Privacy policy
Last updated: 2 November 2026
Most of what Shortcut Flow does happens on your Mac. This page lists everything that leaves it, who gets it and how long we keep it.
1. Who is responsible
The controller of your data is Grasso Sport sp. z o.o., a company registered in Poland under KRS number 0001001419, tax ID (NIP) 7872140767, with its registered office at Wróblewo 24, 64-510 Wronki, Poland. Contact for anything about your data: hello@shortcutflow.com.
2. What stays on your Mac
Your click history, the shortcuts you use, your practice progress and your learning plan stay on your Mac. Before the app saves click history, it replaces anything that looks like an email address, card number, phone number, date, amount of money or a long piece of text with [REDACTED]. You can delete all of it in Settings. We see a part of it only in a bug report you send, in a diagnostic file you export and send us, or in a crash report while the beta test log is on. Section 3 lists what each one holds.
3. What we collect and why
| Data | Why | How long |
|---|---|---|
| Your email address | To sign you in with a code, link your purchase to your account and send the emails about your free week | Until you delete your account |
| Mac identifier: a one-way hash of the hardware ID of your Mac, not the ID itself | One free trial per Mac, one Mac per license | Until you delete your account |
| Trial dates, license type and status, number of license moves this month | To decide if the app should show hints | Until you delete your account |
| Free week totals: time spent clicking menus and buttons that have a shortcut, time saved with shortcuts, how many shortcuts you learned, and the name, keys and app of your top five shortcuts by time. Never window titles, documents or what you type. The app sends them once a day during your free week, only while you are signed in | To email you a summary of your free week the day before it ends and once after it ends | 30 days after the app's last report |
| Day totals, while you are signed in: for each day, how many times you used a shortcut, how many times you clicked a button that has a shortcut, the time saved and the time lost, whether you practiced and how many shortcuts you know by heart. Also your practice streak, the app version and the name, keys and app of your top five shortcuts by time. Never window titles, documents or what you type. The app sends them once a day and when it starts | To show your weekly and monthly recap, to email you the monthly recap once a month, and to add up totals across all users so we can see how people use the app and make it better. We never show one person's numbers to anyone else | 13 months, so a recap can compare with the same month a year earlier |
| Paddle customer and subscription IDs | To match payments, refunds and cancellations to your account | Until you delete your account, longer if tax law requires it |
| Sign-in codes and session tokens, stored only as hashes | To keep you signed in | Codes: 10 minutes. Sessions: until you sign out or delete your account |
| Your IP address | To limit how many requests one address can make and stop abuse | Up to 1 hour |
| Daily usage counts: hints shown, hints you followed with the shortcut, shortcuts pressed, clicks, practice sessions and answers. Also which settings and permissions are on, and the app and macOS version. A random install ID groups the days of one Mac. It isn't your Mac identifier and we don't link it to your account | To see which parts of the app help and fix the ones that don't. Only while "Share anonymous usage data" is on in Settings | 12 months |
| Crash reports: the report macOS writes when Shortcut Flow crashes or freezes, with your user folder name removed, and the same random install ID. With the beta test log on, also the last 15 minutes of that log | To find and fix crashes. Only while "Share anonymous usage data" is on in Settings | 12 months |
| Bug reports you send from the app: your note and the last 15 minutes of the app's log. The log lists the apps you used, the shortcuts you pressed, the buttons and menus you clicked and where hints showed up. It never holds window titles or what you type. With "Attach a screenshot" on, also a picture of your screen. It shows everything that was on that screen, window titles included, and the form shows you the picture before you send. Also the app and macOS version, which settings and permissions are on, your system language, how many screens you use and the random install ID. If you use an account in the app, the report links to it | To reproduce and fix the bug you reported | 12 months |
| Waitlist email, if you joined the waitlist on the website | To tell you when Shortcut Flow launches | Until you ask us to remove it |
4. Information about the apps you use
To build shortcut lists, the app sends our server some information about the apps you use. None of it includes your email or Mac identifier, and we don't link it to your account.
