MachOne — Privacy Policy

What MachOne Sends Over the Network

MachOne contacts other servers only in the situations below. Each one says what the other side receives.

1. Filter Lists. MachOne downloads its blocking rules from the public filter-list servers below when you open MachOne (on iPhone and iPad, also when you switch back to it) and its lists are more than 12 hours old, missing or due to be rebuilt after an app update; when you tap “Update Filter Lists”; and when MachOne Pro or your custom lists change. There is no background schedule, but on a Mac, MachOne adds itself to your login items the first time it opens, so it also opens (and can update) each time you log in.

If you have MachOne Pro, MachOne also downloads the regional lists that match the languages set on your device, from the same servers, and any custom filter list you have added, from the address you entered. MachOne’s own rules come built into the app, so nothing is downloaded for them. MachOne downloads only over secure (HTTPS) connections; if a server sends it on to another secure address, MachOne follows. Like any server you connect to, these servers receive your IP address, the file requested, a generic MachOne/1.0 User-Agent and the standard headers your device adds to every download, including your preferred language. MachOne sends no cookies and nothing else about you, your device or your browsing.

2. The Protection Benchmark — Only When You Run It. When you tap “Run Benchmark” (or “Run Again”), MachOne opens a hidden web view that saves no cookies or cache and requests 38 known ad, analytics, social, session-recording and cryptomining addresses — once with MachOne’s rules off and once with them on. It then requests any address that got through again, once for each of MachOne’s rule sets. Those servers receive an ordinary web request from your device: your IP address and the standard details a web view sends, such as its user agent and your preferred language. Some of those services have shut down, and their addresses may now belong to someone else. MachOne sends nothing it knows about you. The results stay on your device (see “What Is Stored on Your Device”) unless you share your score. The benchmark never runs unless you start it.

3. Looking Up Disguised Trackers. Some trackers use an address that looks like part of the site you’re on (for example, metrics.example.com) but actually leads to a tracking company. A web page can’t see where an address leads, so while you browse, MachOne’s Safari extension asks your device’s DNS service, making the same kind of lookup your device makes to open any address. On each page, it looks up at most 8 addresses it hasn’t already checked, taken from addresses that page uses or lists. This also happens on sites where you paused MachOne. Whatever DNS service your device or network is set to use (often your internet provider’s) receives each address looked up, as it does for every other lookup. MachOne keeps each address and its answer on your device so it doesn’t ask again for 7 days, except for addresses looked up from a private window, which it doesn’t keep; older answers are removed the next time it keeps a new one.

4. Apple. When MachOne opens, it may ask the App Store, through Apple’s StoreKit, which version of MachOne you first downloaded (to know whether you had MachOne before version 3.9.4; see Payments) and whether you bought MachOne Pro. If you didn’t have MachOne before 3.9.4, it also asks the App Store for MachOne Pro’s price, and buying or restoring MachOne Pro goes through the App Store. MachOne keeps only the answers on your device: whether you had MachOne before 3.9.4 and whether MachOne Pro is unlocked. Apple handles these requests (see Payments).

5. Links You Tap. The Privacy and Terms links, and on a Mac the MachOne Support item in the Help menu, open this website, and the links in Acknowledgments open the websites of the projects MachOne credits. Support in the app, and Report a Mistake in the app and in the MachOne popup in Safari, open a new message to me in your own email app, already filled in with the details listed under “Emails You Send Me.” In the app, if no email app is set up, they open this website’s support page instead. Nothing is sent unless you send it. The share buttons open your device’s share options with a link to MachOne or an image of your benchmark score; nothing is shared unless you pick where to send it.

What the Safari Extensions Can See — and What They Do With It

Safari warns that MachOne’s web extension has access to the webpages you visit. Here is exactly what that access is used for:

