Privacy Policy

The short version

1. Who we are

twoplus11 is the trading name of twoplus11 LLC, a single-member limited liability company registered in the State of Missouri, USA — an independent software studio. Where this policy says "we," "us," or "our," it means twoplus11 LLC, which is the data controller for the information described here. We build macOS apps — Viddlr, GifMintr, AltFormr, Stapl, Liftr, Squishr, Trimr, Scrubbr, Heftr, Redlinr, Wakr, Pulsr, Aliasr, Loopr, Diskr, Sweepr, Copyr, WinKeyr, Pingr, Snapr, Blockr, Anchr, Shelfr, Mirrorr, Monthr, and Blinkr — mobile apps (Operations and Tallyr), and custom web applications.

If you have any privacy concerns or questions, reach us through our contact form.

2. Your files stay on your Mac

These apps run entirely on your local machine. Whatever you open, record, convert, compare or scan stays on your computer. None of them:

• Send any usage data or analytics about what you do in the app — nothing any of them transmits describes your files, your folders, or what you did with them (section 3 lists the requests they do make)
• Store any personal information
• Use third-party SDKs, crash reporters, or ad frameworks
• Require an account, a sign-in, or any identifier tied to you

Reading a whole folder, and writing in place. Several of these apps work on a folder rather than a single file, and walk it all the way down: Diskr and Heftr to size what is inside it, Copyr to copy a tree, Aliasr to rename a batch, Sweepr to sort one folder's contents, and Scrubbr, AltFormr, Squishr and Stapl when you hand them a folder of files to process. That reading happens entirely on your Mac, and what they find is never uploaded. Most of them write a new file and leave your original alone, but three can change a file where it stands, and only when you ask for it: Scrubbr has a Replace original (keep backup) option, off by default, which overwrites the file and saves a backup beside it; Trimr writes track tags back into the audio file itself, the way a music library does; and AltFormr strips EXIF and GPS in place when you use its metadata tool. Nothing writes in place silently, and nothing writes outside the files and folders you chose.

Viddlr has the widest network surface of any app we make, because downloading is what it is for. Everything below happens at your instruction and from your own IP address; we have no visibility into any of it.

• It makes direct requests to the video-sharing platforms you point it at (YouTube, Vimeo, TikTok, and the rest) to fetch the content you asked for.
• It fetches thumbnail images from img.youtube.com to illustrate a YouTube link in the queue and in your history.
• If you enable sponsor-segment skipping, it asks the SponsorBlock community API (sponsor.ajay.app) which parts of a video to cut. That is a third-party service with its own privacy policy.
• It bundles the open-source yt-dlp tool and can update it when you press its update button; that download comes from the yt-dlp project's own distribution, not from us.
• An optional proxy. If you enter a proxy address in Settings, Viddlr routes downloads through it. Nothing else is routed through it — not the version check, not the license check, not SponsorBlock.
• A local bridge for the browser extensions. Viddlr listens on 127.0.0.1 (ports 8765 and 8766) so its Chrome, Safari and Firefox extensions can hand it a link from the page you are on. That listener accepts connections only from your own machine and is never reachable from the internet A small background helper keeps that port open so the extension still works when Viddlr is closed; it is a login item you can switch off in Settings, which removes it. If Viddlr cannot be reached at all, the link waits in a file on your own Mac (at most 50, discarded after a day) and is queued the next time Viddlr starts.
• Browser cookies are opt-in and off by default. Viddlr can read cookies from a browser you choose, or from a cookies.txt file you point it at, so that a video you are entitled to watch while signed in can be downloaded. This is a switch you have to turn on yourself. Cookies are handed to yt-dlp for that download and nothing else; they are never sent to us, never written anywhere by Viddlr, and turning the switch off stops it immediately.

GifMintr records your screen entirely on your Mac. Screen recordings stay exclusively on your device and are never transmitted anywhere. Its only network requests are the two in section 3 — the version check, and the license check if you have entered a business key.

AltFormr converts your files entirely on your Mac, using your computer's own processing. Your files never leave your device.

