Version 2026-10-10. This is the same text the app shows in Help ▸ Privacy Notice and asks you to accept when it changes.
Version 2026-10-10 · Cary Norton LLC, Birmingham, Alabama
This is the notice as it stands today. It describes what the app actually does, checked against the code. Two retention promises below are not yet enforced by anything but us; both are noted where they appear. When it changes you will be asked to read it again.
Spot Tone works on your Mac. Your scans are not uploaded, not queued in a cloud, and not seen by anyone but you. There are no accounts.
What does leave your Mac, all of it described below:
If you buy a license, we also hold the email address you bought with.
Off by default. If you turn on "Share these numbers" in Settings ▸ Stats, once a week the app sends the counts shown on that page—how many frames were detected, repaired and exported, how often each tool was used, how often a mark was erased or a fill redone or undone, the sensitivity setting repairs were made at, the size of frame, and how often the app stalled or ran short of memory—along with the app and model version, the macOS version, how much memory the Mac has, and the same random install id as the install record. Numbers only: never a picture, a filename, a path, or anything you typed. We use them to see what is working inside the app and what isn't. Turn it off any time; nothing already sent is deleted, but nothing more goes out.
The first time Spot Tone runs it sends: a random install id, the name of your Mac, which Apple chip it has and how much memory, the app and macOS versions, which detection model is installed, the language and region your Mac is set to, and the address you connected from. It is sent again only after an update that adds a field to it.
No image data and no account. If you typed a name or email into Settings ▸ Contribute, it goes with this record too, so a contribution can be credited to you. It tells us which Macs the app has to run well on, and which languages are worth translating into.
The app asks our server whether a newer version or detection model exists. Detection models install automatically; app updates ask you first. Both are cryptographically signed, and the app refuses anything that fails the signature.
On by default; switch in Settings ▸ Updates. If the app crashes we receive the crash report macOS itself writes, sent as macOS wrote it (it names the app's location on disk and the Mac's model), the app and macOS versions, a random ID for your Mac, the size and bit depth of whatever frame was open and which tool you had selected, and the last 120 lines of the app's diagnostic log with file paths and filenames stripped out before sending. Never the picture.
If you type an email address into the field beside that setting, we get it too, and use it only to reply to you about that crash.
Help ▸ Send Feedback sends the note you typed, your install id, the app and macOS versions, an address if you type one (and the name or email from Settings ▸ Contribute, if you filled that in), and the last 120 lines of the app's diagnostic log only if you tick that box—with file paths and filenames stripped out before sending, the same as a crash report. Nothing is sent unless you press send.
Off until you turn it on, in Settings ▸ Contribute.
With it on, when you correct a frame by hand and apply the repair, the app sends a copy of that frame, downscaled if it is over 3,600 pixels on its long edge, and the correction mask. Not your library and not the full-resolution file. Now and then it also sends, the same way, a frame you accepted as-is when the detection was borderline.
Alongside the frame: the filename (not the path), the detection threshold, pixel counts, the scanner model read from the file's EXIF, the name of your Mac, a map at one-eighth resolution of where on the frame you looked, and—if you used the Dust Lasso—the shape of each loop and which of its suggestions you kept.
Filenames are sent deliberately. They are usually lab job numbers, they let a bad contribution be traced back to a frame, and they make deduplication work. They are never published or shared.
Each contribution is encrypted on your Mac before it leaves, to a key only we hold. It is unreadable in transit and while it waits to be reviewed; it is decrypted only on our own machine. A contribution approved for training is kept, decrypted, in the training corpus on our own storage.
With contributing on, the app also sends, in a batch at launch, one line for each frame you finish: the Sensitivity you used, whether you changed the marks, and how unsure the detection was. Numbers only, no image and no filename. They set better defaults and keep the frames we do see from being a lopsided sample.
Corrections are used for one purpose: training better dust detection, which comes back to you as model updates. They are never sold, rented, or used for advertising.
Sending one is not a promise that we will use it. Every contribution is reviewed before it can train anything, and most of what arrives never does: we reject frames by hand, and the intake tooling drops contributions that would teach the model little or teach it something wrong. A contribution that is rejected is deleted or set aside, not trained on.
We hold the email address you bought with and a license id. Paddle is the merchant of record: they run checkout, hold the payment details, handle tax and invoices, and we never see a card number.
