MachOne — Privacy Policy

What MachOne Sends Over the Network

MachOne contacts other servers only in the situations below. Each one says what the other side receives.

1. Filter Lists. MachOne downloads its blocking rules from the public filter-list servers below when you open MachOne (on iPhone and iPad, also when you switch back to it) and its lists are more than 12 hours old, missing or due to be rebuilt after an app update; when you tap “Update Filter Lists”; and when MachOne Pro or your custom lists change. There is no background schedule, but on a Mac, MachOne adds itself to your login items the first time it opens, so it also opens (and can update) each time you log in.

MachOne also downloads the regional lists that match the languages set on your device, from the same servers, and any custom filter list you have added, from the address you entered. MachOne downloads only over secure (HTTPS) connections; if a server sends it on to another secure address, MachOne follows. Like any server you connect to, these servers receive your IP address, the file requested, a generic MachOne/1.0 User-Agent and the standard headers your device adds to every download, including your preferred language. MachOne sends no cookies and nothing else about you, your device or your browsing.

2. The Protection Benchmark — Only When You Run It. When you tap “Run Benchmark” (or “Run Again”), MachOne opens a hidden web view that saves no cookies or cache and requests 38 known ad, analytics, social, session-recording and cryptomining addresses — once with MachOne’s rules off and once with them on. It then requests any address that got through again, once for each of MachOne’s rule sets. Those servers receive an ordinary web request from your device: your IP address and the standard details a web view sends, such as its user agent and your preferred language. Some of those services have shut down, and their addresses may now belong to someone else. MachOne sends nothing it knows about you. The results stay on your device (see “What Is Stored on Your Device”) unless you share your score. The benchmark never runs unless you start it.

3. Looking Up Disguised Trackers. Some trackers use an address that looks like part of the site you’re on (for example, metrics.example.com) but actually leads to a tracking company. A web page can’t see where an address leads, so while you browse, MachOne’s Safari extension asks your device’s DNS service, making the same kind of lookup your device makes to open any address. On each page, it looks up at most 8 addresses it hasn’t already checked, taken from addresses that page uses or lists. This also happens on sites where you paused MachOne. Whatever DNS service your device or network is set to use (often your internet provider’s) receives each address looked up, as it does for every other lookup. MachOne keeps each address and its answer on your device so it doesn’t ask again for 7 days; older answers are removed the next time it looks something up.

4. Apple. MachOne no longer sells anything, but when it opens it may still ask the App Store about MachOne’s earlier in-app purchases, including whether you bought MachOne Pro. Apple handles that request (see Payments).

5. Links You Tap. The Privacy and Terms links open this website, and the links in Acknowledgments open the websites of the projects MachOne credits. Report a Mistake opens a new message to me in your own email app, with only the subject filled in; nothing is sent unless you send it. The share buttons open your device’s share options with a link to MachOne or an image of your benchmark score; nothing is shared unless you pick where to send it.

What the Safari Extensions Can See — and What They Do With It

Safari warns that MachOne’s web extension has access to the webpages you visit. Here is exactly what that access is used for:

• Hiding ads, leftover ad slots, cookie banners and pop-ups, and pressing a cookie banner’s own Reject button when it has one (the site records that choice as if you had pressed it). MachOne never presses Accept. When a notice covering the page has no Reject button, MachOne presses the notice’s own close button (such as Close or “No Thanks”) if it has one, or removes the notice.
• Removing ads that filter lists leave alone, such as ads served from the site itself, checking that the page still works, and undoing any removal that breaks it
• Removing video ads, including by taking the ad parts out of the video information a page loads (for example, on YouTube)
• Stopping known tracking scripts and blocking tracker requests the filter lists miss, including disguised trackers, and disguising canvas, WebGL and audio fingerprints in frames embedded in the page
• Blocking pop-unders and some extra windows a page tries to open
• Deleting known cross-site ID values that ad scripts save in a site’s own storage
• Stripping tracking parameters from links you click
• Removing messages that ask you to turn off your ad blocker, on YouTube and on other sites
• When you open the MachOne popup in Safari, reading the page’s links to point out ones whose text is a web address different from the one the link opens. Nothing from this is saved.
• Counting what was blocked, for the numbers in Safari and the totals in the MachOne app, and keeping the extension check-in and troubleshooting notes listed below

All of this happens inside Safari on your device, and nothing a page contains is sent to me. When MachOne removes a cookie, sign-up or ad-blocker notice covering a page, it skips any notice showing a password box, so sign-in forms stay in place; its scripts don’t read what you type. A few facts about the pages you visit, such as the last page’s address and the names of recent sites, are kept on your device, as listed under “What Is Stored on Your Device.” The only thing from a page that leaves your device is the disguised-tracker lookup described above. MachOne’s content blockers (the rule-based parts) work inside Safari’s content-blocker system, which by design doesn’t let them see your browsing at all.

What Is Stored on Your Device

MachOne keeps the following on your device, in the MachOne app’s own storage, in storage shared by the app and its Safari extensions, and in the storage Safari keeps for MachOne’s web extension. MachOne sends none of it to me or to anyone else.