Stapl performs every PDF operation — merging, splitting, compression, OCR, redaction, and the rest — locally on your Mac. Nothing you open in Stapl is ever uploaded. Its only network requests are the two in section 3 — the version check, and the license check if you have entered a business key.

Liftr removes and replaces image backgrounds entirely on your Mac, using Apple's on-device Vision model and a bundled CoreML model. Nothing you open or export is ever uploaded.

Squishr compresses video entirely on your Mac, using a bundled encoder and your computer's own hardware. Your videos never leave your device.

Trimr trims and edits audio entirely on your Mac. Editing produces a new file; the one exception is the Tags panel, which writes track title, artist, album and artwork back into the audio file itself — in place, the way a music library does — because that is what editing a tag means. Your files never leave your device.

Scrubbr reveals and strips hidden metadata (location, author, camera details, tracked changes) from photos, PDFs, and Office documents entirely on your Mac. By default it writes a clean copy alongside the original and leaves the original untouched. There is an off-by-default Replace original (keep backup) option: turn it on and Scrubbr overwrites each file with the cleaned version and saves a backup named “<name> (original)” beside it. Either way, nothing is uploaded.

Heftr analyzes what's taking up space in a file or folder and offers a smaller copy where one is available, entirely on your Mac. Your files never leave your device.

Redlinr compares two documents and produces a redline entirely on your Mac. Contracts, leases, and offers are never uploaded to a web diff tool — the comparison runs locally and your documents never leave your device.

Wakr keeps your Mac awake using the operating system's own power-management assertions. It reads and writes nothing beyond that, and has no access to your files.

Pulsr reads CPU, memory, network, disk and battery counters from the operating system's own APIs to draw its menu bar glyphs and popover. Those readings stay on your Mac — none of them are recorded to disk or transmitted anywhere, and Pulsr has no access to the contents of your files.

Aliasr renames the files you drop into it, on your Mac. It reads file names — and, when you use the EXIF date token, a photo's embedded capture date — only to compute and preview the new names. Rule presets and undo logs are stored locally in ~/Library/Application Support/Aliasr; nothing is uploaded, and Aliasr never reads the contents of your files.

Loopr turns the still images you drop into it into a looping GIF, entirely on your Mac. It reads only those image files; your images are never uploaded, and its settings are stored locally in ~/Library/Application Support/Loopr.

Diskr maps what is taking up space on your disk, entirely on your Mac. A scan reads only filesystem metadata — item names, and how many bytes each one actually occupies on the volume — and never opens or reads the contents of your files; it moves something to the Trash only when you explicitly ask it to. Because Diskr is not sandboxed, macOS asks your permission the first time a scan reaches a protected folder such as Desktop, Documents, or Downloads, and granting Full Disk Access in System Settings lets it size those locations without prompting — that permission is between you and your own Mac, and tells us nothing. Nothing about your files — names, paths, or sizes — is ever uploaded. Diskr accepts a business license key in the app; with no key entered, its version check is the one and only request it makes to us.

Sweepr tidies a single folder you point it at, entirely on your Mac. It reads the names, extensions, sizes and dates of the items in that one folder in order to sort them into piles, and shows you the whole plan before anything moves. It moves files; it has no delete code path and never overwrites, and every sweep can be undone. Nothing about your files — names, paths, or contents — is ever uploaded.

Copyr copies files from one place to another, entirely on your Mac. It reads the files you ask it to copy and writes them where you tell it to, keeping a local record of a job's progress so it can resume after an interruption; if you enable verification it reads both copies back to compare them. That record, and any end-of-job report of files it could not read, stay on your machine. Nothing about your files — names, paths, sizes, or contents — is ever uploaded.

WinKeyr remaps keyboard shortcuts, entirely on your Mac. macOS requires Accessibility access before any app can see key events, and WinKeyr uses that access for one purpose: deciding whether the chord you just pressed matches one of its rules and, if it does, passing on the macOS equivalent instead. Keystrokes are rewritten in memory and are never recorded, written to disk, or transmitted — WinKeyr keeps no log of what you type, and keys pressed in an app you have excluded are passed through untouched. Your settings, including which rules are switched on and which apps are excluded, stay in its preferences on your own machine.

