Privacy Policy

Bumply is a Mac app that inspects the dependencies of projects already on your computer. It was built so that almost nothing needs to leave your machine, and this policy describes the small number of exceptions honestly rather than reserving rights we do not use.

Bumply is made and sold by Revelio LLC ("we"), a Wyoming limited liability company.

The short version

• The app has no account and no login.
• Your project names, file paths, dependency lists and audit results never leave your Mac.
• The website counts page views, without cookies and without following you anywhere else.
• The app counts how many people use it: a random number generated on your Mac, the version, and which of five actions happened. Nothing else, and there is a switch in Settings that stops it.
• We ask for an email address once, when you activate a licence.
• We do not sell personal information, and never have.

What the app sends, and when

Licence activation

When you activate a licence, the app sends three things to our activation service at bumply.app: the email address on your receipt, the order reference from that receipt, and an identifier for your Mac derived from its hardware UUID. We use them to confirm the purchase with our payment provider and to issue a licence that works on that computer.

We keep that machine identifier. A licence covers three Macs at a time, and counting them is the only way to hold that number, so our activation service stores the identifiers belonging to an order — a list of opaque strings, and nothing else about the machine. It cannot be read back into anything about your Mac, and it is not linked to what you do in the app. Choosing Remove from this Mac deletes that identifier and frees its place.

The activation record itself is stored on your Mac. After activation the app never sends us your licence or your email address again — it does not check in, and it does not count launches. The one thing it downloads afterwards is described next, and it is the same file for everyone.

Refunded licences

A refunded licence has to stop working, or the refund would be a way of getting Bumply for nothing. Because your licence is checked on your own Mac rather than against our server, we publish a list of the licences that have been refunded and the app reads it.

That list is identical for every copy of Bumply, so asking for it tells us nothing about who is asking: the request carries no licence, no email address and no machine identifier. The list itself holds no addresses either — each refunded licence appears as a salted SHA-256 hash of the email address it was issued to, which lets your Mac recognise its own licence without the file naming anyone. It is signed, so it cannot be forged by whoever is between you and us.

Update checks

If you allow Bumply to check for new versions of the app itself, it downloads a version feed from us. That request carries no identifier for you or your machine beyond what any web request necessarily reveals to the server serving it.

Your own package manager

To tell you which dependencies are outdated or vulnerable, Bumply runs the package manager already installed on your computer — npm, pnpm, Yarn or Bun. Those tools contact their own registries directly from your machine, exactly as they do when you run them in a terminal. Those requests go to the registry operator, not to us, and are governed by that operator's privacy policy rather than this one.

What we never collect

Bumply does not transmit your source code, your file paths, the names of your projects, your dependency lists, your audit results, your git history or the contents of any file. It contains no crash reporting, no advertising identifiers, no session recording, no profiling and no third-party analytics SDK of any kind. Nothing about what you are working on is sent anywhere, ever.

What it does send is described in full under Usage count below. It is four short values, it goes to our own server and to nobody else’s, and it can be switched off.

The website

bumply.app is a static site with no contact forms. Our hosting provider, Vercel Inc., processes standard server request data — including IP addresses — in order to serve pages and to protect the service from abuse.

Since 24 August 2026 the site also uses Vercel Web Analytics, so that we can see which pages people read and where they arrive from. It sets no cookies and stores nothing on your device. It does not identify you and it cannot follow you to any other website: a visitor is a hash derived from the incoming request, which is discarded after twenty-four hours, so the same person returning tomorrow is a new visitor as far as we are concerned.

Each page view records the time, the page address and its referrer, the country, region and city the request came from, and the browser, operating system and device type. We see these as counts. There is no dashboard on which we could look you up, because nothing recorded points at a person.

The download link is a redirect, so Web Analytics never sees it. We record each download on our own server: the time, the version, the site the click came from, the country, and whether the request came from a Mac. The referrer is reduced to a hostname before it is stored, so a search you arrived from does not come with it, and the browser is reduced to macOS or other. No IP address, no city and no user agent string is kept, and the last five hundred downloads are all that is retained. It tells us whether a launch worked. It cannot tell us who you are.

