Privacy policy

Notch Metrics is operated by Notch Metrics (“we”). This policy covers the website at notchmetrics.com, the API that serves it, and the Notch Metrics app for macOS. Questions about it go to support@notchmetrics.com.

Your account. You sign in with Google or GitHub. From that we keep the email address, display name and profile picture the sign-in provider gives us, the time zone and preferred currency you choose, and your plan and trial dates. We do not keep a password.

Your devices. Each Mac you sign in from gets a device token so the app can talk to the API. We store only a hash of that token, with the device’s label and when it was last used. You can revoke any device from the app at any time.

Your connections. When you connect a service, we store the credential that lets us read from it: an API key you paste, or the access and refresh tokens the service issues after you authorise us. Each one is encrypted with a key unique to that connection, bound to your account, before it is written anywhere. We also keep the service’s name for the account, its currency, which metrics it offers, and when it last worked.

Your numbers. The figures we fetch for your widgets are cached on our servers for a short time, from minutes to an hour depending on the metric, so the notch opens instantly and we do not hammer the services you connected. Some widgets list recent events rather than a figure, such as recent payments. Those rows can include your own customers’ names or email addresses as the payment provider reports them, and they sit in the same short-lived cache.

Billing. Subscriptions are sold by Dodo Payments as merchant of record. We receive and store the subscription status, its identifiers and its renewal dates. Card details go to Dodo Payments and never reach us.

Operational logs. Our hosting provider records requests to the API and the website, and our error logs record failures with credentials and secrets redacted before they are written. These are kept briefly and used only to keep the service running.

What we do not collect. There are no third-party analytics or advertising trackers on the website or in the app. The app does not record what you do on your Mac. Custom metrics you write run on your own machine, and any secrets you give them stay there.

Everything above exists to do one thing: fetch the numbers you asked for from the services you connected, and show them to you. We also use it to run your subscription, to keep the service secure, and to answer you when you write to us. We do not sell it, rent it, or use it to build advertising profiles.

Connecting Google Analytics, Google Search Console or YouTube asks for read-only access to those products. We use that access for two things only: to list your properties or channels so you can choose which one a connection reads, and to read the reports behind the widgets you add. For YouTube that includes your channel’s views, watch time, subscribers and estimated revenue. The revenue figures come from Google’s monetary Analytics scope, which is the only one that returns them.

We do not transfer Google user data to anyone else except as needed to provide the service, and we do not use it for advertising or to train machine-learning models. No human at Notch Metrics reads it, except where you have asked us to look into a problem with your own account.

Notch Metrics’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The YouTube connection is built on the YouTube API Services. Using it means you also accept the YouTube Terms of Service, and what Google itself does with your data is covered by the Google Privacy Policy.

You can withdraw this access at any time. Disconnecting the connection in Notch Metrics deletes the stored tokens, and you can revoke it from your Google account’s connected apps instead. Figures already fetched sit in the short-lived cache described above and are swept with it.

The API, its database and the download mirror run on Cloudflare. Data is encrypted in transit everywhere. Credentials are encrypted at rest as described above, with the encryption keys held as secrets separate from the database, so a copy of the database alone does not reveal a single key.

The services you connect — Stripe, Dodo Payments, Google, GitHub and the others listed on the site — receive requests from us carrying your credential for that service and nothing about your other connections.

• Cached numbers: minutes to hours, then replaced or swept.
• Connection credentials: until you disconnect the connection, which deletes them, or delete your account.
• Device tokens: until you revoke the device or delete your account.
• Account and billing records: for as long as you have an account, and afterwards only what we must keep for tax and accounting.
• Logs: briefly, on a rolling basis.

You can disconnect any service, revoke any device, and change your time zone and currency from inside the app. To export or delete your account and everything attached to it, email support@notchmetrics.com from the address you signed in with and we will do it promptly. Depending on where you live, you may also have rights to access, correct, restrict or object to our use of your data, and to complain to a supervisory authority. Writing to us is the fastest way to exercise any of them.

Notch Metrics is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children; if you believe we have, tell us and we will delete it.

When this policy changes we update the date at the top. If a change is material to how we treat your data, we will say so in the app or by email before it takes effect.