Pingr archives the notifications macOS delivers to your Mac, entirely on your Mac. macOS deletes each notification record as soon as it is dismissed, so Pingr copies the app name, title, subtitle, body and timestamp into its own database before that happens. It requires Full Disk Access — the only permission macOS offers that reaches the notification container — and it opens Apple's notification store strictly read-only, never modifying it. That archive may include one-time codes and message previews; it is a single database file in your own Library folder, kept for a retention period you choose and pruned automatically, and excluding an app both stops it being recorded and deletes what was already stored from it. One-time codes are detected on your Mac, and a detected code reaches your clipboard only when you click it. Nothing about your notifications is ever uploaded.

Snapr moves and resizes windows, entirely on your Mac. macOS requires Accessibility access before any app can move another app's windows, and Snapr uses that access to read a window's position and size and to set a new one. It does not read window contents, and window titles are never recorded or transmitted. Your settings and any layouts you save — each recording a window's owning application and its proportional frame — stay in Snapr's preferences on your own machine. Nothing about your windows is ever uploaded.

Anchr chooses which audio device your Mac uses, entirely on your Mac. It reads the list of devices your Mac can see — each one's name, how it is connected, and how many input and output channels it has — and sets which of them macOS treats as the default for output, for the microphone, and for system sounds. It never opens an audio stream. It asks for no permission of any kind, and in particular it has no microphone access and contains no code that could record from one: it chooses which microphone your other apps record from, and never uses one itself. Your device preferences, and the last-seen names of devices you have used, stay in Anchr's preferences on your own machine. Nothing about your audio devices is ever uploaded.

Mirrorr copies your entire disk to a second drive, entirely on your Mac. It reads the files on the source volume you choose and writes them to the destination you point it at, preserving metadata and permissions. If you set up a schedule, it remembers the source, destination and times in its own preferences. Its backup service runs as a privileged helper so it can copy system files and start before anyone logs in; it needs Full Disk Access for the same reason. Nothing about your files, your drives, your schedule or your backups is ever uploaded. Mirrorr accepts a business license key in the app; with no key entered, the license request described in section 3 never happens from Mirrorr at all.

Monthr makes a printable photo calendar, entirely on your Mac. It reads the image files you drop onto a month — to lay them out and to embed them in the PDF you export — and remembers their paths so it can reopen your calendar next time; your originals are never modified, moved, renamed or deleted. If you switch on "Birthdays from Contacts", macOS asks your permission and Monthr reads exactly two fields, name and birthday: no phone numbers, no email or postal addresses, no photos, no notes, and it never writes back to your Contacts. Declining leaves the rest of the app working, and you can revoke access at any time in System Settings ▸ Privacy & Security ▸ Contacts. Its settings and your own annual events stay in ~/Library/Application Support/Monthr. Nothing about your photos, your contacts, or the calendars you make is ever uploaded.

Shelfr puts your ebooks onto a connected e-reader, entirely on your Mac. It reads the book files you add — including the title, author and cover embedded in them — converts between formats locally, and writes the result to a Kindle, Kobo or Nook mounted over USB. It keeps a small library index of file paths, titles, authors and cached cover images in its own Application Support folder, so your shelf survives a relaunch; deleting that folder removes it. No book, filename, cover, title or author is ever uploaded.

Blockr monitors and filters network connections, entirely on your Mac. It sees which application opened a connection and the remote host and port it was going to. It does not decrypt or proxy your traffic, and it never reads the contents of the connections it filters — with one narrow, switchable exception described below. Blockr keeps that record, your rules and your per-app totals on your own machine so they survive a relaunch; none of it is transmitted to us or to anyone else, and you can clear it at any time from Settings. Blockr installs a network filter system extension, which macOS asks you to approve once. Optionally it performs reverse-DNS lookups so that raw IP addresses read as hostnames; those queries go to whichever DNS resolver your Mac already uses, only for addresses you are already connecting to, and the feature can be switched off in Settings.

