Privacy Policy

Super Shortcuts is local-first and anonymous by default. This page explains what leaves your Mac, what doesn't, the macOS permissions the app asks for, and your rights over your data.

Last updated: July 6, 2026

Super Shortcuts is made by Cmon Labs Inc. ("we", "us"). For privacy purposes we are the data controller for the personal data described here. Our contact details are at thebottom of this page.

The macOS app

Your workflows and your voice stay on your Mac. The app needs no account and stores no email to use. Your commands aren't uploaded to us - there's no black box and no cloud sync of your workflows. Voice is transcribed on-device with a local Whisper model; audio is never persisted and never sent anywhere. (The voice models themselves are downloaded on demand from Hugging Face the first time you turn voice on.)

Workflows, settings, and usage history live in a local database on your Mac. Regardless of any setting below, these things never leave your machine as part of any report or event:

• Voice transcripts or any recognized speech
• Workflow names, descriptions, or contents
• What you type, the URLs you open, or file paths
• Foreground app names, window titles, or browser page contents
• Clipboard contents
• Your name, email, or any hardware serial number

App analytics & diagnostics

To improve the app we use two small, separate channels - plus local logs that never leave your Mac. You can change both choices anytime inSettings → General → Privacy & Telemetry.

macOS permissions

Super Shortcuts is a non-sandboxed, notarized app. To drive your other apps it asks for the standard macOS automation permissions, and explains each one before you grant it:

• Accessibility - lets the app send keystrokes and read the on-screen UI state it needs to run a command in the app you're in.
• Automation (Apple Events) - for workflows scoped to a website, the app reads the URL of your frontmost browser tab so a command (e.g. one meant for github.com) only fires on matching pages. It does not read page contents.
• Microphone - only if you use voice commands; audio is transcribed on-device and discarded.

You can revoke any of these anytime inSystem Settings → Privacy & Security.

Super Shortcuts Pro & licensing

If you buy Pro, checkout and payment are handled byLemon Squeezy, our Merchant of Record - they collect your name, email, and billing details on their own checkout page. We never see or store your card number.

To activate your license on a Mac (up to 3 devices), the app contacts our licensing API and sends a one-way hash of a hardware identifier(the "machine ID"), a friendly device model such as "MacBook Pro", and the app version. We deliberately do not send your Mac's name (which is often a person's name), serial number, or raw hardware UUID. Your license key is verified and stored only as a hash - never in the clear - and the signed license token on your Mac contains no personal data, so Pro keeps working offline.

Feedback you send

If you use the in-app feedback form, we receive your message and, only if you choose to add them, your email address (so we can reply) and an opt-in diagnostics summary. We use this solely to answer you and improve the product.

This website

If you sign up for email updates, we store the address you submit (via our API and our email provider) so we can send the occasional product update. We don't sell or rent it, and you can unsubscribe or ask us to remove it at any time. We use a bot-protection check to keep spam off the form; it briefly processes your IP for that purpose. The "Download" and "Buy now" buttons simply redirect you - to our update host and to our payment provider's checkout, respectively.

Cookies & website analytics

To understand how the site is used and improve it, we measure aggregate website usage with Google Analytics 4 and PostHog. These set analytics cookies on your device, so we ask for your consent first. We record events like page scroll depth and which links get clicked - never anything that identifies you personally. We run no advertising, set no advertising cookies, and don't build cross-site advertising profiles.

Your choice, by region. If you're in the EU/EEA, the UK, or Switzerland, analytics stays off until you click Accept on the cookie banner - choose Reject and no analytics cookies are set. Elsewhere, analytics is enabled by default under an opt-out model. Either way you can change your mind anytime: use Cookie settings in the footer to re-open the banner and grant or withdraw consent. Strictly necessary storage (like remembering that choice) is exempt and always used.

Who processes your data

We keep the list of third parties ("sub-processors") small, and only use ones that handle data on our behalf under contract:

This list is current as of July 6, 2026, and we'll update it as our providers change. Two US-based providers also work behind the scenes: a cloud hosting and security service that runs our website and app, and an email service that sends product-update and support messages.

Data location & how long we keep it

• Website analytics (Google Analytics 4 and PostHog) are processed in the United States, so for EU/EEA/UK visitors this involves a transfer to the US - which is why we only collect it with your consent. Events are aggregate and retained up to 14 months (GA4) then discarded; IP addresses are not stored for reporting.
• App analytics are stored in PostHog's EU region and retained for up to 3 years to support long-horizon retention analysis, then discarded. IP addresses are minimized/not stored.
• Email-update, licensing, and feedback data are stored in our database and kept while they're needed for that purpose (to email you, validate your license, or follow up). We delete them on request.
• On your Mac, the app keeps detailed usage for 90 days plus lifetime aggregates, fully under your control. Uninstalling removes it.

Your rights

Depending on where you live, you have rights over your personal data. We honor these regardless of location.

If you're in the EU/EEA or UK (GDPR): you can request access to, correction of, deletion of, or a copy of your data; you can object to or restrict certain processing; and you can withdraw consent at any time - for website analytics via Cookie settings in the footer, and for in-app product analytics by toggling it off (withdrawal doesn't affect anything already lawfully processed). Our legal bases are your consent (website and app analytics), our legitimate interest in a stable, secure product (crash diagnostics, anti-abuse), and performing our contract with you (licensing).

If you're in California (CCPA/CPRA): you have the right to know what we collect, to delete it, to correct it, and to opt out of "sale" or "sharing." We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

You can act on most of this yourself at any time: grant or withdraw website-analytics consent via Cookie settings in the footer, turn app analytics on or off and disable crash diagnostics in the app's settings, unsubscribe from emails, or remove a device from your license. For anything else - access, deletion, or a copy of your data - email[email protected]and we'll take care of it. You also have the right to complain to your local data protection authority.

Children

Super Shortcuts is a tool for professionals and isn't directed at children. We don't knowingly collect data from anyone under 16.

Changes to this policy

If we change how we handle data, we'll update this page and its "last updated" date, and disclose material changes in the app before they take effect.

Contact

Questions about privacy or permissions, or want to exercise a right above? Email[email protected].