One image in the footer is loaded from VibeCodingList, the directory that lists Bumply, because their listing is only credited while their own copy of the badge is the one on the page. Loading it tells them your IP address, your browser and which page of ours you were on, exactly as an image from any other site would. It is the only third-party file this website loads, and if they ever credit the listing without it we will host the image here and this paragraph will go.

This applies to the website only, and none of it touches the app.

Usage count

From version 1.8, released 25 August 2026, Bumply reports that it is being used. Earlier versions do not and never did. This exists to answer one question we could not otherwise answer: how many people actually use the app, and how many are still using it a week later. A download tells us somebody clicked a link, which is not the same thing.

When the app opens, and when one of a short list of actions happens, it sends us four values:

• a random number generated on your Mac when you first run Bumply;
• the version of Bumply;
• the version of macOS, to one decimal — 26.1, not 26.1.3;
• the name of the action: launch, project added, update applied, check run, or licence activated. That is the whole list.

The random number is a UUID with no relationship to your hardware, your user account, your email address or your purchase. Its only job is to stop one Mac opening Bumply twice from counting as two people. It is stored in the app’s own preferences, so deleting the app removes it.

On our side these are folded into counters immediately. The structure we count into is a HyperLogLog, which records how many distinct values it has seen without keeping the values, so there is no list of installs — no register in which anyone could be looked up, including by us. No IP address is stored. The one place the random number is written down is a single entry holding the date it was first seen, which is what makes “still using it a week later” a question we can answer; it expires by itself after about a year.

Nothing else is sent. Not a project name, not a path, not a dependency, not a file, not an error, not an email address, not your licence. The server refuses any field other than the four above.

You can turn this off. Settings → Usage Count. It is on by default, because a count that only the most privacy-minded people opt into is a count that describes nobody. Turn it off and the app sends nothing at all.

Purchases

Purchases are handled by Paddle.com Market Ltd, which acts as the merchant of record and as the seller for your transaction. Paddle collects and processes the information needed to take payment and comply with tax law — your name, email address, billing country, and payment details. We never receive or store your card details. We can see the purchase records associated with our products, including the email address used, in order to provide support and verify licences.

Paddle's handling of your data is governed by its own privacy policy, which you can read at paddle.com/legal/privacy.

Why we are allowed to process this

For customers in the European Economic Area and the United Kingdom, we rely on the following legal bases under the GDPR:

• Performance of a contract — verifying your purchase and issuing a licence is how we deliver what you bought.
• Legitimate interests — keeping records of issued licences so we can support you, and preventing licence fraud.
• Legal obligation — retaining what tax and accounting law requires.

How long we keep it

• Activation records — the machine identifiers held against an order, for as long as the licence exists or until you remove that Mac, then deleted.
• Support correspondence — up to two years after the conversation ends.
• Purchase and tax records — retained by Paddle and by us for as long as tax law requires, which in most jurisdictions is several years.

Your rights

Wherever you live, you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. If you are in the EEA or the UK you also have the right to restrict or object to processing, the right to data portability, and the right to complain to your national data protection authority. If you are in California, you have the right to know what we collect, to delete it, and not to be discriminated against for asking — and we confirm again that we do not sell or share personal information as those terms are defined by the CCPA.

Write to privacy@bumply.app and we will respond within 30 days. Deleting your activation record will deactivate your licence, so we will say so before doing it.

Where your information goes

Our activation service runs on Vercel's infrastructure, and Paddle operates from the United Kingdom and the United States. If you are in the EEA or the UK, this means your information is transferred outside your country. Those transfers rely on the Standard Contractual Clauses or an equivalent safeguard in our providers' terms.

Security

Activation requests are encrypted in transit. Licences are signed with a private key that exists only in our activation service, so a licence cannot be forged. We keep the amount of personal information we hold deliberately small, which is the most reliable security measure available: information that was never collected cannot be leaked.

No system is perfectly secure, and we will not claim otherwise. If we ever suffer a breach affecting your information, we will tell you and the relevant authorities as the law requires.

Children

Bumply is a developer tool and is not directed at children. We do not knowingly collect information from anyone under 16.

Changes

If we change this policy we will update the date at the top. If a change materially affects what we do with your information, we will say so on this page rather than hoping you notice.

Contact