Blockr's blocklists. If you subscribe to a blocklist, Blockr downloads it directly from that list's own publisher — StevenBlack, oisd, HaGeZi or 1Hosts — at most once a day. Those are requests to their servers, not ours: they see your IP address the way any website you visit does, under their own privacy policies, and we never see that you subscribed or which list you chose. We do not host, mirror, bundle or proxy any list. Nothing is subscribed by default, and unsubscribing stops the downloads immediately.

Blockr and DNS. When a blocklist is switched on, Blockr reads the DNS replies passing through the filter — only on port 53, only the question and the addresses in the answer — so that a connection arriving as a bare IP address can be matched against lists that are written as names. This happens in memory on your Mac, is never written to disk, and is never sent anywhere; what it remembers is discarded within minutes. It is the one case where Blockr looks inside a connection rather than at its endpoints, it applies to nothing but DNS, and it can be switched off in Settings ▸ Blocklists, where it is described in the same terms. Encrypted DNS is invisible to it, as it is to every filter of this kind.

The only thing Blockr ever sends us is its weekly check for a new version, described in section 3; it carries nothing about your traffic, your rules or your Mac, and you can switch it off. Blockr accepts a business license key in the app; with no key entered, the license request described in section 3 never happens from Blockr at all.

Blinkr reminds you to rest your eyes, entirely on your Mac, and it asks for no macOS permission of any kind — not Accessibility, not Screen Recording, not the camera. To decide when a break is due, and when showing one would be rude, it reads exactly four signals, none of which says anything about what you are doing: how long it has been since you last touched the keyboard or trackpad (a duration, never which keys — Blinkr cannot see what you type); whether any camera or microphone is currently in use, which is the same yes/no flag the menu-bar green dot is drawn from and gives it no video or audio; whether a window covers a whole display, which is geometry only and never a window's title or contents; and whether the screen is locked. It keeps a small daily tally of breaks taken and skipped, plus your settings, in its own preferences on your machine, pruned after 90 days. Nothing about your breaks, your habits or your screen is ever uploaded. Blinkr accepts a business license key in the app; with no key entered, its version check is the one and only request it makes to us.

3. What an app sends us

There are two routine requests any of our apps makes to a twoplus11 server. One happens in every app; the other happens only if you have entered a business license key. (If you accept an update, downloading it is a third — the installer comes from us as well.) Nothing else is ever sent to us, and none of it carries your files, your folders, or anything about what you did in the app.

The update check — what it does. The app asks our server for a small file listing the current version. If that version is newer than the one you have, the app downloads it and installs it in the background, and the new version takes effect the next time you launch. Every update is cryptographically signed and one that does not verify is refused. Switching automatic checking off in the app's own settings stops all of it — the check, the download and the install — and you can still check by hand whenever you like.

What it sends. The app's version number and a short label naming the app and the update framework, and — as with any request to any website — your IP address. That is the whole of it. It does not send your name, your email address, an account identifier, your license key, a list of your files, or anything at all about how you use the app.

How often. The check runs on its own at most once a week, quietly in the background, and again whenever you ask for it by hand.

Where it goes, and what we record. Every one of our apps now checks with api.twoplus11.com, and we log every check: which app it was, the version it reported, whether the check came from the app's own checker or from Sparkle, the platform, the date, the user-agent string of the request, and a salted hash of your IP address — never the address itself. We do this for one reason: to see roughly how many people still run each app, so we know which ones are worth continuing to maintain. If you go on to install the update, that download is counted the same way, in the same shape.

What that record can and cannot tell us. It is not tied to a name, an email address, an account, or a license key, and there is no installation identifier, so we cannot work out who you are. The IP hash is re-salted every day: two checks from the same address on the same day look alike to us, which is what stops one machine being counted twice, while checks on different days cannot be linked to each other at all. We do not combine this with anything else, and we do not build a profile from it.