• Filter Lists: the downloaded lists, the rules built from them, rule counts, update times, a record of which downloads passed MachOne’s safety checks, whether Safari loaded the rules, and a copy of MachOne’s extra hiding rules in Safari’s storage. Replaced at each update.
• Your Choices: the sites where you paused MachOne, any custom filter list addresses you added, whether MachOne Pro is unlocked, whether you finished setup and, on a Mac, whether MachOne has already added itself to your login items.
• Totals: lifetime counts of what MachOne blocked, the 40 tracker addresses it blocked most and, for the last 24 times it blocked trackers, the top tracker address, how many it blocked and when (not the page itself).
• Extension Check-In: the full address of the last page where MachOne’s web extension ran, the site each of its page scripts last ran on, and when, so the app can show the extension is working. Replaced as you browse, including on sites where you paused MachOne.
• Recent Sites: the names of up to 12 sites you visited where MachOne blocked trackers, each with up to 8 of the tracker addresses blocked there, how many times each was blocked, and when. Entries more than 6 hours old are removed the next time a new one is added.
• Disguised-Tracker Lookups: up to 512 addresses MachOne looked up, each with whether it leads to a tracking company and, if it does, which address it leads to (see above).
• Ad Removal: the names of up to 96 sites where removing ads kept breaking the page, so MachOne stops trying there for 14 days.
• Troubleshooting Notes: the names of the last few sites and embedded pages you opened, with short technical notes on how MachOne’s page scripts behaved there, such as which parts of a page they hid and which ad-like addresses the page requested. Only the latest few are kept (at most 8 of each kind), and some are recorded on sites where you paused MachOne too.
• Benchmark Report: your last benchmark’s results, with your device type (such as iPhone or Mac), system version and memory size. Replaced each time you run it.
• Prompts: how many separate times you’ve opened MachOne and when it last asked you for a rating, and how many times the MachOne Pro offer in Safari was shown or tapped.

MachOne doesn’t treat Private Browsing differently. If you allow MachOne’s web extension in Private Browsing, the browsing-related items above (everything from Totals through Troubleshooting Notes, plus the MachOne Pro offer counts) are also recorded from private windows, and they stay after you close those windows.

Deleting Your Data

On iPhone and iPad, deleting MachOne deletes its own storage and the storage it shares with its extensions. On a Mac, moving MachOne to the Trash doesn’t delete that data: it stays in MachOne’s folders inside the Containers and Group Containers folders in your Library folder (the shared one is VMMUVZA6D2.group.com.corbintucker.Cloak), and you can delete those folders yourself. The storage Safari keeps for MachOne’s web extension (paused sites, ad-removal memory and some troubleshooting notes) is managed by Safari. To stop MachOne from recording anything new from your browsing, turn its extensions off in Safari’s settings. Apart from emails you send me, I have no copy of any of this, so there is nothing else for me to delete.

Emails You Send Me

If you email me, including with Report a Mistake (which opens a new message in your own email app with only the subject filled in), I receive your email address, the name your email app shows and whatever you write or attach. I use it only to reply to you and to improve MachOne, and I don’t share it with anyone unless the law requires it. My email is hosted by Apple’s iCloud Mail. I don’t delete messages on a schedule, and I delete yours whenever you ask.

No Tracking, No Profiles, No Sale of Data

MachOne doesn’t track you across apps or websites, I build no profile of you, and I never sell your personal information or share it for advertising. The only personal information I ever receive is an email you choose to send me, and wherever you live, you can ask me to see, correct or delete it.

Other Companies

I don’t share your personal data with any company. The companies MachOne’s connections reach (the filter-list servers, including any you add, the addresses the benchmark tests, your DNS service and Apple) receive only what those connections carry, as described above, such as your IP address and the addresses looked up, and they handle it under their own privacy policies.

Children

MachOne doesn’t collect information from anyone, including children: nothing it keeps on your device is sent to me. If a child has emailed me, a parent can ask me to delete the message, and I will.

Payments

MachOne is free, and it no longer sells MachOne Pro or tips. Those earlier purchases were sold by Apple through the App Store, and Apple handled all payment details. I never see your payment details, name or Apple Account. Apple gives me sales and download reports that don’t identify you. If “Share With App Developers” is turned on in your device’s analytics settings, Apple also gives me crash reports and usage statistics, which Apple says are aggregated or don’t identify you. MachOne may ask you to rate it with Apple’s standard rating prompt; ratings and reviews go to Apple, and reviews are public. Apple’s handling of this data is governed by Apple’s Privacy Policy.

This Website

This website is hosted by Netlify and loads its fonts from Google Fonts, so both receive your IP address and browser details when you visit. On iPhone and iPad, Safari may also ask Apple for MachOne’s App Store details to show a banner on the home page. The website runs no scripts and sets no cookies. The MachOne app uses neither Netlify nor Google Fonts, except that its Privacy and Terms links open this website.

Changes to This Policy

If this policy changes, the new version will be posted at this address with a new effective date at the top.

Contact

MachOne is made by Corbin Tucker, an independent developer in Georgia, USA. For questions about privacy, or to see or delete an email you sent me: corbintucker@icloud.com