control. Analytics starts in a cookieless mode (Google Consent Mode, with analytics_storage denied) that stores nothing on your device. Everything above still works in that mode; the only thing missing is any way to tell that two visits came from the same browser, so my visitor count is a statistical estimate rather than a real count. Allowing analytics lets GA set a first-party _gacookie — a random identifier, not tied to you — which turns that estimate into an actual number. Advertising storage and personalization stay denied either way; MacGet runs no ads and Google's ad features are switched off on this property.

Your answer is stored in your browser's local storage, never sent anywhere, and applies to that browser only. You can change it here at any time:

Declining is not a downgraded experience — nothing on this site is gated behind it, and no part of MacGet checks it. Any content blocker or Google's own opt-out add-on will block analytics outright, and Google's handling of whatever it does receive is covered by its privacy policy. Downloading and using MacGet never requires loading this page at all.

Children

MacGet is a general-purpose developer tool and is not directed at children. Since it collects no personal information from anyone, it collects none from children either.

Changes to this policy

If MacGet's behaviour ever changes in a way that affects this document, the policy will be updated along with it and the effective date above will change. Because the site is versioned in the same repository as the app, the full history of this page is public in git.

Contact

Questions about privacy: suryansh.codes2001@gmail.com. For suspected vulnerabilities, please use the security policy rather than a public issue.