Turning it off. Automatic checking can be switched off in each app. Doing so limits no feature — you can still check by hand whenever you like, and the app goes on working indefinitely either way.

The business license check. This one is different in kind from the update check, so it is worth being exact about it.

It happens only if you have entered a license key. With no key stored, the app never contacts our licensing server at all — not at launch, not ever. Personal use is the complete app, and it is entirely offline in this respect.

Every app makes it. This was not always true: until the 2026-08-20 release, Blockr, Diskr, Copyr, WinKeyr, Pingr, Snapr and Anchr had no way to enter a key at all, and their License button simply opened a web page. Blinkr was the same until its own first release, and is listed here for the same reason — a policy that quietly rounded it up to "every app" would have been describing a request it could not yet make. All of them now accept a key in the app, so the check described here applies to every app we make — and, as above, only ever once you have entered one.

What it sends. A POST to api.twoplus11.com/api/v1/license/validate containing five things:

• which app it is for, a short product code such as anchr, which the endpoint needs

in order to know which license it is being asked about;

• the license key you entered;
• a machine fingerprint — a SHA-256 hash of your Mac's hardware serial number, truncated, which is stable for that machine and is what makes one key equal one device;
• the app's version number;
• a device name — only what you typed into the "Name this computer" box, and nothing at all if you left it empty. Nothing is ever substituted for a name you did not give: not your Mac's Sharing name, not its host name, not your account name. This is the one item here that can identify you or your organization, because people name their computers after themselves — which is exactly why it is yours to give or withhold. You can change it, or clear it, whenever you like: clearing the box removes the name from the next check rather than leaving the old one in place.

It does not send a file list, your usage, your other apps, or anything you did in the app.

Removing a license also contacts us. Taking the license off a Mac sends a DELETE to

api.twoplus11.com/api/v1/license/activation carrying the key and the same machine

fingerprint, and nothing else, so that the seat is freed for another machine. It is the

only other request the license check makes, and it is the reason removing a license in

the app is better than simply deleting the key: the seat comes back.

How often. Roughly once a day while you are online — not once at activation. A successful result is cached for 24 hours and the app revalidates after that. If our server cannot be reached, the app keeps honoring the cached result for a 72-hour grace period, so a bad connection does not stop you working.

What we keep, and for how long. For each seat we store the machine fingerprint, the device name, the app version, and the times we first and last saw it, attached to the license key and so to the purchasing organization and its contact email. Unlike the update-check log, this record is identifiable — that is inherent to per-device licensing. We keep it for as long as the license is active, and we use it only to enforce the seat count and to support you. It is never used for analytics, never combined with the update-check log, and never shared.

4. What we collect when you deal with us

Beyond the two app requests in section 3, everything else we hold comes from something you chose to do on this site. Here is each surface, what it keeps, and how long we keep it. Section 7 says who processes it for us.

• Buying a license. Your email address, the organization name you give at checkout, the apps and number of seats you bought, and the Stripe payment reference. We do not see or store your card number. Kept for as long as the license is valid, and then for seven years for tax records.
• Activating a license. For each machine you activate: the machine fingerprint, the device name you typed, the app version, and when we first and last saw it (section 3). Kept for as long as the license is valid.
• Leaving a tip. Stripe collects your card details and gives us the amount, and the name and email address you entered on its page. We store those and send you one thank-you email. Kept for seven years, because tips are income we account for.
• Report an Issue. Your message, the app, version and operating system you named, an email address if you gave one, a screenshot if you attached one (stored in Microsoft Azure Blob Storage), your browser's user-agent string, and a hash of your IP address. Kept for 90 days after the report is closed.
• Contact form. Your name, email address, an optional phone number, the topic and your message, your user-agent string, and a hash of your IP address. Kept for 12 months.
• New-app emails (newsletter). Your email address, which page you signed up from, your user-agent string, a hash of your IP address, and the dates you confirmed and unsubscribed. Kept until you unsubscribe; an unsubscribed address is marked so we never mail it again.
• Reviews. The name you give, your review text, a rating, and the platform. Your name is published beside the review once we approve it. Kept for as long as the review is published; ask and we will take yours down.
• Update and download counters. Each version check, appcast fetch, update download and Download button click records the app, the version, the platform, the date, your user-agent string, and a hash of your IP address that changes every day (section 3). Kept for 13 months.
• Website analytics. Described in section 5. Kept for 13 months.

