Privacy policy

1. Controller and scope

This policy covers Disklio for macOS, this website and the handling of contact requests. Further provider details are in the legal notice. Use the contact details above for privacy questions.

2. Data processed by the app

You do not need a separate Disklio account. File analysis takes place locally. Disklio does not send your files, paths, scan results or duplicate comparisons to a server operated by the provider. It contains no advertising or analytics SDKs and no service of its own for sending crash reports. Apple’s processing is described in section 4.

• Folder and storage analysis: After you select a location and grant the required macOS access, Disklio reads file and folder names, paths, types, sizes and modification dates. It also reads drive information such as name, identifier, capacity and available space. This supports the storage map, file list, search and filters. Names and paths may contain personal or confidential information.
• Duplicate search: This Pro feature reads suitable locally available files and calculates comparison values to compare their contents. Contents and results are processed locally. No permanent content archive or server-side fingerprint of your files is created.
• Favourites and recent scan locations: Disklio saves selected folder names and paths, drive identifiers where available and macOS access references, so authorised favourites can be reopened. It also remembers the most recent successful scan location and time for each drive, up to 100 drive records. Up to 50 favourites can be saved.
• Pro scan history: After a successful scan, Disklio automatically saves a local metadata snapshot: file and folder paths, names, sizes, categories, modification dates, scan time and coverage information. Up to ten scans are retained. History contains no copies of file contents and is not a backup.
• Settings: Language, appearance, onboarding completion and saved filters, including their names and criteria, are stored locally. The current search, selection and live results are processed in memory.
• Preview and Trash: At your request, Disklio opens a preview through macOS or reveals a file in Finder. Selected files or folders are moved to the Trash only after confirmation. These actions use local macOS functions.
• Pro CSV export: An export you request writes names, paths, types, sizes and modification dates from the current result list to your chosen destination. CSV files contain no file contents but can still contain sensitive information.

Disklio respects macOS file access permissions. Folders cannot be analysed without the necessary permission. Inaccessible or online-only files may be skipped. If you choose a network drive or synchronised location, its operator may process data according to your settings there. This also applies to exported CSV files and previews. Disklio operates no cloud service for these functions.

Where personal data is processed to provide the app functions you request, the legal basis is Article 6(1)(b) GDPR. The exception for strictly necessary storage and access on your device under section 25(2), no. 2 TDDDG applies only where its legal requirements are met. Granting folder access or reading this policy is not blanket consent to additional processing.

3. Local storage and deletion

Settings, favourites, recent scan locations, saved filters and scan history remain in local app storage across restarts. New history entries replace older ones once ten scans are reached. An additional storage limit may retain fewer entries for very large scans. Recent scan locations keep the latest successful scan per drive; the oldest records are removed beyond 100 entries.

You can remove favourites and saved filters in their respective views. Scan history lets you delete individual entries or all saved history. This removes stored metadata, not your original files. Clearing the current results does not remove favourites, saved filters, recent scan locations or history. Losing Pro access does not automatically delete existing local data.

To remove saved local app data together, open “Local App Data” in Settings and choose “Delete Local App Data…”. After confirmation, this removes scan history, favourites, recent scan locations, saved filters and local review-request counters and timestamps, and resets settings including language, appearance and onboarding completion. Your original files, exported CSV reports and Pro purchase remain unchanged. Deleting saved app data cannot be undone.

Recent scan locations and onboarding completion remain until replaced or until the relevant local app data is removed. Local review-request counters and the last request time remain across app restarts to enforce the limits described in section 4. “Delete Local App Data…” also removes these values and resets those limits. Uninstalling the app may leave local app data behind. Use the contact details above for questions about complete removal.

Temporary scan and duplicate data is released when results are reset or replaced, or the app exits. You manage exported CSV files and files in the Trash separately. Copies in your backups or cloud storage follow your settings for those services. We cannot remotely access or delete local app data.

4. Apple, Pro purchases and reviews

Distribution through the Mac App Store is planned. When you download, buy, update or review the app, Apple processes data as an independent controller, including account, device and transaction information. See Apple’s Privacy Policy and App Store & Privacy information.

Pro access: Disklio uses StoreKit to retrieve the available Pro product and price, start a one-time purchase and restore purchases. The app checks Apple-verified transaction information, particularly the product and entitlement and any revocation or refund. Connections to Apple may be needed. Payment details are not entered in Disklio or sent to a Disklio server. Entitlement checks provide purchased features under Article 6(1)(b) GDPR.

Ratings: After 15 successful scans, Disklio may ask Apple to display its native rating dialog at a suitable moment. Disklio makes at most two automatic request attempts while the local app data is retained. A second attempt requires 15 further successful scans and at least 30 days since the first attempt. For these limits, the app stores only a local successful-scan counter, request-attempt count and last request time. These values contain no file names, paths or file contents and are not sent to a Disklio server. Apple decides whether to display the dialog; Disklio does not record whether you submit a rating or what it contains. You can also choose the rating action in Settings yourself, which opens the App Store. Apple’s privacy information applies to its rating dialog and ratings you submit there.