- When you open an app Shortcut Flow doesn't know yet, it sends the app's name, ID, version and language, plus the names of its menu items and buttons. It doesn't send the contents of your windows or documents, or what you type. Before sending, it removes the recent files, history, bookmarks and window menus, and any menu item that looks like a file name. You can switch this off in Settings with "Learn new apps".
- When you open the cheatsheet or practice for an app, it asks our server for that app's shortcut list by the app's ID.
- When a menu in your app shows a different shortcut than our list, it sends the app ID and version, the menu item name and both shortcuts, so we can fix the list.
- When you mark the same shortcut as wrong 3 times, it sends the app ID and that shortcut.
Our server sends app names, menu and button names to Anthropic to generate the shortcut list. We keep the generated list, which every Shortcut Flow user shares, for up to 90 days. We don't keep the request itself. For correction and wrong-shortcut reports we keep a short hash of the IP address, so one person can't count as many.
5. Payments
Paddle.com sells Shortcut Flow as our reseller and Merchant of Record. Paddle collects your payment details, billing address and tax information and processes them under its own privacy policy. We never see your card number. Paddle tells us your email, customer ID, what you bought and the status of the payment.
The checkout page opens with your account email and account ID in its address, so Paddle can fill in the form and we can match the payment to your account.
6. Who processes your data for us
| Company | What they do | Data |
|---|---|---|
| Cloudflare, Inc. | Hosts the website, our server and the database, and counts website visits | Everything in sections 3 and 4 |
| Anthropic, PBC | Generates shortcut lists | App names, IDs, versions, menu and button names |
| Resend (Plus Five Five, Inc.) | Sends sign-in codes, reminders and monthly recaps by email | Your email and the content of the email |
| Paddle.com Market Ltd | Sells the license and handles payments, taxes, invoices and refunds | See section 5 |
Cloudflare, Anthropic and Resend are based in the US. Resend sends our emails from its servers in Ireland. We rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses for these transfers. We don't sell your data and we don't use it for ads. The app counts its own usage only as section 3 describes, without third-party analytics. The website counts visits with Cloudflare Web Analytics, which sets no cookies and doesn't follow you to other sites. It records the page, the site you came from, your browser type and your country.
7. Legal basis
- Your account, trial, license and emails about them: performance of our contract with you (Art. 6(1)(b) GDPR).
- App information for shortcut lists and IP-based abuse limits: our legitimate interest in making the app work and keeping the service available (Art. 6(1)(f) GDPR). You can object at any time, for example by switching off "Learn new apps".
- Usage counts and crash reports: your consent, which you give by turning on "Share anonymous usage data" when you set up the app or later in Settings (Art. 6(1)(a) GDPR). You can withdraw it at any time with the same switch.
- Website visit counts: our legitimate interest in knowing how many people visit the site and where they come from (Art. 6(1)(f) GDPR).
- Bug reports: your consent, which you give by sending the report (Art. 6(1)(a) GDPR).
- Keeping payment records: our legal obligations under tax law (Art. 6(1)(c) GDPR).
- Waitlist: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
- Day totals and the monthly recap: our legitimate interest in showing you your progress and in learning from totals across all users how to make the app better (Art. 6(1)(f) GDPR). You can object at any time. Turn off the monthly recap email in Settings or with the link at the bottom of every recap, or write to us.
8. Cookies
Our website doesn't set cookies. The checkout page loads Paddle's script, which may set cookies needed for the payment. Paddle's cookie policy applies to those.
9. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it or to receive it in a portable format, and you can object to processing based on legitimate interest. Email hello@shortcutflow.com from the address of your account. We reply within 30 days.
To delete your account, email us the same way. We delete your account data within 30 days. Records that tax law requires us or Paddle to keep stay until that obligation ends. Deleting the account doesn't cancel a Paddle subscription by itself, so cancel it first in the customer portal.
You can also complain to the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl), or to the authority in your own country.
10. Children
Shortcut Flow isn't meant for children under 16 and we don't knowingly collect their data.
11. Changes
If we change what we collect, we will update this page and, for changes that matter, email you before they take effect.