We never use a purchase or tip email for marketing without your explicit opt-in, and we never sell, rent, or share any of the above.

5. This website (twoplus11.com)

No third-party scripts, and no cookies of our own. Every script this site loads comes from twoplus11.com itself: no third-party analytics service, no advertising network, no social widgets, no fonts from someone else's server. twoplus11.com sets no cookies. There is nothing to consent to, which is why you will not find a cookie banner. (Our API at api.twoplus11.com runs on Microsoft Azure, whose load balancer may attach a session-affinity cookie named ARRAffinity to its responses; it carries no identifier we read and is not used for tracking.)

We do count page views, on our own server. A small first-party script on the home page and the not-found page records that the page was viewed, and which link on it was clicked, and sends that to api.twoplus11.com. What is stored is the page path, the type of event, the link that was clicked, the referring page, the date, the user-agent string, and a salted hash of your IP address that changes every day: never the address itself, and never your location. There is no cookie, no fingerprint, and no identifier that survives the day. The script honors the Global Privacy Control and Do Not Track signals: if your browser sends either, it sends nothing. Obvious bots are filtered out. We use it to see which pages people actually reach; it is never sold, shared, or joined to anything else, and blocking it changes nothing about how the site works.

The Download button is counted. Every Download button on this site points at api.twoplus11.com, which hands you the installer and records the click: the app, the platform, the date, your user-agent string, and the same daily-changing hash of your IP address. The download counter on the home page reads that store.

Hosting. The pages of this site are served by Hostinger, which may retain standard server-access logs (IP addresses, requested URLs, timestamps) as part of normal hosting operations; those logs are outside our direct control and are governed by Hostinger's own privacy policy. api.twoplus11.com, which receives the app requests in section 3, the Download clicks, the page-view counter and every form on this site, is our own service and runs on Microsoft Azure in the United States.

6. Subdomains and other services

Other services we build and run — such as Claytonia (claytonia.twoplus11.com) and Midwest Feline Medical Center (midwestfeline.com) — are separate applications with their own data handling. Their respective privacy terms apply when you use those services.

7. How long we keep it, and who processes it

Retention. Section 4 gives the period for each thing we hold. In short: license purchase and activation records for as long as the license is valid, and purchase records for seven years after that for tax; tips for seven years; issue reports for 90 days after they are closed; contact messages for 12 months; newsletter addresses until you unsubscribe; reviews while they are published; update, download and page-view counts for 13 months. When a period ends the record is deleted. If you would like something deleted sooner, contact us and we will remove it promptly; deleting a license record deactivates the license.

Processors. These companies handle data for us, each under its own privacy policy and only for the purpose named:

• Stripe: payment processing for licenses and tips. Stripe sees your card details; we never do.
• Microsoft Azure (United States): hosts api.twoplus11.com, its database, and the screenshots attached to issue reports.
• Google: delivers the email we send you (license keys, thank-you notes, replies, newsletter mail).
• Hostinger: serves the pages of this site.
• SponsorBlock (sponsor.ajay.app): only if you turn on sponsor-segment skipping in Viddlr, and then Viddlr talks to it directly from your Mac (section 2). We never see those requests.

We do not sell personal data, and we do not share it with anyone else.

8. Your rights

You have the right to:

• Request access to any personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data

To exercise any of these rights, reach us through our contact form. We'll respond within a reasonable timeframe.

9. Children's privacy

Our apps and services are not directed at children under 13. We do not knowingly collect personal data from children.

10. Changes to this policy

If we make material changes to this policy, we'll update the effective date at the top of this page. We won't quietly expand data collection — if anything changes, it will be stated clearly here.

11. Contact

Privacy questions, data requests, or anything else: reach us through our contact form.