Public reviews and diagnostics: After release, we read and respond to public App Store reviews and use diagnostic and crash reports Apple makes available. Review data includes the public display name, rating, text and date; replies appear publicly on Apple’s platform. Diagnostic reports may include device and operating system details, app version, error time and technical error information. Availability depends on Apple’s diagnostic sharing controls and your system settings.

Apple is the source of this information; reviews are public. We use it for feedback and troubleshooting under Article 6(1)(f) GDPR, based on our interest in support and a reliable app. We delete our own copies once the request or error has been resolved, unless a legal duty or specific legal claim requires further retention. Such exceptions rely on Article 6(1)(c) or (f) GDPR. Apple’s retention is governed by its own policies.

5. Website and hosting

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus.

When you access the website, the host processes technical connection data, particularly IP address, time, requested file or page, response status, data volume and, where available, referrer, browser and operating system information. Technical logs and server-side access statistics support delivery, error analysis and abuse prevention. The basis is Article 6(1)(f) GDPR and our interest in secure, reliable operation. The site cannot be delivered without necessary connection data.

Retention depends on what is needed for operation, troubleshooting and security checks. Incident data may be retained longer for investigation or specific legal claims. Data must be deleted when no longer needed, unless statutory retention duties apply.

Hostinger processes data on our behalf under its Data Processing Addendum. This also describes subprocessors and transfers outside the European Economic Area. For relevant transfers to countries without an adequacy decision, it provides in particular for EU standard contractual clauses. You may request information about applicable safeguards using our contact details.

6. Cookies, external content and links

The website uses no analytics, advertising or social media scripts and sets no cookies. At the root address, a locally served script selects the saved language choice or, if none is available, the primary browser language: German opens the German version; other languages use English. Pages opened directly under /en/ or /de/, including legal pages, keep the language specified in their address.

Only when you select a language in the language switcher yourself is that choice saved in local browser storage and considered on your next visit to the root address. Change it with the switcher or remove it by clearing website data in your browser. No user profile is created. The requested language path forms part of the website access data described in section 5. Every page remains available through its language links without JavaScript or browser storage.

This storage provides the language display you expressly choose. Where device access is strictly necessary for that purpose, the exemption from consent is governed by section 25(2), no. 2 TDDDG. Where personal data is processed to provide this function, the basis is Article 6(1)(b) GDPR. Fonts come from your device; images, the language script and stylesheets are served with the website. No external video or map service is embedded.

Your browser may cache website files for technical reasons. This is not visitor tracking by us. Connection data is described in section 5. External links open only when you activate them; the destination’s privacy information then also applies.

7. Email and contact requests

You can contact us at team@disklio.app. We process your email address, your name if supplied, message text, voluntary attachments and sending, receipt and delivery information to handle your request. Contract-related enquiries rely on Article 6(1)(b) GDPR; other requests rely on Article 6(1)(f) GDPR and our interest in responding. We may be unable to reply without sufficient contact details and information about your request.

The mailbox is provided through Hostinger Mail. Hostinger processes messages and necessary technical data, such as sender, recipient, times, connection and delivery status and, where applicable, IP addresses in access and security logs. This supports delivery, troubleshooting and abuse prevention under Article 6(1)(f) GDPR. Hostinger processes data on our behalf under the Data Processing Addendum linked in section 5; its arrangements for subprocessors and international transfers also apply.

Messages and attachments are deleted after handling is complete once no legal retention duty or specific legal claim requires them. Necessary further retention relies on Article 6(1)(c) or (f) GDPR and ends when its reason no longer applies. Technical logs are retained as required for delivery, troubleshooting and security checks, then deleted unless a legal duty requires further retention.

Disklio does not automatically send scan history, file lists or file contents when you contact us. Share only what is needed and check screenshots and CSV reports for confidential information.

8. Recipients and transfers

Website and contact information is processed by the provider and, where required for website hosting and email, Hostinger and its subprocessors. Disclosure to authorities or other recipients requires a legal obligation or another applicable legal basis. We do not sell personal data.

Apple independently processes data for its services and may process it internationally under its privacy policies. Disklio’s local file analysis does not transfer your scan data to us. Storage, backup and network services you use are separate.

9. Your privacy rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Use the contact details above. You can withdraw consent for the future at any time without affecting the lawfulness of earlier processing.

Right to object: You may object to processing under Article 6(1)(f) GDPR for reasons relating to your particular situation. We will stop unless we demonstrate overriding compelling legitimate grounds, or processing is needed to establish, exercise or defend legal claims. We do not carry out direct marketing.

We generally handle requests free of charge within one month. If a legally permitted extension is needed, we will explain the reasons within that month. We have no remote access to data stored only on your Mac; local deletion options are in section 3.

You may complain to a data protection authority, particularly where you live, work or believe an infringement occurred. The authority for the provider in Hamburg is the Hamburg Commissioner for Data Protection and Freedom of Information.

We do not make solely automated decisions with legal or similarly significant effects or carry out corresponding profiling.

10. Changes to this policy

We update this policy when app functions, the website or services change. Updating the text does not replace information or consent required for new processing.