Activating a Mac sends the license, a one-way hash of that Mac's hardware id, and the Mac's name. The license server does not keep the address you connect from. After that the app checks in about once a day on a Lab license and once a week on an Indie one. That is how seats are counted and how a refunded license stops working.
On a Lab license the names of the Macs holding seats are shown to the other Macs on that license, in Settings ▸ License, so a lab can manage its own seats.
If you lose your license you can fetch it by the email address you bought with, which sends that address to the license server.
Offline: an activated Mac keeps working, with clean exports, however long it goes without reaching us. The check-in exists to count seats and to learn about a license we have had to withdraw, not to switch anything off.
Recorded with uploads and with the install record, for security and abuse traceability. The license server does not keep it. The app asks our own server for it rather than a third-party address-echo service, which would otherwise learn who uses this software.
The download page has an optional field for an email address. If you leave one, we use it to send news about Spot Tone: new versions, and a Windows version if you ticked that box. Nothing is kept until you confirm the address from the one email we send; an unconfirmed address is deleted after seven days. Every message carries an unsubscribe link, and unsubscribing deletes the address. To stop the field being used to flood someone's inbox, a one-way hash of the address you connect from is kept for an hour.
spottoneapp.com counts visits with Cloudflare Web Analytics, which sets no cookies and does not follow you to other sites. Its pages load their typeface from Google Fonts, so your browser asks Google for it, as it would on most sites. A link we tag for a particular post or channel (one that looks like spottoneapp.com/go/…) is counted by the day and the tag, and nothing else. While the store is open, the home page loads Paddle's checkout script, and the checkout itself is Paddle's: their privacy notice covers what you enter there. While it is closed, no Paddle code loads.
For people in the EU and UK, under the GDPR and UK GDPR:
You can object to anything resting on legitimate interest by writing to the address below.
Cloudflare (United States and its global edge) holds the license records and the server logs. The training corpus, which includes approved contributed crops, lives on our own storage in Birmingham, Alabama, backed up encrypted to Backblaze (United States). Paddle holds the purchase records.
No contributed image is ever seen by anyone but Cary Norton. Every contribution is reviewed by hand before it is used.
Downloads and update checks send us a notification. Each time the app checks for an update, and each time someone downloads it, we get a message in a private notification channel (Discord or Pushover) with the city, region, and country the connection reports and the browser's or app's version string. That is how we see the app being used; the messages stay in that channel until we delete them. Beyond that, Cloudflare, which serves the downloads and runs the license server, is not configured to retain per-request records for us, and we do not collect them ourselves. The address you connect from is recorded inside a contribution bundle, which is encrypted, and with the install record—not in a log of traffic.
Contributed bundles arrive, still encrypted, in Cloudflare R2 storage and are moved to our own computer in Birmingham, Alabama, within minutes. If R2 cannot take one, it goes instead to a file server in Birmingham that keeps its own access log in the ordinary way that any file server does.
Email us with the Install ID shown in Settings ▸ Contribute. Every bundle, install record, crash report, and feedback note carrying that id is deleted, and the crops from those bundles leave the training corpus at the next retraining. Bundles are named by install id, so this is mechanical rather than a search.
You can also turn contribution off at any time. Corrections already prepared but not yet sent stay on your Mac, and are deleted once they have uploaded.
If you are in the EU or UK you have the right to see what we hold about you, to correct it, to have it deleted, to restrict or object to how it is used, and to receive it in a portable form. If you are in California you have comparable rights under the CCPA, and we do not sell personal information. Write to the address below and we will answer.
If you turn contribution on, you are confirming that you own or have the right to contribute those images, and that they are lawful. A lab contributing its clients' scans is making that promise on its clients' behalf.
We have zero tolerance for illegal content. Apparent child sexual abuse material is reported to the National Center for Missing & Exploited Children and to law enforcement as required by 18 U.S.C. §2258A. Every contribution is reviewed by a person before it is used, and each one carries an install id, so anything found can be traced, removed, and reported.
Spot Tone is not directed at children and we do not knowingly collect anything from anyone under 16.
If this notice changes materially we will say so on spottoneapp.com and, for license holders, by email to the address the license was bought with.
support@spottoneapp.com · Cary Norton LLC, Birmingham, Alabama
Version 2026-10-10 · questions to support@spottoneapp.com