• Hiding ads, leftover ad slots, cookie banners and pop-ups, and pressing a cookie banner’s own Reject button when it has one (the site records that choice as if you had pressed it). MachOne never presses Accept. When a notice covering the page has no Reject button, MachOne presses the notice’s own close button (such as Close or “No Thanks”) if it has one, or removes the notice.
• Removing ads that filter lists leave alone, such as ads served from the site itself, checking that the page still works, and undoing any removal that breaks it
• Removing video ads, including by taking the ad parts out of the video information a page loads (for example, on YouTube)
• Stopping known tracking scripts and blocking tracker requests the filter lists miss, including disguised trackers, and disguising canvas, WebGL and audio fingerprints in frames embedded in the page
• Blocking pop-unders and some extra windows a page tries to open
• Refusing requests inside the page when a page keeps retrying a blocked address many times a second
• Deleting known cross-site ID values that ad scripts save in a site’s own storage
• Stripping tracking parameters from links you click and from the address of the page you open, and skipping redirect links whose only job is to record the click
• Removing messages that ask you to turn off your ad blocker, on YouTube and, with MachOne Pro, on other sites
• When you open the MachOne popup in Safari, reading the page’s links to point out ones whose text is a web address different from the one the link opens. Nothing from this is saved.
• About once an hour, and soon after MachOne updates its rules, briefly adding a few invisible test elements to one page you open and taking them straight back out, to check that Safari is using MachOne’s latest rules (Safari Check). The page’s own scripts could notice them, which is why the check is rare.
• Counting what each of MachOne’s engines did, for the numbers in Safari and in the MachOne app, checking that each part of MachOne is in place on the page, and keeping the check-in, Safari Check results and troubleshooting notes listed below

All of this happens inside Safari on your device, and nothing a page contains is sent to me. When MachOne removes a cookie, sign-up or ad-blocker notice covering a page, it skips any notice showing a password box, so sign-in forms stay in place; its scripts don’t read what you type. A few facts about the pages you visit, such as the names of recent sites and, for each Safari Check, the page’s address without anything after a “?”, are kept on your device, as listed under “What Is Stored on Your Device.” Apart from an email you choose to send me, the only thing from a page that leaves your device is the disguised-tracker lookup described above. MachOne’s content blockers (the rule-based parts) work inside Safari’s content-blocker system, which by design doesn’t let them see your browsing at all.

What Is Stored on Your Device

MachOne keeps the following on your device, in the MachOne app’s own storage, in storage shared by the app and its Safari extensions, and in the storage Safari keeps for MachOne’s web extension. MachOne sends none of it to me or to anyone else.

• Filter Lists: the downloaded lists, the rules built from them and from MachOne’s own built-in rules, rule counts, update times, a record of which downloads passed MachOne’s safety checks, whether Safari loaded the rules, and a copy of MachOne’s extra hiding rules in Safari’s storage. Replaced at each update. MachOne also keeps a log of the last 200 problems it found with its rules, such as a rule Safari couldn’t use, and what it did about them.
• Your Choices: the sites where you paused MachOne, any custom filter list addresses you added, whether MachOne Pro is unlocked, whether you had MachOne before version 3.9.4, whether you finished setup and, on a Mac, whether MachOne has already added itself to your login items.
• Totals: lifetime counts of what MachOne blocked; counts of what each of its engines did, by day for up to 8 days and in total, with when each engine last acted; the 40 tracker addresses it blocked most; and, for the last 24 times it blocked trackers, the top tracker address, how many it blocked and when (not the page itself).
• Extension Check-In: the name of the last site where MachOne’s web extension ran (not the page’s address), the site each of its page scripts last ran on, and when, so the app can show the extension is working. Replaced as you browse, including on sites where you paused MachOne. It also keeps when a page last showed each part of MachOne in place and, if a part was missing, when and on which site.
• Safari Check: the results of the last 200 checks that Safari is using MachOne’s latest rules, each with when it ran and the page it ran on: the site name and the rest of the page’s address up to any “?”, cut to 80 characters. A check runs about once an hour, and again soon after MachOne updates its rules or a check finds a problem, including on sites where you paused MachOne. MachOne also keeps when the last check ran, which rule version it last wrote, when Safari last reloaded each list, and its attempts to fix a list that wasn’t working.
• Recent Sites: the names of up to 12 sites you visited where MachOne blocked trackers, each with up to 8 of the tracker addresses blocked there, how many times each was blocked, and when. Entries more than 6 hours old are removed the next time a new one is added.
• Disguised-Tracker Lookups: up to 512 addresses MachOne looked up, each with whether it leads to a tracking company and, if it does, which address it leads to (see above).
• Ad Removal: the names of up to 96 sites where removing ads kept breaking the page, so MachOne stops trying there for 14 days.
• Troubleshooting Notes: the names of the last few sites and embedded pages you opened, with short technical notes on how MachOne’s page scripts behaved there, such as which parts of a page they hid and which ad-like addresses the page requested. Only the latest few are kept (at most 8 of each kind), and some are recorded on sites where you paused MachOne too.
• Benchmark Report: your last benchmark’s results, with your device type (such as iPhone or Mac), system version and memory size. Replaced each time you run it.
• Prompts: how many separate times you’ve opened MachOne and when it last asked you for a rating, and how many times the MachOne Pro offer in Safari was shown or tapped, and when.

If you allow MachOne’s web extension in Private Browsing, it keeps no site names from private windows: nothing from them goes into the Extension Check-In, Safari Check, Recent Sites, Ad Removal or Troubleshooting Notes, and disguised-tracker answers looked up there are not kept. Counts from private windows still go into the Totals (including the tracker addresses blocked, never the site itself) and the MachOne Pro offer counts, and they stay after you close those windows. A site you pause from a private window is saved like any other paused site.

Deleting Your Data

On iPhone and iPad, deleting MachOne deletes its own storage and the storage it shares with its extensions. On a Mac, moving MachOne to the Trash doesn’t delete that data: it stays in MachOne’s folders inside the Containers and Group Containers folders in your Library folder (the shared one is VMMUVZA6D2.group.com.corbintucker.Cloak), and you can delete those folders yourself. The storage Safari keeps for MachOne’s web extension (such as paused sites, ad-removal memory and some troubleshooting notes) is managed by Safari. To stop MachOne from recording anything new from your browsing, turn its extensions off in Safari’s settings. Apart from emails you send me, I have no copy of any of this, so there is nothing else for me to delete.

Emails You Send Me

If you email me, including with Support or Report a Mistake, I receive your email address, the name your email app shows and whatever you write or attach. Support and Report a Mistake in the app fill in your message with details that help me answer: MachOne’s version and build, your device model (such as “iPhone15,3,” never the name you gave it), system version and language, whether you have MachOne Pro and why, what Safari Check says, the status of each engine, whether each MachOne extension is on in Safari, rule counts, how many custom lists you have, the names of any lists rejected at the last update (a custom list by the name you gave it or its server’s name), which lists, if any, Safari didn’t load, and when the lists last updated. Report a Mistake in the MachOne popup in Safari lists the site you were on (left out in a private window), the links it pointed out (the site name each link’s text shows and the one it opens), MachOne’s app and extension versions and your language. You see all of it in your draft before anything is sent, and you can change or delete any of it. I use it only to reply to you and to improve MachOne, and I don’t share it with anyone unless the law requires it. My email is hosted by Apple’s iCloud Mail. I don’t delete messages on a schedule, and I delete yours whenever you ask.

No Tracking, No Profiles, No Sale of Data

MachOne doesn’t track you across apps or websites, I build no profile of you, and I never sell your personal information or share it for advertising. The only personal information I ever receive is an email you choose to send me, and wherever you live, you can ask me to see, correct or delete it.

Other Companies

I don’t share your personal data with any company. The companies MachOne’s connections reach (the filter-list servers, including any you add, the addresses the benchmark tests, your DNS service and Apple) receive only what those connections carry, as described above, such as your IP address and the addresses looked up, and they handle it under their own privacy policies.

Children

MachOne doesn’t collect information from anyone, including children: it sends me nothing it keeps on your device. If a child has emailed me, a parent can ask me to delete the message, and I will.

Payments

MachOne is free to download. If you first got MachOne before version 3.9.4, every MachOne Pro feature is included at no cost, and MachOne never asks you to pay. Otherwise, MachOne Pro is an optional one-time in-app purchase ($4.99 in the US), with no subscription. Every purchase in MachOne is sold by Apple through the App Store, and Apple handles all payment details. I never see your payment details, name or Apple Account. Apple gives me sales and download reports that don’t identify you. If “Share With App Developers” is turned on in your device’s analytics settings, Apple also gives me crash reports and usage statistics, which Apple says are aggregated or don’t identify you. MachOne may ask you to rate it with Apple’s standard rating prompt; ratings and reviews go to Apple, and reviews are public. Apple’s handling of this data is governed by Apple’s Privacy Policy.

This Website

This website is hosted by Netlify and loads its fonts from Google Fonts, so both receive your IP address and browser details when you visit. On iPhone and iPad, Safari may also ask Apple for MachOne’s App Store details to show a banner on the home page. The website runs no scripts and sets no cookies. The MachOne app uses neither Netlify nor Google Fonts, except that some of its links open this website (see “Links You Tap”).

Changes to This Policy

If this policy changes, the new version will be posted at this address with a new effective date at the top.

Contact

MachOne is made by Corbin Tucker, an independent developer in Georgia, USA. For questions about privacy, or to see or delete an email you sent me: corbintucker@icloud.com